How to choose the right password manager, and what really matters
A password manager is the easiest step towards better security. These 7 points help you find the right one for you, your family or your business.
Most accounts are not cracked by sophisticated hackers, but because the same password is used in several places. When an online shop is hacked, attackers automatically try the stolen login details at email providers, banks and social networks. Our password checker shows whether one of your passwords is affected.
A password manager solves the problem: it creates a unique, random password for every account, stores it encrypted and fills it in automatically when you log in. You only need to remember a single master password.
1. Zero-knowledge encryption
The most important criterion. Your data should be encrypted on your device before it reaches the provider. The provider itself then cannot read it, nor can its employees or an attacker who breaks into its servers. Reputable providers explain on their website exactly how their encryption works.
2. Independent security audits
Good providers have their software reviewed regularly by external security firms and publish the results. Open-source programs have the added advantage that anyone can inspect the source code.
3. All your devices
A password manager is only useful if it works everywhere: on your computer as a browser extension and on your phone as an app with autofill. Before deciding, check that all your devices and browsers are supported.
4. Two-factor login
Access to the password manager itself should be protectable with a second factor, such as an authenticator app or a hardware key. It is also handy if the manager can store two-factor codes for your other accounts.
5. Sharing with family or team
For families and small businesses, shared use is crucial. Instead of sending the Wi-Fi or social media password around via WhatsApp, you put it in a shared folder. When someone leaves the team, you revoke access with one click.
6. Emergency access
What happens if you forget your master password? With true zero-knowledge encryption, the provider cannot reset it. Good managers therefore offer a recovery key to print out or an emergency contact who gets access after a waiting period.
7. Privacy and headquarters
For businesses in the EU, it can matter where the provider is based and where the data is stored. With zero-knowledge encryption this is less critical because the provider cannot read the contents. Still, it is worth reading the privacy policy, for example when employees will use it.
Free or paid?
For a single person, free plans are often enough. Paid plans are worth it for sharing within a family or team, for emergency access and for extras such as data breach alerts. Costs are usually a few euros or dollars per month.
What about the password storage in my browser?
Chrome, Firefox, Safari and Edge can store passwords, and that is much better than using the same password everywhere. Standalone password managers do have advantages, though: they work in all browsers and on all devices, offer sharing and emergency access, and are not tied to one browser maker.
How to get started
- Choose a manager and install it on your computer and phone.
- Come up with a long master password, for example four to five random words. Write it down and keep the note somewhere safe.
- Turn on two-factor login.
- Import the passwords your browser has already saved.
- Change your email and online banking passwords first, then all the others little by little. The manager creates new passwords itself, or use our password generator.