Best Password Managers in 2026: Expert Picks for Free, Paid, Privacy, and Families

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

For most people who are willing to pay, 1Password is the best password manager in 2026. It offers the strongest overall balance of security design, reliable cross-platform apps, passkeys, family sharing, recovery features, and everyday usability. Bitwarden is the best free choice, while Proton Pass is the best privacy-focused option.

However, you may not need a third-party password manager. Apple Passwords is sufficient for many Apple-only households, and Google Password Manager is a sensible no-cost choice for people who stay mainly within Chrome and Android. Technical users who want local control should consider KeePassXC.

This guide is for U.S. consumers and reflects the available plans, documentation, and security developments as of August 10, 2026. Password-manager prices, promotions, app support, and feature names change frequently, so verify the final price and renewal terms before subscribing.

Best password managers at a glance

Best for	Recommendation	Why it stands out	Main drawback
Best paid overall	1Password	Excellent usability, cross-platform support, family sharing, passkeys, Watchtower, and its Secret Key design	No permanent free plan; recovery requires careful handling of the Secret Key and account details
Best free	Bitwarden	Unlimited free vault items, device synchronization, open-source code, and inexpensive upgrades	More utilitarian interface and sometimes more manual autofill setup
Best privacy option	Proton Pass	Open-source apps, end-to-end encryption for vault data and metadata, passkeys, and hide-my-email aliases	Some features work best inside the Proton ecosystem; alias addresses require processing for forwarding
Best for Apple-only households	Apple Passwords	Built into current Apple devices, with passwords, passkeys, codes, Wi-Fi credentials, and shared groups	Less capable outside Apple hardware and less flexible for advanced sharing or recovery
Best for Chrome and Android	Google Password Manager	Free, simple, integrated with Google Accounts, Chrome, Android, autofill, passkeys, and Password Checkup	Less comprehensive for cross-browser sharing, vault organization, emergency access, and portability
Best for security-focused users and business controls	Keeper	Strong authentication options, FIDO2 keys, passkeys, auditing, compliance features, and secure file storage	Personal-plan pricing and add-ons can be confusing or expensive
Best for bundled extras	Dashlane	Monitoring, secure sharing, VPN, and advertised scam and phishing protection in a polished package	More expensive than budget choices; the conventional free plan is gone
Best for local control	KeePassXC	Free, open source, and usable without a required hosted vault	You manage synchronization, backups, mobile access, browser integration, and recovery

Short recommendation: choose 1Password if you want the best paid all-round experience, Bitwarden if you want a capable free or low-cost manager, and Proton Pass if privacy and email aliases are your priorities. Do not choose solely because a product advertises “military-grade encryption” or a large first-year discount.

How these recommendations were judged

There is no objective universal winner. Current expert lists disagree: Tom’s Guide selects 1Password, TechRadar ranks NordPass highly, PCWorld favors Dashlane, and Security.org reaches a different conclusion with RoboForm. Those differences reflect different priorities rather than a single settled technical ranking.

This article uses recommendation labels instead of invented laboratory scores. The editorial framework gives the greatest weight to security architecture and transparency, followed by daily usability:

Category	Weight	What matters
Security architecture and transparency	30%	Client-side encryption, key handling, metadata protection, audits, bug bounties, update history, and public remediation
Autofill and daily usability	25%	Website and app autofill, browser extensions, two-page logins, search, offline behavior, and passkeys
Platform coverage	15%	Windows, macOS, Linux, iOS, iPadOS, Android, ChromeOS, and major browsers
Sharing and recovery	10%	Family vaults, emergency access, account recovery, revocation, and permissions
Value and plan clarity	10%	Permanent free access, annual renewal price, device limits, users, add-ons, and bundled features
Exitability and portability	10%	Import, export, attachments, TOTP secrets, passkeys, and self-hosting options

The evidence is not all the same. Academic research, independent reviews, public audits, vendor technical documentation, and vendor responses to reported vulnerabilities should not be treated as interchangeable. A SOC 2 report or ISO certification, for example, is useful evidence about organizational controls but is not automatically a public cryptographic audit of an app.

