A password manager is the single highest-leverage security decision most people will ever make, and yet it’s the one I have the hardest time getting people to act on. In my years working in IT security, the pattern has been relentless: the breaches that actually hurt almost never start with a clever exploit. They start with a password that was weak, reused, or written in a spreadsheet called passwords.xlsx. A good manager removes that entire class of problem in an afternoon.

So this isn’t a neutral spec sheet. I’ve used these tools myself, day in and day out, under real pressure rather than testing them for a weekend. Below is what I genuinely recommend, what frustrates me about each, and how to pick. Where I have a strong opinion, I’ll say so.

First, the part nobody can skip

Before any brand comparison, understand what you’re actually buying. A password manager is an encrypted vault: it generates long random passwords, stores them, and fills them in for you so you never have to know or type them. The whole model rests on one thing — zero-knowledge architecture. The provider holds your vault as an encrypted blob they physically cannot read; only your master password (which never leaves your device in plain form) unlocks it.

That design has a consequence people don’t expect until it bites them: if you forget your master password, nobody can recover it for you. That’s not a flaw, it’s the entire point — but it means a forgotten master password with no recovery set up can lock you out permanently, which is a genuinely bad day. So whichever tool you choose, set up its recovery options properly on day one — emergency access, a recovery key printed and stored somewhere physical, or a trusted contact. Treat that as part of the install, not an optional extra.

The non-negotiable features I check for, in order:

  • Zero-knowledge encryption — the provider can’t read your vault.
  • Independent security audits — published, recent, and ideally repeated.
  • Cross-platform sync — it has to be effortless on your phone, or you won’t use it.
  • Passkey support — it must store and autofill FIDO2 passkeys, not just passwords. This is where the whole field is heading.

Anything missing one of those four, I won’t recommend.

What I reach for first: Bitwarden

If someone asks me one question and wants one answer, it’s Bitwarden. It’s open-source and independently audited, which for a security tool isn’t a marketing line — it means the claims are checkable rather than promised. The free tier is genuinely usable: unlimited passwords across unlimited devices, no artificial “one device only” trap. The paid tier is inexpensive enough that price is never the reason someone doesn’t upgrade.

What I like in practice is that it gets out of the way. What frustrates me: the interface is functional rather than beautiful, and the Android autofill occasionally needs a nudge on stubborn apps. For most people, none of that outweighs “open, audited, free, and it works everywhere.” It’s what I’d put in front of a family member without a second thought.

The one I’d hand to a non-technical person: 1Password

1Password is the most polished tool in this space, full stop, and its Secret Key design is clever: a long random key is generated locally and combined with your master password, so even if their servers were fully compromised, your vault can’t be brute-forced remotely without that key. It’s the tool I’d choose for someone who finds all of this intimidating, because the experience never makes them feel stupid.

The trade-offs are real: there’s no free tier, only a trial, and it’s closed-source (though regularly audited). You’re paying for refinement, and for the right person that’s money well spent.

The privacy pick: Proton Pass

From the Swiss team behind Proton Mail, Proton Pass is the newest serious contender and the one I find myself recommending to the privacy-conscious. It’s open-source and audited, it sits under Swiss privacy law, and its standout trick is built-in email aliasing — it can generate a unique “hide-my-email” address per site, so a breach at one service can’t be correlated back to your real address. The free tier is generous. It’s younger than the others, so a few organisational features are still maturing, and you’ll get the most from it if you’re already in the Proton ecosystem.

The power-user option: KeePass

KeePass is the tool for people who want absolute control. It’s free, open-source, and entirely local — your encrypted database lives on your own disk, not someone’s cloud. I have a soft spot for it because it’s what a lot of us in IT cut our teeth on. It’s the kind of tool you’d keep an offline vault file on for the handful of credentials you want nowhere near the internet.

But I’m honest with people about the cost of that control: there’s no built-in sync (you bolt that on yourself via a cloud folder), the interface is straight out of another era, and the mobile apps are third-party ports. For a technical user who wants their vault under their own roof, it’s superb. For anyone else, it’s friction they won’t tolerate.

The rest, briefly and honestly

NordPass — clean, beginner-friendly, uses the modern XChaCha20 cipher, with good breach-scanning tools. The free tier’s one-device limit is the catch. Fine, not my first reach.

Dashlane — polished and feature-heavy, bundling a VPN and dark-web monitoring at the top tier. It’s one of the pricier options, and it moved to a web-only model that not everyone loved. Good if you specifically want the extras in one bill.

LastPass — once the default choice, and still widely used. I’ll be blunt: after the 2022 incident in which encrypted vault data was exfiltrated, it carries a trust deficit in the security community that I haven’t seen it fully earn back. It still works, but with this much genuine competition, I no longer recommend it as a first choice.

How to actually choose

Strip away the brand noise and it’s simple. Want one safe default that’s free and audited? Bitwarden. Want the smoothest possible experience for someone who finds tech stressful? 1Password. Care most about privacy and aliasing? Proton Pass. Want everything local and under your own control? KeePass.

There is no wrong answer among those four. The genuinely wrong answer is the one I see every week: no manager at all, the same three passwords everywhere, and a quiet hope that you won’t be the one who gets stuffed. Pick any of the above today and you’ve already removed the most common cause of account takeover I deal with.

Whatever you choose, the vault is only as strong as the single master password guarding it. Make that one count — here’s how to build a master password that holds — and if you want to feel the difference length makes, run a few candidates through the PassGuard Check strength tester first. It all happens locally in your browser; nothing you type is ever sent anywhere.