Password Manager Guide: 9 Smart Ways to Choose the Best One for Safer Online Security in 2026

Introduction

A password manager is one of the few security tools that makes life easier and safer at the same time. Most people have well over a hundred online accounts: email, banking, shopping, work tools, streaming, and old forums they forgot existed. Nobody can remember a strong, unique password for each one, so people reuse the same few. Criminals know this and build entire operations around it.

When one website leaks its user list, attackers take those emails and passwords and try them everywhere else. If you used the same password on your email, your bank, and that old forum, one leak can open all three. It happens every day.

A good password manager fixes this by creating a long random password for every site and remembering them for you. You only need to remember one strong master password. But here is the honest part most guides skip: password managers themselves have been breached. LastPass, once the most popular option, lost encrypted customer vaults to hackers in 2022, and investigators have since linked that theft to millions of dollars in stolen cryptocurrency.

So the question is not just “should I use one?” The answer to that is yes. The real question is how to choose one that is built well, run honestly, and set up properly. This guide walks through exactly that, using real cases to show what separates a safe choice from a risky one.

What Top-Ranking Password Manager Guides Cover and Miss

I reviewed the pages ranking for “how to choose a password manager” and “best password manager” in October 2026, including Consumer NZ’s buying guide, vendor blogs from security companies, and several 2026 comparison roundups. They agree on the basics: encryption, a password generator, cross-device sync, and price.

What most of them leave out:

• Which password managers have actually been breached, and what happened next
• How criminals profit from stolen vaults and reused passwords
• Why company honesty after a breach matters as much as the technology
• Many are written by vendors ranking their own product first

Primary keyword

• password manager (focus keyword)

Secondary and LSI keywords used in this article

• best password manager
• master password
• zero-knowledge encryption
• password generator
• two-factor authentication
• credential stuffing
• password vault
• passkeys
• data breach
• open-source password manager

Why You Need a Password Manager: The Credential Stuffing Problem

The biggest threat to most people is not a genius hacker guessing their password. It is credential stuffing: criminals take email and password pairs leaked from one site and use automated tools to try them on thousands of other sites. Any account where you reused that password falls.

A real example: 23andMe

Between April and September 2023, an attacker used passwords leaked from unrelated breaches to log in to about 14,000 accounts on the genetic testing site 23andMe. Because of a feature that let relatives see each other’s profiles, those 14,000 logins exposed personal and ancestry data linked to roughly 6.9 million people. The stolen data was later advertised for sale online.

The UK’s Information Commissioner’s Office fined the company £2.31 million in 2025 for weak security, and 23andMe also settled a US class action for $30 million (The Register report on the ICO fine). But notice where the attack started: ordinary users who had reused old passwords.

What a password manager changes

A password manager breaks this chain in three ways:

1. Unique passwords everywhere. A built-in password generator creates a different random password for every account, so one leak stays one leak.
2. Phishing protection. Autofill only works on the real website address. If a fake bank page asks for your login, the manager stays silent, which is a strong warning sign.
3. Breach alerts. Most managers check your saved logins against known leak databases and tell you which passwords to change.

The common worry is “isn’t it risky to keep everything in one place?” It is a fair question, and the breach cases later in this article answer it honestly. The short version: a well-built password vault with a strong master password is far safer than reusing passwords, even when the company behind it gets attacked.

How to Choose a Password Manager: 9 Factors That Actually Matter

Feature lists all look alike. These nine checks separate a trustworthy password manager from one that only looks good on a sales page.

1. Zero-knowledge encryption

With zero-knowledge encryption, your vault is encrypted on your device before it is uploaded, using a key derived from your master password. The company never sees your master password or your unencrypted data. If their servers are breached, attackers get scrambled data they still need to crack. Look for AES-256 or XChaCha20 encryption and a strong key derivation method such as Argon2 or PBKDF2 with a high iteration count.

2. How the vault is encrypted, not just whether it is

This sounds technical, but it mattered in the LastPass breach. Some older vaults left website addresses unencrypted, which told attackers which accounts were worth targeting. A good password manager encrypts every field, including URLs and notes.

3. Independent security audits

Any company can claim to be secure. The best password manager options publish reports from outside security firms that test their code and infrastructure, ideally every year. If you cannot find a recent audit, treat that as a warning.

4. Open source or transparent code

An open-source password manager such as Bitwarden or KeePassXC lets independent researchers read the code and spot problems. Closed-source tools can still be safe, but they should make up for it with frequent public audits and a bug bounty program.

