Passwords are a classic catch-22: If they’re good, they’re hard to remember. But if they’re easy to recall, they aren’t effective. Because we are an eminently practical species, most of us err on the side of convenience. “Password” and “123456” have been the two most commonly used passwords on the web (“admin” also ranks high), and in 2026, sadly, that’s still the case.
It doesn’t have to be this way. In this article, I’ll teach you how to memorize hundreds of random 16-character strings and keep track of which works where.
Just kidding. That might work for Memory Grand Master Ed Cooke, but it probably won’t for you and me. What I will do is help you find a password manager to do the memorizing for you and give you access to those crazy-long, crazy-strong passwords whenever and wherever you need them.
Updated August 2026: We’ve revamped and reorganized this guide based on more recent testing.
- Best for Most People: Bitwarden
- Best Free Password Manager: Proton Pass
- Best for Sharing: Keeper
- Best Upgrade: 1Password
- Best Full-Featured Manager: Dashlane
- Best for Bundled Services: NordPass
- Best DIY Options (Self-Hosted)
- Other Password Managers We Tested
- Why (and How) You Should Use a Password Manager
- How We Test
Best Password Manager for Most People
Bitwarden is secure, open source, and free with no limits. The applications are polished and user-friendly, making Bitwarden the best choice for most users. Did we mention it’s open source? That means the code that powers Bitwarden is freely available for anyone to inspect, seek out flaws, and fix. In theory, the more eyes on the code, the more airtight it becomes. Bitwarden is also audited by third-parties to ensure it’s secure. You can even install it on a local server for easy self-hosting if you prefer to run your own cloud.
Bitwarden offers apps for Windows, macOS, iOS, Linux, and Android, as well as extensions for all major web browsers. Bitwarden also supports Windows Hello and Touch ID on its desktop apps for Windows and macOS, giving users the added security of those biometric authentication systems. The web interface (which I frequently use) is also well done and easy to use.
Bitwarden supports passwordless authentication, meaning you can log in with a one-time code, biometric authentication, or a security key. Bitwarden also has excellent support for passkeys, including the ability to log into Bitwarden with a passkey, which means you don't need to use your username or password even to open your vault. There’s also some extras, like a feature to securely share files (called Bitwarden Send), a built-in 2FA authenticator app (paid only), and an extremely active and helpful community.
We like Bitwarden’s semi-automated password fill-in tool. If you visit a site you’ve saved credentials for, Bitwarden’s browser icon shows the number of saved credentials from that site. Click the icon, and it will ask which account you want to use and then automatically fill in the login form. This makes it easy to switch between usernames and avoid the pitfalls of autofill. If you simply must have your fully automated form-filling feature, Bitwarden supports that as well.
Why Not Use Your Browser?
Most web browsers offer at least a rudimentary password manager. (This is where your passwords are stored when Google Chrome or Mozilla Firefox ask if you’d like to save a password.) This is better than reusing the same password everywhere, but browser-based password managers are limited. In recent years, Google has improved the password manager built into Chrome, but it’s still not as full-featured or widely supported as a dedicated password manager like those below.
It’s not as secure, either. Although your passwords are encrypted in your browser, they’re trivially easy to decrypt if someone has access to your computer. Avoid using your browser’s password manager if someone else can potentially get access your machine.
WIRED readers have also asked about Apple’s password manager, which syncs through iCloud and has some nice integrations with the Safari web browser—even a dedicated app. There’s nothing wrong with Apple’s system. It doesn’t have some of the nice extras you get with dedicated services, but it can secure your passwords and sync them among Apple devices. The main problem is that if you have any non-Apple devices, you won’t be able to sync your passwords to them. All in on Apple? Then this is a viable, free, built-in option worth considering.
What Are Passkeys?
A concerted effort to get rid of passwords began roughly two days after the password was invented. Passwords are a pain—you’ll get no argument here—but we don’t see them going away in the foreseeable future. The latest effort to eliminate the password comes from the FIDO Alliance, an industry group aimed at standardizing online authentication methods. Does this sound a little bit like the infamous xkcd 927? Yes, yes it does. But thanks to the monopolistic nature of devices, it might work this time.