1Password: best paid password manager overall

Verdict: Recommended for most users who want a polished, cross-platform manager and are comfortable paying for it.

Why 1Password wins

1Password combines a mature interface with a security design that adds a machine-generated Secret Key to the account password. The two are used together to protect the account, which makes a stolen or guessed account password less useful by itself. It supports Windows, macOS, Linux, iOS, and Android, plus major browsers.

Its feature set includes secure sharing, family vaults, item history, Watchtower security alerts, encrypted document storage, password generation, TOTP codes, and passkeys. The Family plan supports the account holder plus up to five invited family members, making it a good fit for households that want separate private vaults alongside deliberately shared credentials.

1Password publishes security documentation and information about independent assessments, including SOC 2 Type 2 and ISO certifications. See its security model and security-assessment information.

Price and limitations

The August 2026 U.S. pricing snapshot lists Individual at $2.99 per month billed annually or $3.99 billed monthly. Families is listed at $4.49 per month billed annually or $5.99 billed monthly. A 14-day trial is available, but there is no permanent free plan. Check the official pricing page for current renewal terms, taxes, and promotions.

The Secret Key is a 34-character alphanumeric value. It improves the account’s security design but creates a recovery obligation: keep the Emergency Kit or another secure record. The Secret Key is not a replacement for the account password and cannot independently recover a forgotten account password. Read the Secret Key documentation before relying on it.

1Password supports saving and using passkeys in browsers. Passkey-based unlocking of a 1Password test account remains documented as a beta feature with platform limitations, including no Linux compatibility for that account type. That is separate from using 1Password to store passkeys for websites.

Choose it if: you want the best balance of usability, family sharing, security design, and broad platform support.

Skip it if: you need a permanent free plan, insist on open-source client code, or do not have a reliable plan for preserving your Secret Key and account-recovery information.

Bitwarden: best free and budget password manager

Verdict: Recommended for free users, budget-conscious families, open-source advocates, and technical users.

What the free plan includes

Bitwarden’s free plan includes unlimited logins, notes, cards, identities, devices, synchronization, and password generation. That is unusually generous: you can use the vault across devices without paying or being restricted to a small number of stored items.

Premium is listed at $19.80 per year, equivalent to $1.65 per month when annualized. Families is listed at $47.88 per year, equivalent to $3.99 per month, for up to six users. Premium adds integrated TOTP, file attachments, emergency access, security reports, and other features. Verify the live pricing and plan details, since regional terms and taxes can differ.

Security, open source, and self-hosting

Bitwarden publishes its codebase, encryption documentation, compliance information, and bug-bounty details. Its documentation describes AES-256-CBC with HMAC-SHA-256 and supports PBKDF2-SHA-256 or Argon2id for key derivation, depending on configuration and account settings. Bitwarden says it performs annual source-code and penetration testing.

Self-hosting is available. That can reduce dependence on Bitwarden’s hosted service, but it does not make security automatic. A self-hosted user becomes responsible for patching, backups, TLS, server access, uptime, monitoring, and incident response. A badly maintained private server can be a worse choice than a professionally operated hosted service.

Usability trade-off and 2026 research

Bitwarden’s interface is functional rather than luxurious. Autofill and credential capture can require more manual setup than 1Password or other premium rivals, especially with unusual forms, mobile apps, or websites that use multi-step login flows.

A 2026 ETH Zurich and USI study examined Bitwarden under a fully malicious-server threat model and reported 12 distinct attack paths. Bitwarden’s response said seven issues were resolved or in active remediation and three were accepted as intentional design decisions. That is meaningful transparency, but it is not the same as saying every issue was simply “fixed.” The study and response are discussed in detail below.

Choose it if: you want the best free vault, inexpensive premium features, public code, or self-hosting.

Skip it if: you expect the most effortless autofill experience or do not want to spend time configuring and troubleshooting it.

Proton Pass: best privacy-focused option

Verdict: Recommended for privacy-conscious users, people who want email aliases, and existing Proton Mail, Proton VPN, or SimpleLogin customers.

Privacy and encryption

Proton says its apps are open source and that vault contents and metadata—including usernames and URLs—are end-to-end encrypted. Its security documentation describes AES-256-GCM for vault data. The important distinction is that Proton’s privacy model covers encrypted vault data, while hide-my-email alias addresses must be processed to forward mail. Proton’s privacy policy explains that distinction.

The free plan includes unlimited logins, notes, credit cards, devices, password generation, and passkeys, plus 10 hide-my-email aliases. Paid plans add unlimited aliases, integrated 2FA, secure sharing, secure links, dark-web monitoring, and file attachments. Pricing is dynamic and promotion-sensitive, so check the current Proton Pass pricing page before publication or purchase.

Recovery and ecosystem considerations

Proton Pass supports an extra password separate from the main Proton Account password. That can add protection, but it also creates another secret that can be forgotten. Understand whether you are strengthening the threat model or simply adding another recovery dependency; Proton documents the feature here.

The ETH Zurich malicious-server paper did not evaluate Proton Pass. It should therefore not be described as cleared or proven safer by that research. Its open-source apps and published encryption design are positive evidence, not a guarantee against every client, server, recovery, or supply-chain failure.

Choose it if: privacy, encrypted metadata, open-source apps, and email aliases matter more than having the most mature family-administration features.

Skip it if: you want a completely independent ecosystem or do not need aliases and already have a manager with a better fit for your family.

Apple Passwords: best built-in choice for Apple households

Verdict: Recommended for people who use Apple devices almost exclusively and want the least setup.

Apple Passwords is built into iOS 18, iPadOS 18, macOS Sequoia, and visionOS 2. It stores passwords, passkeys, verification codes, Wi-Fi passwords, and shared credentials. It also warns about weak, reused, and compromised passwords. Shared groups let trusted contacts add, view, edit, or delete shared passwords and passkeys.

For Apple-only households, that integration can be more valuable than paying for a separate manager. Users are more likely to accept autofill, passkeys, and password replacement when the feature is already part of the operating system.

There are important sharing limits. Shared groups are designed for trusted contacts, not granular business-style access control. Removing someone does not necessarily erase a password or passkey they have already seen. Apple advises changing the password or passkey when revocation matters; see its shared-password safety guidance.

Windows support is available through iCloud for Windows, but it is not equivalent to the broad, uniform experience of a dedicated cross-platform manager. Apple Passwords is less attractive if your household includes Android phones, Linux computers, Windows PCs, non-Apple browsers, or complex emergency-access requirements.

Choose it if: everyone uses current Apple hardware and you mainly need passwords, passkeys, codes, and straightforward trusted sharing.

Skip it if: your devices span Apple, Windows, Android, and Linux, or your family needs granular vault administration and formal emergency access.

Google Password Manager: best built-in choice for Chrome and Android

Verdict: Recommended for Chrome and Android users who want a free, low-friction solution.

Google Password Manager creates and saves passwords and passkeys, autofills on websites and apps, and synchronizes through a Google Account. Password Checkup identifies exposed, weak, and reused passwords. Google documents both account-based and on-device password-management options and recommends recovery information and 2-Step Verification for protecting the Google Account.

It is a sensible choice if nearly all your browsing happens in Chrome and your mobile devices run Android. It is less compelling when you need broad cross-browser access, Linux support, detailed vault organization, secure attachments, family collections, emergency access, or a carefully tested export and migration workflow.

Google Password Manager is not automatically less safe simply because it is built in. The practical question is whether it covers your devices and whether you will use its password generation, autofill, passkeys, and security checks consistently. Its main weakness is a narrower feature and sharing model compared with dedicated managers.

Choose it if: you are deeply invested in Google, Chrome, and Android and do not need advanced sharing or local-only control.

Skip it if: you regularly switch browsers or ecosystems, want a separate vault with richer administration, or need family emergency-access features.

Keeper: best for security-focused and business-oriented users

Verdict: Recommended for users and organizations that value extensive authentication, auditing, compliance, and administration controls.

Keeper documents a zero-knowledge architecture, AES-256 encryption, elliptic-curve cryptography, MFA, biometrics, passkeys, and FIDO2 hardware-key support. KeeperFill supports passwords, passkeys, payment cards, addresses, and TOTP codes across browsers and mobile apps. Its business-oriented features include audit reporting and compliance certifications; Keeper says it holds SOC 2 Type 2 and ISO 27001, 27017, and 27018 certifications.