5. Breach history and honesty

Every large company will face attacks. What matters is how it responds. Did it disclose quickly and clearly? Did it tell users exactly what was taken? Did it change its practices? A history of vague or delayed disclosure is a red flag.

6. Strong two-factor authentication options

Your vault should support two-factor authentication with an authenticator app, and ideally a hardware security key such as a YubiKey. SMS codes are better than nothing but can be hijacked through SIM swap fraud.

7. Passkey support

Passkeys are replacing passwords on many major sites, including Google, Apple, Microsoft, Amazon, and banks. A modern manager should store and sync passkeys across your devices so you are not locked into one phone maker.

8. Works on every device you use

Check support for Windows, Mac, iPhone, Android, and the browsers you use. A manager that does not autofill smoothly on your phone will be abandoned within a month.

9. Fair pricing and easy export

Good free plans exist, and paid plans usually cost $1 to $5 a month. Whatever you choose, confirm you can export all your data in a standard format. That way you can leave if the company is sold, breached, or raises prices.

Types of Password Manager: Which Style Fits You?

Before comparing brands, decide which type of password manager suits your habits. Each has real trade-offs.

Cloud-based password managers

Your encrypted vault is stored on the company’s servers and syncs across all your devices. Examples include Bitwarden, 1Password, Proton Pass, Dashlane, and NordPass.

• Pros: easy setup, automatic sync, family sharing, recovery options
• Cons: your encrypted vault sits on a server that criminals will target

Offline or local password managers

The vault lives as a file on your own device. KeePassXC is the best-known example.

• Pros: nothing stored with a third party, full control, free
• Cons: you handle syncing and backups yourself; lose the file and its backup, and you lose everything

Built-in browser and phone managers

Google Password Manager, Apple Passwords, and Microsoft Edge’s manager are already on your devices.

• Pros: free, zero setup, and they now support passkeys and breach alerts
• Cons: they work best inside one company’s ecosystem, so mixing an iPhone with a Windows PC or Android tablet can get awkward

Business password managers

Companies need admin controls, shared vaults, audit logs, and the ability to remove access when someone leaves. 1Password Business, Bitwarden Teams, and Keeper are common choices. A personal app shared through one office login is not a business solution.

For most individuals and families, a reputable cloud-based password manager gives the best balance of security and convenience. Technical users who want total control often prefer KeePassXC.

Best Password Manager Options Compared

This table compares popular choices on the factors covered above. It is not a paid ranking, and plans change often, so check current pricing on each official site.

If you want one simple recommendation: Bitwarden for most people, 1Password if you want the most polished family app, and KeePassXC if you prefer to keep everything offline.

When Password Managers Were Breached: Real Cases and Lessons

It would be dishonest to recommend a password manager without showing what happens when one fails. These cases are the clearest guide to what to look for.

LastPass 2022: stolen vaults and millions in crypto theft

In August 2022, an attacker broke into LastPass’s development environment. LastPass first said no customer data was touched. Then, in December 2022, it admitted the attacker had used information from that first breach to steal backups of customer vaults. According to the UK regulator’s findings, the attacker first compromised an employee’s laptop, then used access to both personal and work accounts to steal cloud access and decryption keys.

The vaults were encrypted, but some fields such as website addresses were not, and older accounts had weak key-derivation settings. Users with short master passwords became targets for offline cracking.

What followed was a slow-motion crime wave:

• In September 2023, security researchers linked a series of six-figure cryptocurrency thefts to victims who had stored wallet seed phrases in LastPass Secure Notes.
• In March 2025, US prosecutors seized about $24 million in crypto tied to a $150 million theft, and court filings showed the Secret Service and FBI believed the keys came from a cracked LastPass vault (KrebsOnSecurity report).
• In November 2025, the UK Information Commissioner’s Office fined LastPass £1.2 million for failing to protect 1.6 million British users (TechRadar report on the ICO fine).

LastPass has said law enforcement has not shown it conclusive evidence linking the thefts to its incident. Even so, the lessons are clear: encrypt everything, use strong key derivation by default, disclose fully and early, and never store crypto seed phrases in any cloud vault.

Norton Password Manager: credential stuffing against the vault itself

In December 2022, Norton’s parent company Gen Digital warned several thousand customers that attackers may have accessed their Norton Password Manager accounts. The attackers had not hacked Norton. They used email and password pairs leaked elsewhere and simply tried them on Norton’s login page. People who reused a password for their password manager handed criminals the key to everything.