Apple supports the FIDO specs and coined the term passkeys, which has caught on. Passkeys are generated cryptographic keys managed by your device (usually your phone). They’re easy to create—you don’t need to do anything, as your device handles the details. Your passkeys are stored on your device and protected by either biometrics or PINs. Since passkeys are generated key pairs instead of passwords, there’s nothing to remember. If you are familiar with GPG keys, they’re somewhat similar in that there’s a public and private key; the website you want to log in to has a public key and sends it to your device. Your device compares that to the private key it has, and you’re signed in (or not, if the keys don’t match).
While passkeys aren’t a radical departure, they’re still an improvement by virtue of being a preinstalled tool for people who aren’t going to read this article and immediately sign up to use one of the services below. If millions of people suddenly stop using 12345678 as a password, that’s a win for security.
Almost all of the apps we’ve suggested here can store passkeys, which means you can store your passkeys right alongside your passwords. Our two favorites, Bitwarden and 1Password, can generate, save, store, and sync passkeys. You can even log in to Bitwarden using a passkey, which pretty much eliminates the need for a password at all. Once you have a passkey stored, it will automatically sync to all your devices the same way Bitwarden and 1Password sync your passwords. When you return to that site, your password manager will log you in using the passkey you generated.
Think of passkeys as credit cards next to the cash (passwords) in your wallet. One day passkeys may work everywhere and there will be no passwords, no password managers. In the meantime we think it’s better to stick with a password manager, even if all you’re doing with that manager is storing passkeys.
How a Password Manager Works
Password managers are simple at the most rudimentary level. Instead of remembering your passwords, you store and encrypt them behind a master password. It could be as simple as an encrypted spreadsheet. A password manager makes logging in easier since you don’t need to remember your password, and more secure, as you’re able to use long, random, and unique passwords across all your accounts.
The best password managers throw more than a little encryption at the problem, though. Ideally, they’re built on a zero-knowledge or zero-access security architecture. This security model means your passwords are inaccessible while stored and synced across the provider’s servers. In other words, the service has zero knowledge of your passwords and no possible way to decrypt them. Some services, such as 1Password, take this idea further with a device-bound key that you need to register each time you set up a new device.
All of this extra security is in place for convenience. In addition to storing your encrypted passwords, a password manager can also sync your logins across devices, and ideally offer autofill and credential capture as you’re creating new accounts.
If you don’t want to use remote servers, you can also host your own password vault. Bitwarden offers self-hosting, while Enpass allows you to sync with cloud storage providers like Google Drive or iCloud. Self-hosting provides the best security, assuming you have good network security, but avoid syncing with a cloud storage provider.
Bitwarden offers paid upgrade accounts. The cheapest of the bunch, Bitwarden Premium, is $10 per year. That gets you 1 GB of encrypted file storage and two-factor authentication (2FA) with devices like YubiKey, FIDO U2F, and Duo, plus a password hygiene and vault health report. You also get priority customer support with a paid account.
| Features | |
|---|---|
| Passkey support | Yes |
| 2FA support | Yes |
| Emergency access/recovery kit | Yes |
| Email aliases | Yes |
| Encrypted storage | 1 GB (Premium Plan) |
After signing up, download the app for Windows, macOS, Android, iOS, or Linux. There are also browser extensions for Firefox, Chrome, Safari, Edge, Vivaldi, and Brave.
Best Free Password Manager
Just about every password manager has some kind of free tier, but Proton Pass rises above the rest for its extensive free offerings. You get all the features you need in a password manager, including unlimited logins, unlimited devices, apps for browsers, mobile, and desktop, a password generator, passkey support, password testing, and even 10 email aliases that will keep your real email protected. Proton Pass’ free plan is competitive with paid options like 1Password and Dashlane, but it does lack some of the things Bitwarden offers, like family sharing; if you don't need that, Proton is a solid alternative to Bitwarden.
Proton Pass catapulted itself to the top of the password manager heap in part because it’s free but also because the company has a long (and very good) history when it comes to security and privacy. We’ve reviewed and recommend Proton's VPN and Proton Mail, and if you use either of those, then Proton Pass feels like a natural fit. Like Bitwarden, all the Proton Pass apps and extensions are open source (though the server-side component is not, one reason I still rate Bitwarden higher).
