The Best Password Managers

How many passwords do you need to remember? Most of us have dozens of online accounts, including accounts we use every day such as email, social networks and shopping sites as well as long-forgotten sites we’ve used exactly once.

The cardinal rule of password safety is not using the same password across sites, lest you risk a snowballing breach of all your accounts. But combining that principle with cardinal rule number two—creating complicated passwords that aren’t easily guessable by people or machines—results in the near-impossible task of remembering dozens of random strings of characters. And that in turn makes it hard to keep the third cardinal rule: never writing your passwords down.

Password managers solve all of these issues in one fell swoop. As smartphone apps and handy browser plugin, they encrypt and store passwords for your various online accounts, all protected by a master password that is the only thing you need to remember.

Beyond security, password managers are also a convenient way to handle sensitive information. You can share passwords with trusted friends or family, without them being able to see the password, while most also encrypt notes and scans of documents such as passports. On smartphones, a password manager app can log you into apps and websites without the hassle of having to type your fiendish string of characters into a tiny mobile-sized form field.

Better than browser password managers

The built-in password managers in the major browsers are a lot better than they used to be, and address one of the biggest issues – that many people are still using passwords that can be easily cracked, either because they’re weak or reused at swathes of sites across the web.

Firefox now supports password generation and encrypts stored passwords, with alerts of passwords that may have been compromised in data breaches of other websites. Chrome offers password generation and you can log into your Google account for a password strength check, while Safari flags passwords that are weak or used multiple times (in Preferences > Passwords) and can also be set to generate unique, complex passwords in new password fields. (On smartphones, Safari, Chrome and Firefox all generate strong passwords and flag weak efforts.)

However, there’s still a security issue around the fact that unless you remember to sign out of your browser at the end of every session, your accounts can be easily compromised by anyone with access to your computer.

To that end, Google Chrome has the safest password manager, requiring Google login with the option of two-factor authentication; while Firefox and Edge have the option of putting a master password; and Safari doesn’t have any sign-in at all, so that anybody using it can access your logins, and open your list of saved passwords to see which accounts can be auto-filled (and if you don’t have a password protecting your Mac, they can then elect to “show passwords” in that same screen). 

On top of that, dedicated password managers generate not only strong passwords whenever you sign up for new accounts (or to update any “123456” efforts still sticking around) but also offer additional security by requesting your master password at the start of each web session as well as two-factor authentication for individual logins.  

Creating a strong master password

The only trick to using a password manager is coming up with an uncrackable master password to secure the vault of all your logins. 

The good news is strong passwords aren’t necessarily the incomprehensible strings of characters you might think. Password crackers employ cracking dictionaries, testing dictionary words and common passwords at thousands of guesses or more per second, including well-known substitutes such as “5” for “s,” so what appears incomprehensible to a person is just a matter of time for a computer.

In 2013, a group of tech reporters from Ars Technica cracked 14,800 encrypted passwords in a few hours using such techniques. Even a brute-force attack (such as trying all possible combinations of letters) at thousands of guesses per hour could break an seven-character password in nine days.

To come up with your own tough-to-guess passwords:

• Use at least 12 characters; this increases the number of possible combinations and lengthens the time needed for a brute force attack.
• Use upper and lowercase letters, numbers and symbols. But avoid common substitutes that would reduce the randomness of the password and therefore make it easier for a computer to guess.
• Combine a few different words that aren’t normally used together. Even better, come up with a pass phrase by taking the first letters of a memorable (long) sentence, appended with memorable dates and unusual (but memorable) substitutions.

For example, “During winter, she would hope for snow and be bitterly disappointed (1984)” might become “DWswh4s&BBD(84)” as a pass phrase, which makes use of uppercase, lowercase, numbers and symbols.

Whatever you come up with, make sure you can remember it. Password managers don’t save master passwords and most don’t even save a password hint, so if you forget your master password, you’ll lose access to your data.

The best password manager features

To start cleaning up your password act, your password manager should meet these screening criteria.

1. Ease of use

It should save passwords from apps and sites seamlessly, including importing passwords from your browser(s) or other password managers.

2. Password health check

Does it rate passwords and update weak ones?

3. Biometric log-in

Using face or fingerprint recognition to login to the smartphone password manager ups both convenience and security – and additionally, may offer a way to recover accounts if the master password if forgotten.

4. Two-factor authentication

This system requires an additional offline code along with the master password – usually when using the password manager on a new device – so even if this password gets compromised, the vault is still secure.

5. Digital wallet

Can your digital wallet feature securely store credit card details and, even better, facilitate express checkout?

6. Online backup

The system should back up your information so passwords can be restored in the event of a lost or stolen device.

7. Sync across devices

The manager should let you access passwords on both work and home computers, as well as your smartphone.

All of our following picks meet these criteria, with the exception of the digital wallet. While a nice feature, we didn't feel it was essential. 

Editor's Pick: Dashlane

If you want a password manager with all the bells and whistles, Dashlane is the one. A well-designed, intuitive app for browser and smartphone, it comprises several privacy features along with a seamless password generator and form auto-filler.

Its desktop app will import saved passwords from your browsers as well as other password managers, while its browser plug-in automatically generates passwords for new accounts and auto-fills saved passwords. If you have more than one password or account on certain site, it’s easy to select the appropriate one.

If your passwords on any accounts are weak, you’ll be encouraged to update them, or if you spring for the Premium subscription, Dashlane can automatically replace these with strong alternatives.

The app includes a digital wallet to store payment cards so you can pay online without having to remember your credit card info.

There’s a secure notes feature, with templates for saving frequent flier numbers, Wi-Fi passwords, ID information for autofilling forms, as well as your credit card information. It’s similar to your existing memos app but encrypted, so if your computer is breached, all is not lost. The browser plug-in will also offer to save receipts from online transactions.

Though Dashlane is serviceable as a free app, supporting a browser plugin and the ability to save and generate passwords on one device, its Premium version really offers an all-round online privacy solution.

The premium version of Dashlane lets you sync passwords across unlimited devices and use its web app to securely log in to your accounts on a public computer. Accessible on all major browsers except Internet Explorer, the Dashlane Web application only decrypts your passwords locally once the data has reached the computer (whether it’s a public computer or your own), so all information that is shared with the Dashlane servers remains encrypted. And since you need to be logged into Dashlane and decrypt the information with your master password, the next person won’t be able to read your data.

For free and premium users, Dashlane supports two-factor authentication so that any time you log in with your master password, whether that’s in a browser or on another device, you can choose to also require a security code from an offline app such as Google Authenticator Google Authenticator (free for iOS and Android). 

Imports browser passwords: Yes
Password health check: Yes, with alerts when weak or old passwords need to be updated
Biometric login: Yes, for Premium version
Two-factor authentication: Yes
Digital wallet: Yes
Online backup: Yes, for Premium version
Sync across devices: Yes, for Premium version
Platforms: Mac, Windows, iOS, Android
Price: Free; $59.88/year for Premium version

RoboForm Everywhere

Although RoboForm Everywhere can feel clunky compared to streamlined, feature-packed password managers like Dashlane or LastPass, it offers great form-filling features in addition to security basics like a password health check, in-browser password generation and syncing across unlimited devices.

Its dashboard makes it easy to comb through hundreds of passwords, with folders and a powerful search feature, and you can also share logins – say for a joint bank account – with trusted recipients (so they can access accounts but not see the passwords).

There is also an emergency contact feature with premium accounts, so that trusted friends or family (who will be invited to sign up for a free RoboForm account if not already users) can access your password vault in an emergency, or even if you’ve simply forgotten your master password, allowing you to recover your account more easily.

Its browser plugin is available for all the major browsers - Safari, Firefox, Chrome, Opera, Internet Explorer, and Edge – and along with saving and autofilling passwords, these are also top-notch with commonly used online data such as your name, address and phone number (rather than trusting these details to your browser). Passwords aren’t the only loot after all – and to that end, if you’ve employed the method of saving important numbers such as tax references to a note file, you can encrypt and save the file to RoboForm Everywhere. 