Lesson: your master password must be unique, and two-factor authentication on the vault is not optional.

Passwordstate 2021: a poisoned software update

In April 2021, attackers hijacked the update system of Passwordstate, a business password manager made by Click Studios. For roughly a day, customers who installed the update received malware that collected stored passwords and sent them to the attackers. This is called a supply-chain attack: the product was trusted, so the malicious update was trusted too.

Lesson: business users need vendors with signed updates, strong internal security, and a fast incident response.

What these cases have in common

1. Strong encryption helped, but weak defaults and unencrypted metadata gave attackers a head start.
2. Reused and short master passwords turned an encrypted vault into a crackable one.
3. Delayed or partial disclosure left users unprotected for months.
4. The criminals who profited were committing serious crimes, and law enforcement has been able to trace and seize stolen funds, but victims rarely get everything back.

Setting Up Your Password Manager Safely

Choosing well is half the job. The other half is setting it up so that even a breach at the company would not expose you.

Step-by-step setup

1. Create a long master password. Use a passphrase of five or six random words, such as four unrelated nouns plus a number. Length beats complexity. Never reuse it anywhere else.
2. Turn on two-factor authentication immediately. Use an authenticator app or a hardware key. This alone would have stopped the Norton-style attacks.
3. Write down your recovery details. Store your emergency kit or recovery code on paper in a safe place at home. Many zero-knowledge services cannot reset a forgotten master password.
4. Import, then clean up. Import passwords saved in your browser, then delete them from the browser so they are not stored in two places.
5. Fix the worst passwords first. Use the password health report to change reused and weak passwords on email, banking, and your phone provider account before anything else.
6. Add passkeys where offered. Switch important accounts to passkeys as sites support them.
7. Keep crypto seed phrases offline. Write them on paper or metal. The LastPass thefts show what happens when they sit in a cloud vault.

Using a password manager ethically

A password manager is a tool for protecting your own accounts and those you are authorised to manage. A few honest ground rules:

• Do not use shared vaults to pass around accounts you are not allowed to share, such as paid subscriptions against their terms or a former employer’s systems after you leave.
• At work, follow company policy. Storing work credentials in a personal vault can break security rules and data protection law.
• Never access someone else’s vault without permission, even a partner’s or family member’s. Unauthorised access to accounts is a crime in most countries, including under the UK Computer Misuse Act and the US Computer Fraud and Abuse Act.
• Plan for emergencies. Most good managers offer an emergency access feature so a trusted family member can reach your accounts if something happens to you. Set it up openly and with consent.

Ongoing habits

• Review breach alerts monthly
• Update the app and browser extension promptly
• Check that your provider still publishes audits each year
• Export a backup of your vault occasionally and store it encrypted

Password Manager FAQs

Is a free password manager safe?

Yes, if it comes from a reputable provider. Bitwarden, Proton Pass, KeePassXC, and the built-in Apple and Google options are free and use strong encryption. A free password manager from an unknown developer with no audits is a different story.

What happens if my password manager company gets hacked?

With zero-knowledge encryption, attackers get an encrypted copy of your vault. A long, unique master password makes cracking it impractical. The LastPass victims who lost money mostly had weaker master passwords or old, weak encryption settings.

Can I use the password manager built into my browser?

For many people, yes. Browser and phone password managers have improved a lot. A dedicated password manager is better if you use devices from different companies, need secure sharing, or want detailed security reports.

Should I store two-factor codes in my password manager?

It is convenient but puts both factors in one place. For email, banking, and the password manager itself, keep two-factor codes in a separate authenticator app or on a hardware key.

Is it worth switching away from LastPass?

That is a personal decision. If you stay with any password manager after a breach, change your master password, increase encryption settings, and move the passwords to your most important accounts. If you leave, export your data and delete the old account once the new password manager is set up.

Conclusion

Choosing a password manager comes down to trust built on evidence: zero-knowledge encryption that covers every field, regular independent audits, open or transparent code, strong two-factor and passkey support, smooth apps on every device you use, fair pricing, and an honest record when things go wrong. Real cases show why each point matters, from 23andMe’s credential stuffing breach that exposed 6.9 million people through reused passwords, to the LastPass vault theft that investigators have tied to tens of millions of dollars in crypto crime, to attacks on Norton and Passwordstate users. For most people, a well-audited option such as Bitwarden, 1Password, or Proton Pass, protected by a long unique master password and two-factor authentication, is far safer than reusing passwords, and using it ethically and keeping critical secrets like crypto seed phrases offline closes the remaining gaps.