Most password managers now look the same in a feature list: autofill, a generator, a browser extension, syncing. The differences that decide whether you stay for years are less visible. They are how the vault is encrypted, whether you can take your data out, and what happens when you lose your phone or your memory.
This guide is the checklist I would use before moving a family or a small team onto a manager, based on what the major products ship in 2026 and the current NIST guidance on passwords.
Start with the encryption model, not the feature list
Any manager worth using should be zero-knowledge: your vault is encrypted on your device with a key derived from your master password, and the provider stores only ciphertext. That means a breach of the vendor's servers does not hand over your passwords.
How to check without reading a security paper: look for the phrase "zero-knowledge" or "end-to-end encrypted" in the vendor's own documentation, and check whether the product is open source or has had an independent audit published. Open source is not a guarantee, but a closed product with no audit and no encryption page is a reason to walk away.
The seven checks that matter
1. Zero-knowledge encryption with a published design. If the vendor cannot explain how the vault is encrypted in plain language, assume it cannot.
2. Passkey support. Passkeys are now the default sign-in for many Google, Apple and Microsoft accounts. A manager that cannot store and autofill passkeys is already behind, and you will end up keeping passkeys in a browser keychain anyway.
3. Breach monitoring inside the app. Most managers now check saved credentials against known breach data and flag reused or weak entries. This is the feature that catches a leak before you do.
4. Strong second-factor options. Look for authenticator-app (TOTP) support, hardware security keys and recovery codes, not just email or SMS. Email as the only second factor is barely better than a password, and why multi-factor authentication matters explains the difference between the types.
5. Autofill that works in your actual browser and apps. Test it on the sites you use daily, including Indian banking and government portals, which are often the ones that break. A manager that fails on your bank's login page is not solving your problem.
6. Emergency access and recovery. What happens if you are hospitalised or lose your only device? Family plans and emergency-access features let a trusted contact request the vault after a waiting period.
7. Export and delete rights. You must be able to export the whole vault in a readable format and delete the account completely. A manager that traps your data is a manager you cannot leave, and that risk grows every year you stay.
What NIST says about passwords now
The current US guidance, NIST SP 800-63B-4, published in August 2025, changed the rules most people still follow. Single-factor passwords should be at least 15 characters. Systems should not impose composition rules or force periodic changes. They should check new passwords against a blocklist of known compromised ones, comparing the entire password rather than substrings.
For a password manager user, the practical translation is simple: length beats complexity, reuse is the thing to eliminate, and a manager that generates long random passwords removes the guesswork. The master password is the exception you have to remember yourself, so make it a long passphrase and write the recovery kit down somewhere offline.
Free versus paid
Free tiers are more usable than they were in 2021. Bitwarden's free plan, for example, includes unlimited passwords on unlimited devices, passkey management and sharing with one other user, and the paid personal tier is priced at about $1.65 a month when billed annually. Other vendors have moved in the opposite direction and put sync or passkeys behind a subscription, so check the free plan's limits before you migrate.
| What you get | Typical free tier | Typical paid tier |
|---|---|---|
| Unlimited passwords | Usually yes now | Yes |
| Sync across devices | Usually yes, sometimes one device type | Yes |
| Passkey storage | Increasingly yes | Yes |
| File attachments | Rarely | Yes |
| Emergency access | Rarely | Usually |
| Family sharing | No, or one other user | Yes, up to 5-6 people |
| Breach reports and dark-web alerts | Basic or none | Full |
Paid tiers are usually cheap relative to what they protect: a few dollars a month per person. The decision is less about price and more about whether the extra features, family sharing and support are worth it to you.
Bundles and add-ons: be careful
Some vendors sell a password manager as part of a bundle with a VPN, an authenticator or cloud storage. The bundle can be good value if you would have bought the other pieces anyway. It is a bad reason to choose a manager, because the vault is the part you cannot easily swap later.
The same caution applies to browser password managers. Chrome, Safari and Edge now store passkeys and sync passwords for free, and for a single person on one ecosystem they are genuinely adequate. They fall short on sharing, emergency access, cross-platform consistency and export quality, which are exactly the cases where a dedicated manager earns its subscription.
Where people get it wrong
Most of these are account-security habits rather than app settings. If you are tightening your setup, how digital scams are evolving is worth ten minutes, and the top 10 online privacy tips covers the rest of the basics.
- Reusing the master password. The vault is only as strong as the one password that opens it. Use a passphrase you have never used anywhere else.
- Skipping two-factor. A strong master password plus TOTP or a hardware key is the combination that survives a phishing page.
- No recovery plan. Recovery codes, an emergency contact and a printed recovery kit cost nothing and save months of account recovery.
- Never reviewing the vault. Run the security report monthly, fix reused passwords, and delete accounts you no longer use.
- Storing the master password in the vault. It sounds absurd; it happens.
How to migrate without losing anything
1. Export your current vault as CSV or JSON.
2. Import it into the new manager and check the item count.
3. Install the browser extension and mobile app, and test autofill on five sites you use daily.
4. Delete the CSV export from your downloads folder, or move it to an encrypted drive.
5. Keep the old manager active for a week, then delete the account.
The export step is also the test from check seven. If a manager will not export cleanly, do not move to it, and if your current one will not, move away from it now.
FAQ
Are browser password managers good enough?
For one person on one ecosystem, often yes. They sync, they handle passkeys, and they cost nothing. They become awkward when you need to share credentials with a partner or a team, recover an account after a lost device, or move to a different browser family without losing history.
What happens if I forget my master password?
With a properly built zero-knowledge manager, nobody can reset it for you, because nobody else can decrypt the vault. That is the point. Recovery depends on the emergency-access feature, a saved recovery kit, or a backup export you kept offline. Set one of those up on day one, not after the problem.
Is a free password manager safe?
Safe is about the encryption model, not the price. A free tier from a vendor with published zero-knowledge design and independent audits can be safer than a paid product with a vague security page. Check the design and the audit history first, then compare the limits.