Consumer plans include different limits. The free plan allows up to 10 passwords or passkeys on one mobile device and does not synchronize across devices. The Unlimited plan adds unlimited passwords, devices, autofill, sharing, password generation, MFA, and emergency access. The Family plan offers up to five private vaults and 10 GB of secure file storage. Breach monitoring and extra storage may be add-ons, so compare the exact checkout total rather than assuming an enterprise feature is included in a personal subscription.

Keeper’s controls can add friction, which is often reasonable in security-heavy environments but unnecessary for a user who only wants easy password autofill. Its consumer pricing can also be more complicated than Bitwarden’s or 1Password’s.

Choose it if: you need stronger administrative controls, FIDO2 keys, auditability, secure file storage, or a business-compatible security posture.

Skip it if: you want the simplest inexpensive household manager and do not need its extra controls.

Dashlane: best for bundled security extras

Verdict: Recommended for users who want password management, monitoring, VPN access, and advertised phishing or scam protection in one subscription.

Dashlane’s paid plans include unlimited password storage, device access, autofill, secure sharing, passkeys, Password Health, and dark-web monitoring. Its current personal pricing page also advertises AI-powered Scam Protection and real-time phishing alerts. Premium includes a VPN. The Friends & Family plan covers up to 10 accounts, although family members do not receive the VPN according to the current comparison information.

PCWorld’s April 2026 review listed Advanced at $33 per year, Premium at $59.88 per year, and Friends & Family at $89.88 per year. Treat those as a dated reference rather than a guaranteed current price: check Dashlane’s live pricing page, renewal cost, taxes, and any promotion before subscribing. The conventional permanent free plan was discontinued in September 2025 according to PCWorld’s 2026 coverage.

Dashlane and the 2026 malicious-server research

Dashlane publicly responded to the ETH Zurich findings. It said Extension version 6.2544.1, released November 5, 2025, addressed the relevant legacy-cryptography downgrade issue by removing support for that legacy cryptography, and said it had no evidence of exploitation related to the findings. That is a vendor response to a specific issue, not proof that the product is immune to other threats.

Choose it if: you value a polished interface and will actually use its monitoring, VPN, and phishing/scam features.

Skip it if: you already pay for a VPN or breach-monitoring service, want a permanent free tier, or prefer the lowest recurring cost.

NordPass: a streamlined paid alternative

Verdict: Recommended with caveats for users who prioritize a simple interface and are willing to pay for simultaneous multi-device access.

NordPass supports major desktop and mobile platforms and browsers. Paid plans add simultaneous device access, password health, breach scanning, email masking, secure sharing, attachments, and emergency access. Its security documentation describes XChaCha20-Poly1305-IETF, X25519, XSalsa20, Poly1305, and Argon2id.

The free plan permits only one active session at a time on one device, which substantially limits its usefulness for a household or anyone who moves between a phone and computer. Pricing is heavily promotion-dependent. Do not mistake a discounted first term for the standard renewal price.

NordPass is a serious contender for people who dislike utilitarian interfaces, but much of the available security evidence is vendor-supplied. Distinguish those technical claims from an independently published audit when comparing it with products that publish more extensive assessment information.

Choose it if: ease of use, email masking, and cross-platform support matter more than having the best free plan.

Skip it if: you need a genuinely useful free plan across several devices or want pricing that is easier to predict.

KeePass and KeePassXC: best for local control

Verdict: Recommended for technically capable users who prefer a local vault and do not want a required hosted password-manager account.

KeePass and KeePassXC are free and open source. They store an encrypted vault locally, so you can choose where the file lives and how it is synchronized. This can reduce dependence on a provider’s hosted infrastructure and may suit users with unusual privacy or offline requirements.

The trade-off is responsibility. You must arrange secure synchronization between computers and phones, maintain encrypted backups, update the software, configure browser integration, handle mobile access, test recovery, and make sure family members can use the vault when necessary. A local vault can still be lost, corrupted, copied, or exposed through careless backups.

