How to Choose a Password Manager: The Features That Actually Matter

The safest password is one that is long, random and used on exactly one website. Nobody can remember fifty of those, which is why a password manager is the most practical security upgrade most people can make. It generates and stores a unique password for every account and fills it in for you.

Choosing one is easier once you know which features matter and which are marketing.

Why reused passwords are the real risk

When one website is breached, attackers try the leaked email and password combinations on other popular services. If you reused that password, they get in without any hacking skill at all. Current guidance from NIST's digital identity guidelines favours long passwords, screening against known-breached passwords and avoiding forced periodic changes. A password manager makes all of that effortless.

The features that matter

1. A clear security model

Look for end-to-end encryption, sometimes described as "zero-knowledge": your vault is encrypted on your device with a key derived from your master password, so the company cannot read it. Check whether the provider publishes independent security audits and how it handled past incidents. Transparency after a problem tells you more than a spotless marketing page.

2. Works on every device you use

You need it on your phone, your laptop and every browser you use. If it is awkward on one of them, you will start saving passwords somewhere else and the system breaks down.

3. Passkey support

Passkeys are replacing passwords on many large sites. A manager that can store and sync passkeys across your devices saves you from being tied to one phone platform.

4. Built-in two-factor support

Some managers can store authenticator codes. That is convenient, but for your most important accounts it is reasonable to keep the second factor on a separate device so a single compromise does not expose both.

5. Secure sharing

Families and small teams need to share some logins, such as the electricity account or a company social profile. Proper sharing lets you revoke access later without changing the password for everyone.

6. Recovery and emergency access

Find out exactly what happens if you forget your master password. Some services offer recovery keys or trusted emergency contacts; others cannot recover your vault at all, by design. Neither is wrong, but you must know which you have.

7. Export

You should be able to export your vault in a standard format. If you cannot leave easily, think twice before going in.

Features that matter less

• Dark-web monitoring dashboards are useful but you can check breach exposure for free with services like Have I Been Pwned.
• Bundled VPNs are a separate product and should be judged separately.
• Password "strength scores" are nice to look at; the generator matters more.

Built-in browser managers vs dedicated apps

The password managers built into Chrome, Safari, Edge and Firefox have improved a lot and are far better than reusing passwords. Their weakness is that they work best inside one ecosystem. If you use an iPhone with a Windows laptop, or share logins with family on different devices, a dedicated manager is usually smoother.

Choosing a master password

Your master password is the one password you do need to remember. Make it a passphrase of four or more random words, for example something like copper-lantern-orbit-meadow but not that one. Length beats symbols. Never use it anywhere else, and switch on two-factor authentication for the manager itself.

Moving your passwords across safely

1. Install the manager on your computer and phone, and set the master password and 2FA.
2. Import saved passwords from your browser using the manager's import tool. Delete the temporary export file afterwards; it is not encrypted.
3. Turn off the browser's own password saving to avoid two competing systems.
4. Run the manager's report for reused or weak passwords and change them, starting with email, banking and shopping accounts.
5. Work through the rest gradually, changing each password the next time you log in.

Bottom line

The best password manager is the one you will use on every device every day. Prioritise strong encryption, cross-device support, passkeys and a recovery plan you understand. Everything else is a bonus.