As with most of these services, we primarily use Proton Pass’s browser extensions, which have everything you need to fill and save passwords. The apps do have a few things worth using, like Pass Monitor, which is Proton’s security feature for flagging weak passwords and anything that’s been revealed in a data breach.
As great as the free plan is, it’s worth nothing that almost all the features missing are available in Proton's paid plans. If you need extra tools like two-factor authentication and online storage, you can pay for the Pass Plus plan, or if you use Proton's VPN, Mail, or other services, it would probably make the most sense to bundle them all with the Proton Unlimited plan, which is $10 per month.
| Features | |
|---|---|
| Passkey support | Yes |
| 2FA support | Yes |
| Emergency access/recovery kit | Yes |
| Email aliases | Yes |
| Encrypted storage | 10 GB (Plus Plan) |
Once you've signed up, download the Proton Pass app on Windows, macOS, Linux, Android, or iOS, and enable the browser extension on Chrome, Safari, Firefox, Edge, or Chrome.
Keeper (7/10, WIRED Recommends) is a bit more expensive than our top options. The free version lacks some built-in features, such as dark web monitoring, which is only available as a paid add-on. But when it comes to sharing logins with multiple people, Keeper tops the charts. That’s largely due to its enterprise focus, giving it an edge when managing logins for multiple users across multiple accounts.
Instead of structuring your data into separate vaults, Keeper lets you create folders and share them with a permission structure similar to Google Drive. Additionally, you can share passwords externally with one-time share links and create self-destructing records, which will automatically delete themselves shortly after being opened.
Although Keeper is more expensive than the competition in most cases, it offers a lot of flexibility for small businesses. Keeper can scale up to enterprises and government institutions, offering products that run as much as $85 per user, per month. But for smaller businesses, you can start for as little as $4 per user, per month. —Jacob Roach
| Features | |
|---|---|
| Passkey support | Yes |
| 2FA support | Yes |
| Emergency access/recovery kit | Yes |
| Email aliases | No |
| Encrypted storage | No (Up to 100 GB available separately) |
Once you’ve signed up, download the Keeper app on Windows, macOS, Linux, Android, or iOS, and enable the browser extension on Chrome, Safari, Firefox, Edge, Brave, or Chrome.
Another Good Password Manager
What sets 1Password (8/10, WIRED Recommends) apart from the other options on this list is the number of extras it offers. Like other password managers, 1Password has apps for every major platform, including macOS, iOS, Android, Windows, Linux, and ChromeOS. There’s even a command-line tool that will work anywhere. There are plug-ins for your favorite web browser, which make it easy to generate and edit new passwords on the fly.
I still find Bitwarden to be a more economical choice for most people, but 1Password has some very nice features you won’t find elsewhere. If you frequently travel across national borders, you’ll appreciate my favorite perk: Travel Mode. This mode lets you delete any sensitive data from your devices before you travel and then restore it with a click after you’ve crossed a border. This prevents anyone, including law enforcement at international borders, from accessing your complete password vault.
It’s worth noting that 1Password uses a combination of two keys to unlock your account: your password and an additional generated secret key. While that does add a layer of security that will protect against weak passwords, it also means part of what you need to unlock your passwords is something you did not create. 1Password does make sure you have this key as an item in your “emergency kit,” but I still prefer pairing a self-generated password with a hardware key, like the YubiKey.
In addition to working as a password manager, 1Password can act as an authentication app like Google Authenticator. For added security, it creates a secret key to the encryption key it uses, meaning no one can decrypt your passwords without that key. The downside is that if you lose this key, no one, not even 1Password, can decrypt your passwords. (This can be mitigated by setting up a custom group with the “Recover Accounts” permission.) It now offers passkey storage, as well.
1Password also offers tight integration with other mobile apps. Rather than copying and pasting passwords from your password manager to other apps (which puts your password on the clipboard, at least for a moment), 1Password is integrated with many apps and can autofill. This is more noticeable on iOS, where inter-app communication is more restricted.
| Features | |
|---|---|
| Passkey support | Yes |
| 2FA support | Yes |
| Emergency access/recovery kit | Yes |
| Email aliases | Yes |
| Encrypted storage | 1 GB |
After signing up, download the app for Windows, macOS, Android, iOS, Chrome OS, or Linux. There are also browser extensions for Firefox, Chrome, Brave, and Edge.
