iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
You do not have to choose one replacement for a password manager. Passkeys, a browser or operating-system credential manager, and a local or self-hosted vault solve different problems—and can work together. Use passkeys for accounts that support them, built-in storage if it fits your devices and recovery needs, and a vault when you need broader storage, organization, sharing, or control. Self-hosting makes sense only if you are also prepared to maintain and recover the server.
What counts as a password manager alternative?
“Alternative” can mean several things: a different way to sign in, a place to save credentials, or a different way to operate the software that stores them. Passkeys change how a supported account authenticates you. Browser and operating-system managers save and provide credentials. A local vault or self-hosted service changes where the vault is kept and who is responsible for its operation.
Those categories overlap, but they are not interchangeable. A passkey can replace a password for a particular account without storing all your other passwords. A built-in manager can save passwords and passkeys, but its device coverage and features depend on the provider. A self-hosted vault can give you more control over the service and its data, while making you responsible for server maintenance and recovery.
FIDO Alliance describes a passkey provider as responsible for creating and managing a user’s passkeys. The provider might be built into a browser or operating system, or come from a third-party manager. That means the choice is not simply “passkeys or password manager”: the provider is part of how you use and keep passkeys.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
How do passkeys differ from saved passwords?
A passkey is a credential managed by a provider and used by a compatible website or app; it is not merely a password stored for autofill. Whether you can use it on another device depends on whether it is synced through a provider or tied to one physical device.
Synced and device-bound passkeys
With a synced passkey, a provider can make the credential available on other devices connected to that provider. Google’s documentation describes passkeys being encrypted locally before sync. The exact devices, browsers, and sign-in flows that work depend on the provider and the service.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →A device-bound passkey stays on one physical device rather than syncing through a provider account. Microsoft distinguishes this type from synced passkeys in its Microsoft Entra documentation. A FIDO2 security key is one possible physical option for device-bound credentials on services that support it. It is an optional sign-in component, not a replacement for storing conventional passwords or planning account recovery.
What passkeys do—and do not—replace
Passkeys can remove the need to enter a password for an account that supports them and for which your provider and device are compatible. They do not make every website accept passkeys, and adopting them does not automatically take care of accounts that still use passwords or other sensitive information you want to store. A vault may still be useful for those credentials and recovery information.
Before relying on a passkey as your only way into an important account, check what recovery options that service offers and what happens if you lose access to the device or provider account. A device-bound credential has a different portability and loss scenario from one synced through a provider. Do not assume that a passkey stored on one device will be available on another.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Should I use a dedicated password manager or my browser’s password manager?
Use the option that works across the devices and browsers you actually use, and that offers the storage and recovery features you need. Built-in storage can be convenient in an established ecosystem; dedicated managers often offer a broader set of features, but no single comparison applies to every product.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsGoogle documents Google Password Manager availability across Chrome and Android environments, along with platform-specific provider behavior. Microsoft’s provider information also illustrates that built-in choices and requirements vary by operating system. These examples are not a guarantee that every browser, operating system, or service supports the same features.
When built-in storage is a good fit
- Your devices already use a compatible browser or operating-system ecosystem, and its credential provider is available where you need to sign in.
- You primarily need convenient saving and autofill rather than a particular set of additional features.
- You understand how to recover the provider account and how credentials will be available if you change devices.
Privacy Guides describes the general trade-off as integration and convenience versus the broader features often found in dedicated managers. Treat that as a starting point, not a rule that built-in storage is inherently unsafe or that every standalone manager is automatically better. Compare the actual products and platforms in your household, including how each handles sharing, organization, and storage beyond logins.
When a dedicated manager may fit better
A dedicated manager may be worth considering if you need capabilities that your built-in option does not provide, such as a particular organization or sharing arrangement, support across a mix of devices, or storage for more than logins. Feature availability varies, so verify that the specific manager supports the browsers, operating systems, and account-recovery needs you depend on.
Whichever approach you choose, account recovery is part of the decision. Ask what happens when you lose a device, cannot reach a provider account, or move to a different platform. Convenience on your current phone is not enough if the credentials cannot be recovered or used when your setup changes.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What is the difference between a local vault and a self-hosted vault?
A local vault keeps an encrypted vault file under your control; a self-hosted vault runs a server or service that you operate. Both can offer more direct control than relying entirely on a provider’s hosted service, but they shift different responsibilities to you.
Local or offline vault
A local vault such as KeePassXC can appeal if you want to keep an encrypted vault file under your own control. The trade-off is that synchronization, backups, and recovery are user-managed in the comparison described by The Privacy Cookbook. You need a deliberate plan for getting the file to the devices where you need it and keeping a recoverable copy. Do not assume that a local file is automatically backed up or that an available copy has been tested for restoration.
Self-hosted service
A self-hosted service runs on infrastructure you administer. Bitwarden’s self-host documentation describes several deployment paths, including standard server deployment and manual, offline, Lite, and Kubernetes options. Their skill requirements differ, and choosing one means taking responsibility for the server and its supporting infrastructure.
Self-hosting changes who operates the service; it does not remove operational risk. Bitwarden’s setup checklist calls out networking, certificates, updates, security review, backups, disaster recovery, monitoring, and user support. If you cannot confidently cover those jobs—or do not have someone who can—self-hosting may create more risk and work than it removes.
How should I compare these options?
