How to Choose a Password Manager: Features That Really Matter

Strong passwords should be long, random and different for every account — but nobody can remember dozens of them. That is exactly the problem a password manager solves. This guide explains what a password manager does, whether it is safe, which features really matter and how to choose and set one up, without recommending any particular brand.

What a password manager does

A password manager is an app or browser feature that keeps your passwords in an encrypted vault. Typically, it can:

• Generate long, random passwords for new accounts.
• Store them securely so you don’t need to remember them.
• Fill them in automatically when you log in.
• Sync your passwords across your devices.
• Warn you about weak, reused or leaked passwords.

You only need to remember one strong password — the one that unlocks the password manager. Government security agencies such as the UK’s National Cyber Security Centre (NCSC) and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recommend password managers because they make it practical to use a different strong password for every account.

Are password managers safe?

For most people, using a reputable password manager is far safer than reusing passwords or writing them down. Reusing passwords is risky: if one account is compromised, attackers can try the same password on your other accounts.

Encryption and the master password, explained simply

Your passwords are stored in encrypted form, which means they look like scrambled data without the key to unlock them. That key is based on your master password (sometimes called a primary password). Many dedicated password managers use a “zero-knowledge” design, which means the provider cannot see your stored passwords.

What happens if the service is breached?

No service is completely immune to attacks. With a well-designed password manager, stolen data is still encrypted, so your master password is your most important protection. Make it long and unique — a passphrase of several random words works well — and turn on two-step verification for the password manager itself. If a provider ever reports a security incident, follow its advice and change your most important passwords.

Features that really matter

Strong encryption and a zero-knowledge design

Look for a provider that clearly explains how your data is encrypted and states that it cannot read your vault. Reputable providers publish this information on their security pages.

Two-step verification

The password manager should support two-step verification (2SV, also called two-factor or multi-factor authentication), such as an authenticator app or a security key. This adds a second check when someone tries to sign in to your vault.

Apps for all your devices and browsers

Check that it works on everything you use — for example, your Windows or Mac computer, your Android phone or iPhone, and your preferred web browsers. Good syncing means a password saved on your laptop is ready on your phone.

Password generator and security alerts

A built-in generator should let you choose the length of new passwords. Security alerts that flag weak, reused or leaked passwords help you fix your riskiest accounts first.

Autofill that helps against phishing

Autofill saves time and adds protection: a password manager normally fills a password only on the website it was saved for, so it won’t fill your bank password on a fake look-alike site. If your password manager doesn’t offer to fill in a password on a site you use, take a moment to check the web address.

Secure sharing and emergency access

If you share accounts with family members or colleagues, look for secure sharing instead of sending passwords by message. Some services also offer emergency access, so a trusted person can reach important accounts if something happens to you.

Free vs. paid: what’s the difference?

Free password managers — including the ones built into browsers and phones — cover the essentials for many people: storing, generating and filling in passwords. Paid plans often add extras such as family sharing, more device types, advanced security reports, secure file storage or priority support. Compare the features you actually need before paying, and check what happens to your data if you stop a subscription.

Built-in password managers vs. dedicated apps

Major browsers such as Chrome, Edge and Safari, and phone operating systems, can save and fill in passwords. According to the NCSC, saving passwords this way is safe on your own devices and is often the easiest option if you use the same browser or system everywhere.

A dedicated (third-party) password manager is often the better choice if you:

• Use a mix of browsers and operating systems.
• Want to share passwords securely with family or a team.
• Want extra features such as detailed security reports or emergency access.

Whichever you choose, never save passwords in the browser on a shared or public computer, and keep your browser and operating system updated, because stored passwords are only as secure as the device and account that protect them.

Checklist: choosing your password manager

• Is the provider well established, with clear security information?
• Does it use strong encryption and a zero-knowledge design?
• Does it support two-step verification for your vault?
• Does it work on all your devices and browsers?
• Does it include a password generator and alerts for weak or leaked passwords?
• Can you share passwords securely, if you need to?
• Can you export your data if you want to switch later?
• Do the free features cover your needs, or is a paid plan worth it?

Read reviews from trusted, independent sources and check each provider’s official website before you decide.

How to set up a password manager safely

1. Download it only from the official website or app store to avoid fake versions.
2. Create a strong master password — for example, several random words — that you don’t use anywhere else.
3. Turn on two-step verification for the password manager account.
4. Save your recovery details (such as a recovery code) somewhere safe, offline if possible.
5. Import or add your passwords, starting with your most important accounts: email, banking and social media.
6. Replace weak and reused passwords using the built-in generator, one account at a time.
7. Remove old copies, such as passwords saved in documents, notes or another browser, once everything works.

FAQ

What if I forget my master password?

Many dedicated password managers cannot recover your vault without the master password or a recovery method you set up in advance — that’s part of what keeps it secure. Set up recovery options when you start, and keep them safe.

Is it safe to keep all my passwords in one place?

With a reputable password manager, a strong master password and two-step verification, it is generally much safer than reusing passwords or storing them in an unprotected file.

Do I still need two-step verification?

Yes. The NCSC describes turning on two-step verification as the first and most important step, because it helps protect your account even if a password is phished or leaked.

Can I switch password managers later?

Usually, yes. Most password managers let you export and import passwords. Delete any exported file securely once the move is complete, because it may not be encrypted.

Final thoughts

A password manager is one of the simplest ways to improve your online security. Start with the one in your browser or phone if it fits your needs, or choose a reputable dedicated app if you use many devices or want to share passwords. Protect it with a strong master password and two-step verification, and replace your weakest passwords first. For more software guides, explore our Software & Apps and Windows & Software sections, and see our guide How to Speed Up a Slow Windows PC. If you use AI chat tools, our explainer What Is Generative AI? explains why you should never paste passwords or other sensitive data into them.

This article is for general information only and does not recommend a specific product. See our Disclaimer for more details.

Sources: National Cyber Security Centre (UK) — Managing your passwords · CISA — Use Strong Passwords