KeePassXC is not automatically more secure than a cloud manager for every user. If self-management causes missed updates, bad backups, or password reuse because autofill is inconvenient, the theoretical control may produce a worse practical result.

Choose it if: you understand files, backups, encryption, synchronization, and recovery and want maximum control over storage.

Skip it if: you want effortless mobile autofill, family sharing, or provider-managed recovery.

Are password managers safe in 2026?

Generally, yes: a reputable password manager is usually safer than reusing passwords, keeping them in a spreadsheet, or storing them in plain text. But password managers are not risk-free, and different products make different security and recovery trade-offs.

The main benefit is structural. A manager can generate a different, long password for every website, store it, and fill it only when the domain and app context look appropriate. The result limits the damage when one website is breached. NIST’s SP 800-63B-4 guidance recognizes password managers as a way to create and maintain distinct passwords, while cautioning that implementations should be evaluated rather than treated as equally secure by default.

What a password manager protects against

• Reused passwords exposed by a breach at another service.
• Weak or predictable passwords.
• The practical difficulty of remembering hundreds of unique credentials.
• Some phishing mistakes, when domain-aware autofill refuses to fill on the wrong website.
• Lost notes, spreadsheets, and browser tabs containing credentials.

What it does not fully protect against

• Malware on an unlocked or compromised device.
• A malicious browser extension that can inspect pages or interfere with autofill.
• A compromised email account that controls recovery, alerts, or password resets.
• Social engineering or approving a malicious login yourself.
• Credentials that have already been viewed, copied, or shared with another person.
• A provider or client that mishandles key distribution, recovery, sharing, metadata, or updates.

Encryption algorithms are only one part of the design. AES-256 does not make a password manager unhackable. Key derivation, authentication, integrity checks, recovery, client updates, browser-extension behavior, server integrity, and your master password matter just as much.

What zero-knowledge really means

“Zero-knowledge encryption” is widely used by password-manager vendors, but it is an industry term rather than one strict, universal cryptographic guarantee. A 2026 paper from ETH Zurich and USI specifically highlights that ambiguity.

• Encrypted in transit means network traffic is protected while moving between your device and a service.
• Encrypted at rest means stored data is encrypted on a server or device.
• Client-side encryption means vault data is encrypted on your device before upload.
• End-to-end encryption generally means the provider is not supposed to see plaintext vault contents.
• Zero-knowledge is a vendor claim that must be examined through key handling, metadata, recovery, sharing, and server behavior.

The more useful question is: if the provider’s storage server were compromised or malicious, what could an attacker make the client do, and what data could the attacker recover? Read the ETH/USI research paper and the ETH Zurich summary for the technical context.

What the 2026 ETH Zurich study found

The researchers examined Bitwarden, LastPass, and Dashlane under a fully malicious-server threat model. They reported:

• 12 distinct attacks against Bitwarden.
• 7 attacks against LastPass.
• 6 attacks against Dashlane.
• Consequences ranging from targeted vault-integrity violations to organization-wide compromise.
• A majority of the attacks allowed password recovery.

This does not mean that an ordinary thief can instantly decrypt every password-manager vault. The researchers assumed control of the password-manager server and the ability to make it behave maliciously. That is an unusually severe scenario, but it matters because providers often promise protection even if their servers are breached.

The study did not test every leading manager. Proton Pass, NordPass, Keeper, RoboForm, Apple Passwords, and Google Password Manager should not be described as cleared by this research. A research finding and a vendor’s later remediation statement are also separate pieces of evidence.

Bitwarden said the issues were addressed and characterized the fully compromised-server scenario as hypothetical with medium- and low-impact findings. Its published response says seven issues were resolved or in active remediation and three were accepted as intentional design decisions. Read Bitwarden’s response rather than reducing it to an unqualified claim that everything was fixed.

Dashlane said it released Extension version 6.2544.1 on November 5, 2025, removed support for the legacy cryptography involved in a downgrade attack, and found no evidence of exploitation related to the findings. Its response describes the remediation.