Imports browser passwords: Yes
Password health check: Yes, with alerts when weak or old passwords need to be updated
Biometric login: Yes
Two-factor authentication: Yes
Digital wallet: No
Online backup: Yes
Sync across devices: Yes
Platforms: Mac, Windows, iOS, Android
Price: Free; $23.88/year for Premium version

LastPass

The free version of LastPass is one of the most feature-packed – and easy to use – password managers around. Uniquely, free users on LastPass get password syncing across unlimited devices – nearly every other password manager offers free users just one device – which becomes increasingly necessary when all your passwords are complex random generations and you’re hopping between work and personal devices. Free users can also securely share passwords with trusted others so they can access accounts temporarily (say, to stream TV) or permanently (say, to pay joint bills). There are browser plugins for Chrome, Firefox, Safari, Opera and Edge browsers.

On smartphones, downloading the LastPass app means you can get passwords autofilled in other apps as well as on mobile sites. If your phone supports it, the app can be unlocked using face or fingerprint recognition – which handily also means that if you forget your master password, you can biometrically unlock the smartphone app to change it. 

Like many other managers, it also auto-fills personal information into online forms, and offers a secure notes feature with preset forms for storing Wi-Fi passwords, membership numbers and other sensitive information. Notes can also be securely shared. 

Get the lowdown on how secure your passwords are by heading into LastPass’s Security Challenge, which tells you how many weak, old or reused passwords you have and rates your security on a scale of 100. It alerts you about sites at which you have accounts that have experienced site compromises. In all of these cases, LastPass can update your passwords with new, generated strong passwords. 

At the start of 2019, LastPass bumped up the price of its premium password manager to $36/year, from $12 back in 2016. For this price, you get several extras, including 1GB of secure file storage, password auto-fill for desktop apps as well as online accounts, extended two-factor authentication supporting hardware keys and emergency access for loved ones. All that said, however, if you don’t need all these features, the free version, with its support for use across unlimited devices, is likely to meet basic password needs and then some.

It’s worth noting that LastPass was the subject of a high-profile breach a few years back, although the company says it didn’t expose master passwords or decrypted user data. The most recent vulnerability uncovered by researchers, which could have leaked passwords from users’ last-visited site, has been addressed in a software update.

Imports browser passwords: Yes
Security health check: Yes, with alerts when weak or old passwords need to be updates
Biometric login: Yes
Two-factor authentication: Yes
Digital wallet: No (though you can store bank card info in the secure notes feature)
Online backup: Yes
Sync across devices: Yes, for Premium version
Platforms: Mac, Windows, iOS, Android
Price: Free; $36/year for Premium

Bitwarden

For the tech-savvy and privacy-concerned, Bitwarden is a great – and affordable – option. This streamlined basics-only password manager is open-source and audited by security researchers and third-party firms. Its browser plugins support not only the major browsers (Chrome, Edge, Firefox, Safari, Opera) but also the lesser-used, privacy-focused Tor, Vivaldi and Brave. 

For free accounts, Bitwarden offers online backup and password syncing across unlimited devices, as well as an encrypted ‘web vault’ if you need to access your passwords at a public computer. Password generation for new accounts isn’t quite as slick as on many other password managers – when creating new passwords, where Dashlane and LastPass plugins pop up a handy button within form fields to create logins, with Bitwarden you’ll have to open the browser plugin, generate a password and copy it into the field.

Another minor hurdle is that importing passwords involves going into your browser (or other application) settings, saving stored passwords into a file format such as .csv, then heading into your Bitwarden account to import this file. That said, there are easy instructions on the Bitwarden help page, and the upside is you only need to do this once.

Accounts are protected by two-factor authentication – you’ll be asked for a 2FA code from an app like Google Authenticator whenever syncing to a new device.

A $10/year premium account offers a password health check, 1GB of encrypted file storage and data breach monitoring (the latter of which is included in premium accounts from much pricier password managers). Premium users also get the ability to secure individual logins with 2FA, plus the option of USB keys as a 2FA method.

Though Bitwarden takes a little more manual tinkering, this open-source option is an easy to use tool that’s ideal for privacy-centric browsers not supported by most other password managers.