Best Full-Featured Manager
Dashlane offers most of what you’ll find in our other picks. The company no longer offers a desktop app, but I primarily use passwords in the web browser anyway, and Dashlane has add-ons for all the major browsers, along with iOS and Android apps. If a desktop app is important to you, that omission is something to be aware of, but in my testing, it isn’t a big deal. Dashlane uses the same AES 256-bit encryption in a zero-knowledge system, which means passwords are only ever decrypted on your device. Dashlane uses multifactor authentication if you want, via an authenticator app or a hardware key.
Dashlane is considerably more expensive than Bitwarden or 1Password, but that extra money does get you some additional security features, like Site Breach Alerts, which let you know if any web services you use have leaked your data. Dashlane also actively monitors the darker corners of the web, looking for leaked or stolen personal data, and it alerts you if your information has been compromised. There’s even a Phishing Alert system that will stop you from entering credentials on a site with a spoofed URL. This last feature is incredibly useful if you happen to be setting up less tech-savvy relatives or friends with a password manager. Dashlane’s phishing protection can save them from themselves. Dashlane also offers a VPN through Hotspot Shield VPN. I have not tested the Dashlane integration, but in testing Hotspot Shield on its own, we’ve always found it too slow to recommend in our VPN guide.
Setting up and migrating to Dashlane from another password manager is simple, and you’ll use a secret key to encrypt your passwords, much like Bitwarden’s setup process. In practice, Dashlane is very similar to the others on this list. Dashlane offers a 30-day free trial, so you can test it out before committing.
| Features | |
|---|---|
| Passkey support | Yes |
| 2FA support | Yes |
| Emergency access/recovery kit | Yes |
| Email aliases | Yes |
| Encrypted storage | 1 GB |
After signing up, download the app for Android and iOS, and grab the browser extensions for Firefox, Chrome, and Edge.
Best for Bundled Services
You might know Nord better for its VPN service, but the company also offers a password manager, NordPass, and a pretty nice online storage system, NordLocker. A part of the appeal of NordPass comes in bundling it with the company’s other services for some compelling deals. As a password manager, NordPass offers everything you need. It uses a zero-knowledge setup in which all data is encrypted on your device before it’s uploaded to the company’s servers. Unlike most services here, NordPass uses XChaCha20 for encryption. It would require a deep dive into cryptography to get into the differences, but the short story is that it’s just as secure and maybe slightly faster than the AES-256 encryption used by other services.
There’s a personal information storage feature to keep your address, phone number, and other personal data safe and secure, but easy to access. NordPass also offers an emergency access feature, which allows you to grant another NordPass user emergency access to your vault. It works just like the same feature in 1Password, allowing trusted friends or family to access your account if you cannot.
Other nice features include support for two-factor authentication to sign in to your account, as well as security tools to evaluate the strength of your passwords and alert you if any of your data is compromised. Note that NordPass Premium is theoretically $3 a month, but there are always sales that bring that much lower.
The downside, and my one gripe about all Nord services, is that there is no monthly plan. As noted above, the best deal comes in combining NordPass, NordVPN, and NordLocker for a bundled deal. A free version of NordPass is available, but it’s restricted to only a single device. —Jacob Roach
| Features | |
|---|---|
| Passkey support | Yes |
| 2FA support | No (business accounts only) |
| Emergency access/recovery kit | Yes |
| Email aliases | Yes |
| Encrypted storage | 3 GB |
After signing up, download the app for Windows, macOS, Linux, Android, iOS, and grab the browser extensions for Firefox, Chrome, Safari, Opera, and Edge.
Best DIY Options (Self-Hosted)
Want to retain more control over your data in the cloud? Sync your password vault yourself. The services below do not store any of your data on their servers. This means attackers have nothing to target. Instead of storing your passwords, these services use a local vault to store your data, and then you can sync that vault using a file-syncing service like Dropbox, NextCloud, or Edward Snowden’s recommended service, SpiderOak. There are two services to keep track of in this scenario, making it a little more complex. But if you’re already using a file-syncing file service, this can be a good option.
You can also properly host your own vault with network-attached storage or a local server.