Browser extensions and malware remain important

Password-manager extensions can see pages and participate in autofill, so they are useful security components and attack surfaces at the same time. Research has documented clickjacking and autofill risks affecting browser extensions. The CERT/CC vulnerability note and USENIX research support keeping extensions updated and using autofill carefully.

A password manager also cannot guarantee protection after credentials have been decrypted on an infected device. Research published in 2025 found plaintext credential exposure in system memory across multiple password-manager applications and browser plugins. That is a threat-model finding, not proof that every product is equally vulnerable today, but it illustrates why endpoint security matters.

Password managers and passkeys are complementary

Passkeys use public-key cryptography and are tied to a service’s domain. They are designed to resist phishing because the private key is not submitted to a lookalike website. The FIDO Alliance’s passkey explanation provides the underlying model.

A passkey is not simply another password stored in a vault. The buying questions are different:

• Can the manager save and use passkeys in your browsers and mobile apps?
• Can passkeys be synchronized across your devices?
• Can passkeys be exported or moved to another provider?
• Can you use a passkey to unlock the password manager itself?
• Does the website support passkeys correctly on your operating system and browser?
• What happens if you lose a device or the account that synchronizes your passkeys?

Device-bound passkeys and synced passkeys have different recovery and portability properties. Device-bound keys can reduce synchronization exposure but make device loss more consequential. Synced passkeys are easier to recover across devices but make the synchronizing account and its recovery process especially important.

1Password supports saving and using passkeys in browsers. Proton Pass supports passkeys across devices. KeeperFill advertises support for passwords, passkeys, payment cards, addresses, and TOTP codes. Apple Passwords and Google Password Manager both support passkeys as first-party features. A manager may support passkeys generally while still failing on a particular website because of browser, operating-system, or website implementation limitations.

Passkeys do not eliminate the need for a password manager or secure credential store. You may still need one for websites without passkeys, recovery codes, TOTP seeds, secure notes, identity details, payment data, and family-shared credentials.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

Built-in managers versus dedicated password managers

Need	Apple Passwords	Google Password Manager	Dedicated manager
Best ecosystem	Apple devices and Safari	Chrome, Android, and Google Accounts	Mixed Apple, Windows, Android, Linux, and browser environments
Passwords and passkeys	Yes	Yes	Usually yes, but compatibility varies
Family sharing	Shared groups for trusted contacts	Less central and less advanced	Shared vaults, collections, or family plans vary by product
Emergency access	Limited compared with dedicated tools	Not a central feature	Available in products such as 1Password, Bitwarden, Keeper, and NordPass paid plans
Cross-platform use	Limited outside Apple; Windows support through iCloud for Windows	Best within Google and Chrome	Usually the strongest reason to choose one
Portability and organization	Basic to moderate	Basic to moderate	Folders, tags, secure notes, attachments, histories, and export options vary
Cost	No separate subscription	No separate subscription	Free tiers, trials, or paid subscriptions depending on product

A paid manager is not automatically more secure for someone who will not use it consistently. If Apple Passwords or Google Password Manager works across all your devices, generates unique passwords, fills only on the correct sites, supports your passkeys, and gives you an adequate recovery plan, it may be enough.

How to choose the right password manager

1. Want a capable permanent free plan? Start with Bitwarden.
2. Use only Apple devices? Try Apple Passwords first.
3. Use mainly Chrome and Android? Google Password Manager is the easiest no-cost choice.
4. Want the best paid all-rounder? Choose 1Password.
5. Want open-source apps, encrypted metadata, and aliases? Choose Proton Pass.
6. Need business controls, FIDO2 keys, auditing, or compliance features? Evaluate Keeper or a business-focused plan.
7. Want VPN and monitoring bundled with the manager? Consider Dashlane, but compare the total subscription cost with services you already own.
8. Want a local-only vault? Choose KeePassXC only if you are prepared to manage synchronization, backups, and recovery.
9. Need the simplest polished family experience? Compare 1Password Families, Bitwarden Families, and Keeper’s family plan based on the number of users, sharing permissions, attachments, and emergency access you actually need.