Compare them against your sign-in needs, devices, recovery plan, and willingness to administer infrastructure. A provider or setup that works well for one person may be a poor fit for a household or a mixed-device setup.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
| Option | What it does | Key decision | Responsibility to plan for |
|---|---|---|---|
| Passkey provider | Creates and manages passkeys used by compatible services; the provider may be built in or supplied by a third party. | Are passkeys supported, and do you want synced credentials or device-bound ones? | Provider access, device compatibility, and recovery if a device or account is unavailable. |
| Browser or operating-system storage | Provides built-in credential storage and may also manage passkeys. | Does it work across the browsers and devices you actually use, with the features you need? | Provider-account recovery and access when you change or lose devices. |
| Local vault | Keeps an encrypted vault file under your control. | Are you prepared to manage synchronization, backups, and recovery yourself? | Secure file handling, reliable backups, and tested restoration. |
| Self-hosted vault | Runs a vault service on infrastructure you operate. | Can you maintain the chosen deployment and support the people using it? | Server security, updates, monitoring, backups, disaster recovery, and user support. |
Check device and browser coverage
List the devices and browsers you expect to use, including any less frequently used computer where you may need account access. Check the current provider and service requirements for each combination. Microsoft Entra’s platform requirements apply to that Microsoft service; they should not be treated as a universal compatibility list for other websites and apps. Platform support and minimum versions can change, so confirm current requirements before depending on a particular setup.
Decide who owns recovery
For a provider-based setup, consider recovery of the provider account and the availability of synced credentials on replacement devices. For a local vault, you own the file and its backup process. For a self-hosted service, you own the service’s backup and restoration procedures as well as the infrastructure. In each case, a backup is useful only if you can access it and restore it when needed.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Consider sharing and portability
If more than one person needs access, check whether the specific option supports your intended sharing arrangement and how that sharing works. Do not infer family or team features from the label “password manager.” Similarly, test whether credentials can be moved or accessed on your next device before a change becomes urgent. Export options differ, and an export may expose sensitive data.
How do you start using a safer combination?
You can adopt these options gradually. Start with the accounts and devices that matter most, verify that you can recover access, and keep a vault for credentials and information that passkeys do not cover.
- Inventory the accounts and devices you rely on. Note which accounts support passkeys, which devices and browsers you use, and whether anyone else needs access to credentials.
- Choose a provider that fits your devices. Check current compatibility information for the provider and the services you use. If using a device-bound passkey, decide how you will handle device loss or replacement.
- Enable passkeys account by account where supported. Follow the sign-in and security settings provided by the site or app. Do not assume a passkey is available just because your device can store one.
- Keep a way to handle accounts that still use passwords. Use suitable credential storage for those accounts and for other sensitive information you need to retain.
- Plan and verify recovery before relying on the setup. Confirm how to regain access to the provider or vault, and make sure any backup or recovery method is actually available to you.
- If choosing a local or self-hosted vault, test the operational plan. For a local file, verify how it will be synchronized and backed up. For a self-hosted service, use the instructions for the exact deployment and test a restoration rather than assuming a backup is usable.
What should you know about exports and backups?
Exports are a portability tool, but they can also create an exposed copy of your credentials. Bitwarden documents both plaintext and encrypted export formats and warns against unsafe handling of unencrypted exports. Treat any plaintext export as sensitive: protect it while it exists, avoid leaving it in an ordinary downloads folder or shared location, and remove temporary copies when they are no longer needed.
Best Value
- POWERFUL SECURITY KEY: The YubiKey 5 is a versatile physical passkey that protects your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 secures 100+ of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 via USB and tap it to authenticate. No batteries, no internet connection, and no extra fees required.
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Backups and exports are not the same thing. An export helps move vault data between products or formats; a server backup is part of recovering an operated service. Bitwarden states that self-hosted administrators are responsible for their backup procedures. Its documentation also says that the Lite deployment does not take nightly backups, so operators must manage those processes themselves. Backup behavior differs by deployment: consult the instructions for the one you run and test restoration.
When is self-hosting the wrong choice?
Self-hosting is a poor fit if you want a service that requires little administration, cannot reliably apply updates, or do not have a tested plan for backup and disaster recovery. It is also a poor fit when the person who understands the deployment is the only person who can restore it, unless you have accepted that recovery constraint.
Before selecting a deployment, make sure you can handle its network access, certificates, updates, monitoring, security review, and user support. The available Bitwarden deployment methods have different skill requirements; choosing a more specialized method does not make the underlying responsibilities disappear. If you are unwilling or unable to own those tasks, a built-in or hosted option may be a better practical choice.
Which option should you choose?
- Choose passkeys for supported accounts when your provider and devices are compatible and you have a recovery plan. You can use them alongside other credential storage.
- Choose built-in storage when it fits your browser and operating-system ecosystem and supplies the organization, sharing, and recovery features you actually need.
- Choose a local vault when keeping an encrypted file under your control is important and you are willing to manage synchronization, backups, and recovery.
- Choose self-hosting only when you are prepared to operate and recover the server, not merely install it.
There is no need to force every account into one method. A practical setup can use passkeys where supported, a credential manager for passwords and other stored information, and a recovery plan suited to the provider or vault you chose.
Frequently Asked Questions
Can I use a passkey on a computer that does not store it?
Some supported sign-in flows let you use a nearby phone that holds the passkey to authenticate on another device. Google documents this cross-device option, but its availability depends on the site or app, provider, and compatible devices.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Can I connect existing apps to a self-hosted vault?
Client connection is a separate setup step from deploying the server. Bitwarden documents instructions for connecting individual clients to a self-hosted instance; follow the current instructions for the specific client and deployment you use.
Should I delete my old vault after exporting it?
Not until you have confirmed that the destination contains the credentials and information you need and that you can access them. If the export was plaintext, handle and remove the temporary file carefully because it can expose the vault contents.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
