The best password manager for you: 1Password, Bitwarden, Proton Pass and the built-ins compared

The biggest password risk is reuse. When one site is breached, attackers try the leaked email and password on hundreds of other sites, automatically. A password manager fixes reuse by generating a different random password for every account and filling it in for you. You remember one strong master password, or use your device's face or fingerprint unlock, and the manager handles the rest.

Good managers also warn you about reused, weak or breached passwords, store passkeys, and fill logins only on the real site, so they quietly protect you from some phishing pages too.

Features below are based on each company's published documentation at the time of writing. Plans change, so check the current details on their sites before you choose.

If everything you own comes from one company, start with what is already there.

Apple Passwords. Since iOS 18 and macOS Sequoia, Apple's password manager has its own Passwords app instead of being buried in Settings. It syncs through iCloud Keychain with end-to-end encryption, stores passkeys and 2FA verification codes, flags reused and compromised passwords, and lets you share selected passwords with a group. It works on Windows through iCloud for Windows. The catch: no Android app, so it fails if anyone in the household has an Android phone or you use a Windows PC heavily.

Google Password Manager. Built into Chrome and Android, and available on iPhone through Chrome. It runs Password Checkup for leaked and reused passwords and supports passkeys. You can turn on on-device encryption so Google cannot read your passwords; look in the manager's settings. The catch: it is tied to Chrome on desktop, so it is awkward if you use Safari or Firefox.

Both are free, both are well maintained, and both are a huge improvement over reusing passwords. The case for a separate manager is mixed devices, sharing with people outside your ecosystem, or features like secure notes and email aliases.

Bitwarden: the best free choice for most people

Bitwarden's free plan includes unlimited passwords on unlimited devices, passkey support and apps for every platform. The code is open source and the company publishes third-party security audits. Its apps are plainer than 1Password's, and some extras, such as built-in 2FA code storage and advanced vault reports, are on the paid plan. If you want a free cross-platform manager, start here.

1Password: the most polished paid option

1Password has no free plan, only a trial. In return you get careful design, good family and team sharing, a Watchtower dashboard for weak and breached passwords, and a security model that combines your master password with a Secret Key stored on your devices. That Secret Key means a stolen copy of your vault from 1Password's servers would be far harder to crack, even with a weak master password. It also integrates with Fastmail's masked email feature.

Dashlane

Dashlane is a capable paid manager with good autofill and passkey support. It has moved to running mainly in the browser and on mobile rather than through desktop apps. Its free offering has been cut back over time, so check the current plans.

KeePassXC: no cloud, full control

KeePassXC is a free, open-source desktop app that stores your vault in an encrypted file on your own computer. Nothing goes to a company's servers unless you put the file there. The trade-off is work: you handle syncing (through a cloud drive or otherwise), backups, and mobile access through separate compatible apps. It suits technical users who want no account and no subscription.

Proton Pass comes from Proton, the Swiss company behind Proton Mail and Proton VPN. Its apps are open source and have been independently audited, according to the company. The feature that sets it apart is built-in email aliases: when you sign up for a site, Pass can create a unique forwarding address so the site never sees your real email. If that address starts getting spam, you turn it off.

It is younger than 1Password and Bitwarden, and the free tier has limits on things like the number of aliases and vaults. If you already use Proton Mail, it fits in neatly.

In 2022, attackers broke into LastPass's systems and, according to the company, stole backups of customer vault data. The passwords inside those vaults were encrypted with each user's master password, but some information, including website addresses, was not. That meant anyone with a weak master password, or an older account with weaker encryption settings, was at greater risk from offline cracking, and every user learned which sites the attackers knew they had accounts on.

Three lessons carry over to any manager:

• Your master password must be long. A passphrase of four to six random words is far stronger than a short complex password and easier to remember.
• Check what gets encrypted. Prefer managers that encrypt all fields, including URLs and item names, and publish independent audits.
• Protect the account itself. Turn on two-factor authentication for your password manager account.

1. Install the new manager and set a strong master password. Write it down and store it somewhere safe at home.
2. Export from your old manager or browser. Most offer a CSV export: in Chrome it is in Google Password Manager settings, and in the Apple Passwords app on a Mac it is under the File menu.
3. Import the file into the new manager. Bitwarden, 1Password and Proton Pass all have import tools that recognize common formats.
4. Delete the export file immediately, and empty the trash. It contains every password in plain text.
5. Turn off password saving in your browser so two managers do not compete to fill forms.
6. Run the new manager's security report and change reused or breached passwords, starting with email and banking. Our guide to checking for leaked passwords explains what the warnings mean.