Password managers: what to look for before you commit
Most people reuse a handful of passwords across dozens of accounts. That is understandable, because remembering hundreds of unique logins is not realistic. A password manager solves this by storing your credentials in an encrypted vault, so you only need to remember one strong master password. This guide explains what to check before choosing one, whether you use it alone or with a small team.
What a password manager actually does
It generates long random passwords, saves them, and fills them in on the right sites. Many also store secure notes, card details and one-time code generators. A good manager also warns you when a site you use has been involved in a known data breach, or when you have reused a password.
Current guidance from the US standards body NIST points in the same direction: sites should accept password managers and autofill, should not force arbitrary composition rules such as "one capital and one symbol", and should favour length. For passwords used on their own, NIST's current digital identity guidelines set a minimum of 15 characters. A manager makes long, unique passwords painless, which is the whole point.
Criteria that matter
- Encryption model. Look for a vendor that says the vault is encrypted on your device before it is synced, so the company itself cannot read your data. Check that this is documented on its security page, not only on the marketing page.
- Sharing. If you work with a partner, a freelancer or staff, you need a way to share a login without pasting it into chat. Shared folders with permissions are better than a shared spreadsheet.
- Two-step verification and passkeys. Check that the manager supports hardware keys or an authenticator app for its own login, and that it can store passkeys. NIST notes that passwords on their own are not phishing-resistant, so passkeys or security keys are worth using where a site offers them.
- Recovery. Find out what happens if you forget the master password. Some services cannot recover your vault at all, which is secure but unforgiving. Decide on a recovery method before you need it.
- Platforms. It should work on your phone, your browser and your computer, and export your data in a standard format so you can leave later.
- Admin controls. For a team, look for the ability to remove access quickly when someone leaves, and to see who has access to what.
Common mistakes
- Choosing a weak master password. Use a long passphrase that you have never used anywhere else.
- Importing everything and never cleaning up. Replace the passwords for your email, bank and domain registrar first, because those accounts can reset all the others.
- Leaving the emergency kit unprinted. Store recovery codes somewhere offline.
- Sharing one login for everything. Individual accounts make it possible to revoke access without changing everything.
- Ignoring the manager's own security alerts.
A sensible way to start
Pick one service, set a long master password, turn on two-step verification, and move your most important accounts first. Then migrate the rest gradually over a few weeks. Many providers offer a free tier or a trial, so you can test the interface with your own workflow before paying. Compare the details on each vendor's own site, because plans and features change.
No tool removes all risk. A manager reduces the damage from reused passwords and phishing attempts, but you still need to keep your devices updated and be careful about the links you click.
Some links are affiliate links: we may earn a commission at no cost to you. Learn more.