Top picks by use case
| Use case | Recommended | Why |
|---|---|---|
| Best free password manager | Bitwarden Free | Generous free tier; unlimited passwords + sync |
| Best paid password manager | 1Password | Most polished UX; Secret Key model |
| Best for Apple ecosystem | Apple Passwords | Built in, free, well-integrated |
| Best privacy-focused | Proton Pass | Swiss-based; E2EE; identity protection |
| Best self-hosted | Vaultwarden | Bitwarden-compatible; owns the server |
| Best for families | 1Password Families or Bitwarden Families | Strong sharing models |
The main contenders
The best balance of price, security, and ecosystem reach. Free tier covers unlimited passwords, multi-device sync, browser extensions, and mobile apps — most users never need to upgrade. Open-source clients and server, audited security, broad platform support. Premium tier (~$10/year) adds TOTP storage, file attachments, emergency access.
Best for: almost everyone. Default recommendation.
The most refined password manager on the market. Browser extension and mobile apps are best-in-class. The Secret Key model (master password + a randomly generated key stored on each device) adds an additional protection layer against server-breach scenarios. Strong developer tools (CLI, SSH agent, secret injection).
Best for: users who value UX polish and don't mind paying ~$36/year; devs needing SSH/secrets workflow.
Apple's iCloud Keychain became a real cross-platform password manager with the standalone Passwords app. Free, well-integrated, iCloud sync. Cross-platform support (Windows, Android via Chrome extension) is improving but partial. Passkey support is excellent.
Best for: all-Apple households where Windows/Android isn't a daily concern.
Part of Proton's privacy suite. End-to-end encrypted, Swiss-based, integrated with Proton Mail aliases (create burner email addresses per signup). Generous free tier; Proton Unlimited gets you Pass + Mail + VPN + Drive in one bundle. Newer than the others — feature parity is close but not complete.
Best for: existing Proton users; users who want all-in-one privacy suite.
An unofficial reimplementation of the Bitwarden server you can run on your own hardware. Use all official Bitwarden clients against your own server. Tiny resource footprint, runs on a Pi or any mini PC. For users who want to own the vault and have the operational discipline to back it up properly.
Best for: homelabbers, privacy-maximalist users with self-hosting comfort.
What you can skip in 2026
- LastPass: after the 2022 breach where customer vault data was exfiltrated, the trust calculus has not recovered. Plenty of better options exist.
- Built-in browser password managers (Chrome / Firefox / Edge) as a primary: better than nothing, but locked to the browser, weaker sharing, and less consistent across devices. Use a real password manager instead.
- "Free" tools with unclear business models: a password manager is a piece of infrastructure that has to exist for decades. Pick a vendor whose business model you understand.
What actually matters when picking
- Master password: long, unique, memorable (not "password123!"). The entire security model rests on this.
- Two-factor authentication on the vault: non-negotiable. TOTP or hardware key.
- Cross-device sync: every modern option does this; verify it actually works on your devices before committing.
- Browser extension polish: you'll use it dozens of times a day. Try the extension before deciding.
- Recovery story: what happens if you forget the master password? Most providers can't help you. Plan a recovery method.
- Family / sharing: if multiple people need access, evaluate the org/family plan model.
Passkeys
Passkeys are replacing passwords on supporting sites. Modern password managers store and autofill passkeys alongside passwords. As of 2026:
- 1Password, Bitwarden, Apple Passwords, Proton Pass all support storing passkeys.
- Cross-platform passkey sync works but ecosystem-walled — Apple passkeys sync via iCloud, others via your password manager's sync.
- A cross-platform password manager that stores passkeys is more portable than the platform default.
Pricing snapshot (2026)
- Bitwarden Free: $0 — unlimited passwords, sync, mobile, browser.
- Bitwarden Premium: ~$10/year — adds TOTP, attachments, emergency access.
- Bitwarden Families: ~$40/year for 6 users.
- 1Password Individual: ~$36/year.
- 1Password Families: ~$60/year for 5 users.
- Proton Pass Plus: ~$2-4/month, generous free tier.
- Apple Passwords: free with any Apple device.
Common pitfalls to avoid
- Reusing your master password elsewhere — defeats the entire model.
- No 2FA on the vault — if someone gets your master password, they get everything. Always 2FA.
- Storing 2FA codes only in the password manager — combines two factors into one. Use a separate TOTP app or hardware key for the password manager's 2FA.
- No backup of recovery codes — print them, store offline.
- Never running breach reports — Watchtower / Vault Health Reports tell you which passwords have leaked. Run them.
Frequently Asked Questions
Is Bitwarden Free really good enough?
For most users, yes. Unlimited passwords, multi-device sync, browser extensions, mobile apps — the core experience is complete. You only need to pay if you want TOTP storage inside the vault, file attachments, or emergency access.
What if I forget my master password?
Generally, the vault is unrecoverable — that's the security model. Mitigations: long memorable passphrase rather than complex string; emergency access (paid tiers); printed recovery key in a safe deposit box. 1Password's "Emergency Kit" PDF is a good template.
Should I use a hardware key?
Yes, for your password manager's own 2FA — YubiKey or similar. Combined with a strong master password, this is the strongest practical setup for individuals.
Is it safe to put all my passwords in one place?
Yes — and far safer than the alternative of reusing passwords or storing them in a file. The encryption model means the provider can't read your vault even if breached; an attacker would need to break the encryption with your master password.
Can I migrate from one to another?
Yes. All major password managers have CSV export and CSV import. Plan an hour for cleanup; review for duplicates and weak passwords during the move.
What about LastPass?
Skip. The 2022 breach exposed customer vault metadata and likely encrypted vault contents. While breached vaults are only decryptable by someone with the master password, the response and ongoing trust posture make better alternatives the obvious pick.