How to set up a password manager safely

1. Create a long, unique master password or passphrase. Never reuse it anywhere else. A sequence of several unrelated words is easier to remember than a short complicated password.
2. Enable MFA. Prefer a FIDO2 security key or a phishing-resistant passkey where the manager supports it. An authenticator app is generally preferable to SMS when those are the available choices.
3. Save recovery codes and account-recovery information offline. Keep them somewhere secure and accessible if your phone is lost. For 1Password, preserve the Emergency Kit and Secret Key; remember that the Secret Key cannot replace the account password.
4. Install only official apps and extensions. Use the vendor’s website or the official Apple, Google, Microsoft, or browser store. Keep the apps and extensions updated.
5. Import existing passwords carefully. Browser exports and CSV files are often plaintext. Use an encrypted import path where available and delete temporary files securely after confirming the import.
6. Protect the password-manager account and primary email first. Change the email account, password manager, banking, and primary identity credentials before working through less important accounts.
7. Replace reused passwords with generated passwords. Start with email, financial, health, cloud-storage, shopping, social-media, and work accounts.
8. Add TOTP codes thoughtfully. Keeping TOTP in the same manager is convenient and protects against losing a separate authenticator. A separate authenticator can provide more separation if your threat model justifies the extra recovery burden.
9. Configure emergency access. Choose a person who can actually help, understand the waiting period and permissions, and avoid granting access to every vault item unless necessary.
10. Test recovery and export. Confirm that you can sign in on a second device, recover the account, and produce an export you can actually read and restore.
11. Clean up old storage. Disable or review old browser password storage, delete spreadsheets and notes containing passwords, and remove duplicate or plaintext exports.
12. Review the vault after 30 days. Fix failed autofill entries, remove obsolete accounts, verify shared-vault permissions, and make sure recovery information is still available.

Important failure modes and recovery steps

You forgot the master password

In a genuine zero-knowledge design, the provider may not be able to reset the master password and reveal the vault. Do not confuse these different mechanisms:

• Password reset: changes an account credential, often without decrypting an existing vault.
• Account recovery: a product-specific process that may allow a trusted person, device, or recovery code to restore access.
• Emergency access: delegated access under defined conditions; it is not always immediate.
• Device-based unlock: a device may remain able to open a locally cached vault, but that does not necessarily recover the account on a new device.
• Recovery codes: one-time credentials that must be stored securely and may not recover the vault by themselves.

Before switching managers, test the exact recovery process. A second unlocked device is helpful, but it should not be your only plan.

Your phone is lost or stolen

1. Revoke or deauthorize the missing device from the manager’s account page.
2. Revoke active sessions and change the manager account password if compromise is possible.
3. Secure the email account that controls alerts and recovery.
4. Rotate the most sensitive credentials if the phone was unlocked or its local vault may have been accessible.
5. Review passkeys, TOTP codes, recovery codes, and emergency-access contacts.
6. Replace the phone’s carrier, device, and account protections as appropriate.

Your email account is compromised

Email often controls password-manager registration, billing, security alerts, and password resets. Protect it with a unique password, phishing-resistant MFA or a hardware security key, offline recovery codes, and carefully reviewed recovery email and phone settings.

A browser extension looks suspicious

Check that the extension came from the official vendor and browser store, update it, and review its permissions. Where the browser allows it, restrict site access. Consider disabling automatic autofill in high-risk environments and use confirmation-based filling instead. Do not install unknown extensions alongside a password manager, and do not paste credentials into an unfamiliar domain when domain-aware autofill refuses to fill.

A family member leaves

Removing a person from a family plan or shared collection does not guarantee that they forgot a credential they previously viewed. Shared credentials may need to be changed. Separate private vaults from deliberately shared collections, grant editing rights only when necessary, and treat sharing as delegation—not as a substitute for rotating a password.

Exporting and leaving a password manager

Exitability is an important buying criterion because a password manager becomes a long-term dependency. Before committing, check whether the export includes:

• Secure notes and identity fields.
• TOTP seeds and recovery codes.
• Attachments and documents.
• Shared items and permissions.
• Item history or deleted items.
• Passkeys.
• Folders, tags, and custom fields.