Enpass does not store any data on its servers, so you don’t have to worry about Enpass being hacked. Syncing is handled through third-party services. Enpass doesn’t do the syncing, but it does offer apps on every platform. That means once you have syncing set up, it works just like any other service. Enpass supports syncing through Dropbox, Google Drive, OneDrive, iCloud, Box, Nextcloud, or any service using WebDAV. Alas, SpiderOak is not currently supported. You can also synchronize your data over a local WLAN or Wi-Fi network.
All of the features you expect in a password manager are here, including auto-generating passwords, breach-monitoring, biometric login (for devices that support it), auto-filling passwords, and options to store other types of data, like credit cards and identification data. There’s also a password audit feature to highlight any weak or duplicate passwords in your vault. One extra I particularly like is the ability to tag passwords for easier searching. Enpass also makes setting up the syncing through the service of your choice very easy. Enpass added support for passkeys, too.
Enpass is free to use on Windows, Mac, and Linux. The mobile version syncs up to 25 items in one vault for free. For more than that, you’ll want to sign up for the paid service.
After signing up, download the app for Mac, Windows, Linux, Android, and iOS, and grab the browser extensions for Chrome, Vivaldi, Edge, and Firefox.
KeePassXC works like Enpass above. It stores your passwords in an encrypted digital vault that keeps you secure with a master password, a key file, or both. You sync that database file yourself using a file-syncing service. Once your file is in the cloud, you can access it on any device that has a KeePassXC client. Like Bitwarden, KeePassXC is open source, which means its code can be and has been inspected for critical flaws. If you’re an advanced user and comfortable handling your own issues and support, KeePassXC makes a great choice.
The downside of KeePassXC is that it doesn’t have official mobile clients. However, third-party apps are available for iOS and Android. KeePassXC is a fork of KeePass that offers better cross-platform support, but there are a handful of other forks available, as well.
Download the desktop app for Windows, macOS, or Linux and create your vault. There are also extensions for Firefox, Edge, and Chrome. The project does not offer apps for phones. Instead, it recommends KeePass2Android or Strongbox for iPhone.
Other Password Managers We’ve Tested
Password managers are not a one-size-fits-all solution. Our top picks cover most use cases and are the best choices for most people, but your needs may be different. Fortunately, there are plenty of good password managers out there. Here are some more we’ve tested.
Google Password Manager (Free): Google has offered a password manager within Chrome for years, but it recently broadened with a dedicated Android app. Although storing passwords in your browser has a few security concerns, Google offers top-notch encryption, the option to turn on on-device encryption, and integration with biometric authentication on Android and Windows. It can even store passkeys. For most people, I recommend a third-party password manager, but if you aren’t using a password manager at all, Google Password Manager is a good option.
RoboForm ($30 Per Year, $48 Per Year for a Five-User Family Plan): RoboForm has most of the same features as the rest on this list, but it lacks some of the things that differentiate our top picks, like Bitwarden’s open source aspect and 1Password’s travel features. I’ve been testing the free plan for a while and haven’t run into any problems. There are apps for every common platform, and it’s easy to use. RoboForm recently completed an independent security audit and came out looking good.
Pass (Free): Pass is a command-line wrapper around GPG (GNU Privacy Guard), which means it is only for the nerdiest users. It supports managing encrypted .gpg files in Git, and third-party mobile apps are available. It’s not for everyone. For years, this was my password manager of choice, but eventually, Bitwarden’s ease of use won me over.
Password Managers to Avoid
Most password managers are decent. Some are more secure than others, but the top password managers largely compete on features and pricing. Security is a prerequisite. However, there are a couple of password managers you should avoid for various reasons.
ExpressKeys by ExpressVPN: ExpressKeys is from ExpressVPN (formerly Keys by ExpressVPN that I tested, but it’s the same product), which ranks among the best VPN services on the market. But ExpressKeys doesn’t live up to the same standard. It’s secure, but I struggled to get it to work with any consistency. The browser extension requires the desktop ExpressVPN app to work, and closing either will force you to sign back in all over again. Worse, ExpressKeys wouldn’t recognize that I was signed into my ExpressVPN account about half the time. It needs some serious fixes before I can recommend it. —Jacob Roach
LastPass: LastPass has suffered a handful of data breaches, and after changing ownership, it appears that the company is in better shape security-wise. However, the fallout of the LastPass 2022 data breach and the lack of communication about it still ripples throughout the cybersecurity world, being linked to over $180 million in cryptocurrency theft. It’s one thing to suffer a breach, but it’s another to fail to disclose necessary precautions when so much is at stake. Proton Pass now offers a competitive free plan, while Bitwarden, 1Password, and NordPass are solid paid options; I see no reason to recommend LastPass given its history.