Imports browser passwords: Not directly – you have to save passwords from your browser or other password manager into a file then import this file.
Password health check: Yes, for paid-for accounts.
Biometric login: Yes
Two-factor authentication: Yes
Digital wallet: No
Online backup: Yes
Sync across devices: Yes
Platforms:  Mac, Windows, Linux, iOS, Android
Price: Free, $10/year for Premium

Sticky Password

Designed by former execs behind the free antivirus software AVG, Sticky Password seamlessly encrypts and stores passwords and fills out a large variety of forms, recognizing fields such as job titles and company names and handling a range of online accounts.You can also share passwords with other users, as well as organise passwords into folders, although unlike Keeper Security, you can’t share folders of passwords.

Unlike some other password managers, Sticky Password also offers unlimited encrypted data storage within its desktop app and for free users, but to get enough use of this password manager, the premium version is really required: it backs up passwords online, syncs them across all your devices and allows password sharing.

There’s also a great new security feature where passwords can be synced between devices only when on your own – and therefore safe – Wi-Fi network as well as through the cloud. However, it lacks the data breach monitoring that several other premium services offer
 Its browser extension is available for Chrome, Firefox, Internet Explorer, Opera and Safari, although not Edge.

The dashboard displays all your accounts and passwords, with weak passwords highlighted for updating. A secure memos feature lets you write down other sensitive passwords and membership numbers.

The premium version backs up passwords online and syncs all your devices. Choose to do this over your own Wi-Fi network (potentially more secure) or through the cloud. If you test out Sticky Password and love it, you can get a lifetime license for $149.99. 

Imports browser passwords: Yes
Password health check: Yes
Biometric login: Yes
Two-factor authentication: Yes
Digital wallet: Yes
Online backup: Yes, for Premium version
Sync across devices: Yes, for Premium version
Platforms: Mac, Windows, iOS, Android 
Price: Free, with 30-day free trial of Premium; $29.99/year for Premium; $199.99 for lifetime license

LogmeOnce

LogmeOnce offers a ton of features with its free version, including – like LastPass – the ability to sync passwords across multiple devices, plus some unique anti-theft features in its two paid-for account types.
 

The downside is that interfaces on its browser extension (available for Chrome, Firefox, Internet Explorer, and Safari) and mobile apps are dated compared to the likes of Dashlane and LastPass – but they’re easy enough to use. As soon as you hit a site that asks for your password, LogmeOnce asks if you’d like to save it. If you’re signing up for a new account or changing a password, a pop-up auto-generates a complex password that you can use and save in a single click.

You can choose to save accounts by user-friendly names, handy if two people are using one computer for their Facebook, LinkedIn and so on. There’s also an auto-complete feature for forms requiring personal information like your name and phone number.

An automatic password changer prompts you to replace your old passwords with new, strong ones. The free version allows you to share just five passwords with other users, which may be limiting if you have multiple accounts to which others need access from time to time. Shelling out for the $1/month Professional version gets you 30 password-shares, or unlimited shares with the, well, Unlimited account for $3.25/month. You can also encrypt text files (three in the free version, more in the paid-for versions).

Now for the unique anti-theft features. If the wrong details are entered, the Mugshot feature captures the phone’s GPS location and snaps a selfie on the presumption that it must have been a thief — pretty cute. A new feature, Password Shock, sends flashing or vibrating alerts to any device attempting to hack into someone’s LogmeOnce vault, and relays the device’s location and IP address, with three ‘incidents’ offered in the free version, seven in the Professional and nine in the Unlimited version.

Paying users also get location tracking for smartphones so that in the event of loss and theft, devices can be wiped, locked or rung, while Unlimited users can freeze access to their password vaults if they suspect it has been hacked. One notably missing feature from the premium accounts is the scan for logins that have been compromised in data breaches.

While the volume of available features can be overwhelming – and perhaps not terribly useful for many - LogmeOnce offers a solid password manager with many features for free, as well as an affordable Professional subscription with a good password sharing allowance.  

Imports browser passwords: Yes
Password health check:Yes
Biometric login: Yes
Two-factor authentication:Yes
Digital wallet: Yes
Online backup: Yes, for Professional and Unlimited versions
Sync across devices: Yes
Platforms: Mac, Windows, iOS, Android
Price: Free; $1/month for Professional version, $3.25/month for Unlimited Version 

[Image credits: password security via Shutterstock, Dashlane, LastPass, Bitwarden, Sticky Password, LogmeOnce]

Updated on 11/22/2019 with new picks and features