How to choose a password manager

1. Start with the security architecture

Insist on zero-knowledge design — the vendor cannot read your vault — with modern encryption (AES-256 or XChaCha20) and, ideally, an additional secret the vendor never stores. Read the audit reports: credible vendors commission regular independent audits and publish the results, including the unflattering parts.

2. Check breach history and, more importantly, breach response

Almost every vendor in this category has faced incidents. What separates trustworthy companies is transparent disclosure, clear technical explanation, and evidence that the architecture contained the damage. A vendor with no incidents and no transparency deserves more suspicion, not less.

3. Verify passkey and MFA support

Passkeys are replacing passwords faster than expected; your manager should store, sync and fill them across devices today. Equally, check MFA options for the vault itself — hardware key support is the gold standard for the account that guards everything else.

4. Test the daily experience on your devices

Browser extensions, mobile autofill and desktop apps must work frictionlessly on your actual platforms, or you will route around them — which defeats the entire purchase. Trial the top two candidates on every device you own before deciding.

5. Choose sharing and recovery features deliberately

Families need shared vaults and emergency access; businesses need admin policies, group sharing and fast offboarding. Decide these requirements before choosing a plan tier, because they usually sit one tier up from the headline price.

6. Price is the least important factor — within reason

The gap between a good free tier (Bitwarden) and paid plans is smaller than the cost of one account takeover. Buy for architecture and fit; but do not pay business-tier prices for features a family plan already includes.

Next steps

With the criteria clear, the fastest route to a confident shortlist is our category research: