Introduction
Most people know they should not reuse the same password everywhere. Most people do it anyway, because remembering dozens of different logins is not realistic. That gap is exactly what a password manager is for: one strong master password opens an encrypted vault, and the vault remembers everything else.
In 2026 the job has got bigger. Passwords are still everywhere, but passkeys are now a real part of everyday logins, with billions of them in active use according to the FIDO Alliance. A good manager today has to handle both — store your passwords, and create, store and sync passkeys across your devices, so you can sign in with a fingerprint or face scan instead of typing a password at all.
There is no single best one. The right choice depends on whether you want free or paid, open source or polished, cloud sync or full local control.
What to Look For First
Zero-knowledge encryption
This is the most important property. In a zero-knowledge design, your vault is encrypted on your own device before anything is sent to the provider’s servers. The provider stores only scrambled data it cannot read, and it never receives your master password. If its servers are breached, an attacker gets encrypted blobs, not your logins. The encryption itself is usually AES-256, the standard used by governments and banks, and the provider should publish independent security audits of its apps.
Passkey support
A manager without passkey support is falling behind. Check that it can create and store passkeys, sync them between your phone and computer, and fill them in when a site asks for one. Just as important, check that you can move your passkeys out again. A passkey locked into one company’s system is not much better than a password you cannot change.
Your devices, all of them
A manager only helps if it is there when you need it. Make sure it covers every device you actually use — Windows, Mac, iPhone, Android, and the browsers you live in — and that syncing between them is automatic. If it only works well on one platform, you will end up going back to memory, or to the same password everywhere.
Recovery, set up in advance
Zero-knowledge has a hard edge: if you forget your master password and have no recovery set up, nobody at the company can reset it for you, because they cannot read your vault. So before you put everything in, set up whatever recovery the manager offers — a trusted contact, a printed recovery code stored somewhere safe, or a second device that can approve you. Do it on day one, not after a problem. Turn on two-factor authentication on your manager account as well, ideally with an authenticator app or a hardware security key rather than a text message code.
The Main Types, and Who Each One Suits
The polished all-rounder
This is the manager for most people. It works smoothly on every platform, syncs without fuss, fills in passwords and passkeys reliably, and has mature sharing for families — shared vaults, emergency access, and controls for what each person can see. It is usually a paid product with a free trial rather than a permanent free tier, and its apps are usually closed source, though it should still publish independent audits and a clear security design. Pick this type if you want the least friction and are happy to pay for a service that just works.
The free and open-source option
Some managers are built in the open: their apps are open source, anyone can inspect the code, and they publish independent security audits. The best-known of these offers a genuinely free plan that covers unlimited passwords and devices, with passkey support included, and a paid plan that adds extras like built-in authenticator codes, vault health reports, and emergency access. Some also let you host the vault yourself. Pick this type if you want to pay nothing to start, you care about transparency, or you like the idea that the code can be checked by people outside the company.
The privacy-first option
A third type is built around privacy as the main selling point. These managers often come from companies known for encrypted email or VPNs, and they tend to include extras like email aliases — a different address for each site, so a breach at one site does not expose your real address. Their free plans are often generous, and their apps are open source and independently audited. Pick this type if you already use the company’s other privacy tools, or if email aliases matter more to you than the slickest autofill. For a closer look at how privacy tools fit together, see Anon Vault.
The built-in option
If every device you own is from one company, the manager already built into that system may be enough. Apple Passwords and Google Password Manager both store passwords and passkeys, sync across their own devices, and cost nothing extra. The catch is portability: they work best inside their own ecosystem, and moving to a different platform later can be awkward. Pick this type if your devices are all in one place and you want zero setup. Pick a cross-platform manager if you mix Apple, Windows and Android, or think you might switch later.
The fully offline option
A small group of managers store nothing in the cloud at all. Your vault is a single encrypted file on your own device, and you decide how to back it up and sync it. There is no vendor server, no subscription, and no account to be breached — but also no one to help if you lose the file and its backup. Pick this type only if you are comfortable managing your own backups and want full local control. For most people, automatic cloud sync is worth more, provided the cloud manager is zero-knowledge.
How to Switch Without the Mess
Switching feels like the hard part, so most people never do it. In practice it takes less than an hour for a personal vault. Export your existing passwords from your browser or old manager, import them into the new one, then go through the vault in batches — banking and email first, then shopping and social — and let the manager generate a new, unique password for each site as you visit it. You do not have to do them all in one sitting.
While you are at it, check the manager’s health report, if it has one — it flags reused and weak passwords, and logins seen in known breaches. Fix reused ones first. And for Mac users: check the browser extension is actually enabled before blaming the manager, the same kind of everyday Mac annoyance as the one in Orange Spot on MacBook Screen.
The Bottom Line
A password manager is worth using if it is zero-knowledge, supports passkeys, covers all your devices, and is one you will actually keep using. For most people that means a polished paid all-rounder or a strong free open-source option. For privacy-focused users, a privacy-first manager with email aliases is a good fit. For an all-Apple or all-Google household, the built-in option may be enough.
What is not worth using in 2026 is no manager at all — or a manager you chose once and never set up properly. Pick one, set up recovery, turn on two-factor authentication, and let it generate a different password for every site. That single change does more for your security than any other habit you could adopt this year. Pricing and plans change often, so before you pay for anything, check the official pricing page for the plan you are considering.