Why (and How) You Should Use a Password Manager
A good password manager stores, generates, and updates passwords for you with the press of a button. You don’t even need to spend a dime to start using one. Here’s why you should, and a few tips for getting started.
Only one password to remember: To access all of your passwords, you only have to remember one password. When you type that into the password manager, it unlocks the vault containing all of your actual passwords. Only needing to remember one password is great, but it means there’s a lot riding on that password. Make sure it’s a good one. If you’re having trouble coming up with that one password to rule them all, check out our guide to better password security. You might also consider using the Diceware method for generating a strong master password.
Apps and extensions: Most password managers are full systems, rather than a single piece of software. They consist of apps or browser extensions for each of your devices (Windows, Mac, Android phones, iPhone, and tablets), which have tools to help you create secure passwords, safely store them, and evaluate the security of your existing passwords. All that information is then sent to a central server where your passwords are encrypted, stored, and shared between devices.
Fixing compromised passwords: While password managers can help you create more secure passwords and keep them safe from prying eyes, they can’t protect your password if the website itself is breached. That doesn’t mean they don’t help in this scenario, though. All the cloud-based password managers we discuss offer tools to alert you to potentially compromised passwords. Password managers also make it easier to quickly change a compromised password and search through your credentials to ensure you didn’t reuse any compromised passwords.
Passkey storage and support: An increasing number of websites and services support passwordless login with a passkey. That makes logging in both safer and easier. Password managers like Bitwarden, 1Password, Proton Pass, and Dashlane support passkey storage and sync so you can easily access them across your devices.
You should disable auto form-filling: Some password managers will automatically fill in and even submit web forms for you. This is super convenient, but for additional security, we suggest you disable this feature. Automatically filling in forms in the browser has made password managers vulnerable to attacks in the past. For this reason, some, like 1Password, require you to opt into this feature. We suggest you do not.
Don’t panic about hacks: Software has bugs, even your password manager. The question is not what to do if it becomes known that your password manager has a flaw, but what you do when it becomes known that your password manager has a flaw. The answer is, first, don’t panic. Normally bugs are found, reported, and fixed before they’re exploited in the wild. Even if someone does manage to gain access to your password manager’s servers, you should still be fine. All of the services we list store only encrypted data, and none of them store your encryption key, meaning all an attacker gets from compromising their servers is encrypted data.
How We Test
The best and most secure cryptographic algorithms are all available via open-source programming libraries. On the one hand, this is great, as any app can incorporate these ciphers and keep your data safe. Unfortunately, any encryption is only as strong as its weakest link, and cryptography alone won’t keep your passwords safe.
This is what I test for: What are the weakest links? Is your master password sent to the server? Every password manager says it isn’t, but if you watch network traffic while you enter a password, sometimes you find, well, it is. I also dig into how mobile apps work: Do they, for example, leave your password store unlocked but require a PIN to get back in? That’s convenient, but it sacrifices too much security.
The best security is built on the back of a broad ecosystem of shared knowledge. Bitwarden and Proton Pass have open-source apps, so while that isn’t a wholesale endorsement of their security, it makes security flaws in the apps much less likely. Dashlane and 1Password use proprietary apps, but they publish white papers detailing their security architecture. For password managers, the standard isn’t marketing bullet points. You need to show your work.
Security is the top priority, but usability is a close second. A password manager should make your digital life easier and more secure, not one or the other. Newer features like passkey support are paramount, and browser extensions with seamless autofill and credential capture are a prerequisite.
From there, it’s all about dressing. Do you need more encrypted storage like Proton offers? Do you want to host your own passwords with Bitwarden or KeePassXC? The password managers I’ve included here all get the essentials right. It’s up to you to decide what features you need on top of that core.
Power up with unlimited access to WIRED. Get best-in-class reporting and exclusive subscriber content that’s too important to ignore. Subscribe Today.
Comments
Back to top