Do not assume passkeys are portable just because passwords are. Passkey export and transfer depend on the provider, operating system, browser, passkey type, and website. Also do not assume a CSV export is secure: it is often readable plaintext. Prefer an encrypted export where supported, store it temporarily offline, and securely delete any plaintext copy after migration.

Test an export before cancelling the old subscription. Import a small sample into the replacement manager, verify notes, TOTP, identities, attachments, and shared records, then migrate the rest. Keep an encrypted backup and document how a trusted person could access essential household information if you become unavailable.

Cloud-based versus local password managers

“Cloud-based” does not necessarily mean “online-only.” Many hosted managers cache an encrypted vault locally, so existing devices can often work offline. Initial login, adding a new device, sharing, breach monitoring, and synchronization generally require connectivity.

A local manager such as KeePassXC can work offline by design, but synchronization and recovery become your responsibility. A cloud manager introduces provider and server risks but can deliver professional backups, device synchronization, account recovery tools, and family access. Choose based on the threat model you can operate safely, not on the assumption that local automatically means secure.

Why LastPass is not a default recommendation here

LastPass still advertises zero-knowledge architecture, but trust history matters. The official settlement site documents litigation related to the 2022 data-security incident, and 2026 reporting described a separate third-party incident involving customer-support case data.

That does not establish that every current LastPass control is ineffective. It does mean new users have several alternatives with stronger current editorial fit and less trust baggage. This guide does not include LastPass among the default recommendations for new users; existing customers should review current security controls, update software, rotate especially sensitive credentials where appropriate, and decide whether the convenience is worth the trust penalty.

Final recommendations by user type

• Most paying users: 1Password.
• Most free users: Bitwarden.
• Privacy-first users: Proton Pass.
• Apple-only households: Apple Passwords.
• Chrome and Android households: Google Password Manager.
• Security-heavy personal or business environments: Keeper.
• Users wanting monitoring and VPN extras: Dashlane.
• Users wanting a streamlined paid alternative: NordPass.
• Technical users wanting local control: KeePassXC.

The most important upgrade is not switching to a particular brand. It is using a unique generated password for every important account, protecting the manager and email account with strong MFA, keeping recovery information safe, and reviewing how sharing and exports work before an emergency.

Frequently Asked Questions

What is the best password manager for most people in 2026?

1Password is the best paid all-round choice for most people because it combines strong account protection, mature apps, reliable cross-platform support, passkeys, family sharing, and useful security alerts. Bitwarden is the better choice if you need a permanent free plan.

Are password managers safer than saving passwords in a browser?

A reputable password manager is generally safer than password reuse, spreadsheets, notes, or plaintext files because it can generate unique credentials and reduce phishing and breach damage. Built-in Apple and Google managers can also be sufficient when they cover your entire ecosystem and you use them consistently. No manager fully protects an unlocked, malware-infected device or a compromised email account.

What happens if I forget my password-manager master password?

A true zero-knowledge provider may be unable to reset it and reveal your vault. Recovery depends on the product and may involve a trusted device, recovery code, emergency contact, or account-recovery process. Set up and test recovery before you need it; a 1Password Secret Key, for example, cannot replace the account password.

Should I store passkeys in a password manager?

It can be useful, especially when you need passkeys across multiple devices, but check whether the manager supports your browser and whether passkeys can be exported or recovered. Passkeys are designed to resist phishing, yet device loss, synchronization, and account-recovery risks still matter.

Is Bitwarden still a safe choice after the 2026 ETH Zurich research?

The ETH/USI study reported 12 attack paths against Bitwarden under an unusually severe fully malicious-server threat model. Bitwarden published a response saying seven issues were resolved or in active remediation and three were accepted as intentional design decisions. The finding is a reason to keep the app updated and evaluate vendor transparency—not a conclusion that ordinary users can have every vault instantly decrypted.

The Bottom Line

Bottom line: Choose 1Password if you want the best paid balance of security and usability, Bitwarden if you want the best free or budget option, and Proton Pass if privacy and email aliases are central. Apple Passwords and Google Password Manager are good enough for many single-ecosystem users. Whichever tool you choose, enable strong MFA, protect your email account, save recovery information offline, update apps and extensions, and test your export and recovery plan.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.