What is the best password manager to use?

Short answer: the best password manager is the one you will actually use consistently. For most people, that means either the free manager built into their phone or computer, or a well-established dedicated app like Bitwarden or 1Password. Any of these is enormously better than reusing passwords.

This is one of those questions where the differences between the top options matter far less than the decision to use one at all. A password manager generates strong, unique passwords for every site, remembers them for you, and fills them in automatically. That single change eliminates the two biggest causes of account takeovers: password reuse and weak passwords. The rest is detail — but the details are worth getting right, so let's walk through them.

What a password manager actually does for you

At its core, a password manager is an encrypted vault. You remember one strong master password (or use your device's biometric login), and the manager remembers everything else. When you visit a site, it offers to fill in the right credentials. When you create an account, it generates a long random password you would never memorize and never need to.

The security benefit most people underestimate is uniqueness. When every site has a different password, a breach at one site — and breaches happen constantly — gives attackers nothing they can use elsewhere. Without a manager, most people reuse a handful of passwords across dozens of sites, which means one breach compromises everything.

Good managers also warn you about weak, reused, or compromised passwords, store secure notes and two-factor codes, and sync across your phone, tablet, and computer. The sync is what makes the habit stick: your passwords are everywhere you are, so there is never a reason to fall back on an old reused favorite.

The criteria that actually matter

Ignore most review-site scoring and focus on a short list. First, encryption and architecture: your passwords should be encrypted on your device before they ever reach the company's servers, so that even the company cannot read them. This is called zero-knowledge architecture, and every reputable manager uses it. If a product cannot clearly explain this, walk away.

Second, cross-platform support. If you use an iPhone and a Windows laptop, or an Android phone and a Mac, your manager must work well on all of them — including browser extensions for whatever browsers you use. A manager that only works in one ecosystem will push you back toward bad habits on your other devices.

Third, longevity and reputation. You are entrusting a company with the keys to your digital life, so prefer companies with long track records, independent security audits, and transparent responses to past incidents. A password manager from a company you have never heard of, no matter how slick the app, is a gamble.

Fourth, export and portability. You should be able to export your passwords in a standard format at any time. This is your escape hatch, and any manager that locks you in does not deserve your trust.

The built-in options you already have

Before spending money, look at what is already on your devices. Apple's iCloud Keychain (built into iPhone, iPad, and Mac) and Google Password Manager (built into Android and Chrome) are both competent, free, and deeply integrated. For someone entirely inside one ecosystem — all Apple, or all Google — the built-in option is often the right answer. There is nothing to install, nothing to pay for, and it syncs automatically.

The limitations are real, though. Apple's manager works best within Apple's world; using it on a Windows PC or Android phone is clumsy. Google's is tied to your Google account, which means your passwords' security is only as good as your Google account's security — enable strong two-factor authentication there if you go this route. Both are also less feature-rich than dedicated apps: family sharing, secure document storage, and advanced organizational tools are thinner or absent.

Still, for a large fraction of people, the built-in manager plus a strong master setup is a complete solution. Do not let the perfect be the enemy of the done.

The popular dedicated options, honestly compared

Bitwarden is the option most security-minded people recommend first, and for good reason: it is open source, which means its code can be independently inspected; it has a genuinely useful free tier that covers unlimited passwords across unlimited devices; and its paid tier is inexpensive. The interface is functional rather than beautiful, but it does everything that matters. For most people who want a dedicated manager without overthinking it, Bitwarden is the default recommendation.

1Password is the polished alternative. It costs more, but the apps are excellent across every platform, family sharing is well designed, and features like travel mode and detailed security reports go beyond the basics. If you are managing passwords for a whole family, or you simply want the smoothest experience and do not mind paying for it, 1Password is the one people tend to stick with longest.

There are other credible names — Dashlane, Keeper, NordPass among them — and any established, audited option beats having no manager. But the honest truth is that the differences between the top three or four are marginal for personal use. Pick one with a good reputation, set it up fully, and move on with your life.

Free versus paid: what you actually get

Free tiers from reputable managers are not traps; they are genuinely usable. Bitwarden's free tier, for example, covers the core job — unlimited passwords, sync across devices — without meaningful limits. The built-in Apple and Google managers are free outright.

Paid tiers typically add emergency access (letting a trusted person into your vault if something happens to you), advanced two-factor options, larger file storage for documents, family plans, and priority support. Emergency access alone can justify the small annual cost: without it, your family may be locked out of critical accounts in a crisis.

A family plan is worth considering once you have your own vault in order. Getting a partner or parent onto a manager multiplies the security benefit, and shared vaults make it easy to manage household accounts — utilities, streaming, the Wi-Fi password — without texting credentials back and forth.

What about just writing them down?

This question comes up constantly, and the honest answer is more nuanced than security purists admit. A notebook of unique, strong passwords kept in your home is actually reasonably secure against remote attackers — nobody in another country can steal your notebook. Its weaknesses are physical: fire, theft, loss, and the fact that it does not help you on your phone or generate passwords for you.

For a small number of critical credentials — your password manager's own master password, your email account recovery details — writing them down and storing them somewhere safe is genuinely good practice. As a complete system for dozens of accounts, though, paper does not scale, does not sync, and does not warn you about breaches. Use paper as a backup for the keys to the kingdom, not as the kingdom itself.

Migrating without the headache

The migration is the part people dread, and it is less painful than it looks. Most managers can import directly from browsers and from each other, so your existing saved passwords transfer in minutes. After importing, the real work is the cleanup: the manager will flag reused and weak passwords, and you should change the important ones — email, banking, primary social accounts — to fresh generated passwords first.

Do this in stages rather than all at once. Start with your ten most important accounts. Then handle the rest opportunistically: whenever you log into a site, let the manager generate a new password and save it. Within a few months, the bulk of your accounts will be converted without a single marathon session.

One critical step people skip: after migrating, turn off or clear your browser's built-in password saving if you are using a dedicated manager, so you do not end up with two competing systems. And write down your new master password on paper, stored somewhere safe, until it is firmly in your memory.

Set it up right once, then forget it

A few setup decisions pay off for years. First, make your master password a long passphrase — four or five random words you can remember — rather than a complex jumble you will forget. Its length is what protects you. Second, enable biometric unlock (fingerprint or face) on your devices so day-to-day use is frictionless; the master password then only matters for new devices.

Third, turn on two-factor authentication for the password manager account itself, ideally with an authenticator app rather than SMS. Your vault is the single point of failure for everything, so it deserves the strongest lock you have. Fourth, set up emergency access or designate a trusted contact, and tell that person it exists.

After that, the manager should fade into the background of your digital life — quietly generating, filling, and guarding. Check in once a year: run the security report, change anything flagged, and confirm your emergency contact is still correct. The best password manager is not the one with the most features. It is the one that is set up, synced, and so routine you never think about it — while it thinks about your security constantly.