How to Choose a Password Manager App: A Simple Guide

The right password manager is the one you will actually open every day: one with zero-knowledge, end-to-end encryption (almost always AES-256), autofill that works in both your browser and your phone's keyboard, and a recovery plan you set up before you ever need it. Brand loyalty, price, and long feature lists come a distant second to those four things, so judge every candidate against them first.

How they actually keep your passwords secret#

Encryption is the easy part; key derivation is the real difference#

Almost every reputable manager encrypts your vault with AES-256, so that number is not a useful way to tell them apart. What matters more is the key derivation function (KDF) — the math that turns your master password into the actual encryption key. The two you will see are PBKDF2-SHA256 and Argon2id. Argon2id is the newer, stronger choice because it is deliberately memory-hard, which makes brute-force cracking on cheap GPUs far more expensive.

If your manager uses PBKDF2, the iteration count matters. OWASP's current guidance is 600,000 iterations for PBKDF2-HMAC-SHA256, and Bitwarden now defaults to exactly that (you can also switch it to Argon2id under Account Settings > Security > Keys). This is not academic. In the 2022 LastPass breach, attackers stole encrypted vault backups, and older accounts were still configured with far fewer iterations than the modern default — weak enough that a determined attacker could grind at them offline. The lesson is that "unbreakable encryption" depends on settings you can often see and change.

Zero-knowledge, and why 1Password's Secret Key is different#

Zero-knowledge (or end-to-end encrypted) means the company never holds your master password or your unencrypted vault, so even a server breach or a subpoena cannot expose your logins. Treat this as non-negotiable, and skip any service that can reset your master password and then show you your data, because that means it can read your data too.

1Password adds a second ingredient to the encryption itself: a 34-character Secret Key generated on your device and combined with your master password to derive the key. The practical benefit is that a stolen server-side vault is useless without that Secret Key, even if your master password is mediocre. The trade-off is that you must save the Secret Key — it lives in your Emergency Kit PDF — because if you lose both it and your password, no one, including 1Password, can recover the account.

The features that actually matter#

Ignore the marketing checklist and weigh these instead:

• Cross-platform autofill. It needs a browser extension for the browser you use (Chrome, Firefox, Safari, or Edge) and a working mobile autofill provider. On iOS you enable it under Settings > General > AutoFill & Passwords (it was Settings > Passwords > Password Options on iOS 17). On Android it is Settings > Passwords, passkeys & accounts, then pick your manager. If autofill is clumsy, you will quietly stop using the app within a week.
• Modern second factors. Look for TOTP support and, ideally, hardware-key (FIDO2/WebAuthn, such as a YubiKey) or passkey login for the vault itself. Avoid relying on SMS codes, which are exposed to SIM-swap attacks.
• Passkey storage. Passkeys are phishing-resistant logins built on FIDO2/WebAuthn that replace passwords entirely on supporting sites. Bitwarden, 1Password, Dashlane, and Proton Pass can now store and sync passkeys, which future-proofs your choice.
• Breach and health monitoring. A vault-health report that cross-checks your logins against the Have I Been Pwned database and flags reused or weak passwords turns a one-time setup into ongoing protection.
• A real recovery path. Emergency access (Bitwarden) or an Emergency Kit (1Password) so that a trusted person, or future you, is not permanently locked out.

What the good options actually cost#

Pricing shifts, so treat these as realistic ballparks and confirm on each site before you commit:

• Bitwarden is open source, independently audited, and has the standout free tier: unlimited passwords across unlimited devices with sync. Premium runs about $10 per year (adding vault health reports, encrypted attachments, and emergency access), and the Families plan is roughly $40 per year for six people.
• 1Password has no free tier but offers a 14-day trial; individual plans are around $36 per year and Families around $60 per year for five members. You are paying for polished apps and the Secret Key model.
• Proton Pass, from the Proton privacy ecosystem, has a genuinely usable free tier, with paid plans commonly in the $2 to $5 per month range.
• Apple Passwords / iCloud Keychain and Google Password Manager are free and built in. They are fine, and far better than reuse, but they work best inside a single ecosystem; mixing an iPhone with a Windows PC gets awkward fast.
• KeePassXC is free and fully local: your vault is a .kdbx file that you sync yourself. That means maximum control and no third-party server, but more manual effort and no built-in cloud sync.

The best manager is the one whose apps you find pleasant, because a tool you enjoy opening is a tool you will keep using.

Setting it up without locking yourself out#

1. Build the master password as a passphrase. Use four to six random, unrelated words (the EFF diceware method is ideal). Length beats symbols, because a long passphrase is both harder to crack and easier to recall than something like "P@ssw0rd!". Never reuse it anywhere else.
2. Save your recovery material offline. Write the master password, and for 1Password the Secret Key or full Emergency Kit, on paper and keep it somewhere physical and secure until it is memorized.
3. Turn on 2FA for the vault itself. Prefer an authenticator app or a hardware key over SMS.
4. Migrate the important accounts first. Do email and banking, changing each of those passwords to a fresh generated one as you go. There is no need to convert everything in one sitting; let the vault fill over a couple of weeks.

Common mistakes people make#

The biggest is storing the two-factor codes for your most critical accounts inside the same manager those codes are meant to protect. If that vault is ever compromised, both factors fall together, so keep at least your email and banking 2FA in a separate authenticator app. The second mistake is a weak master password guarding an otherwise bulletproof vault, since the encryption is only ever as strong as that one phrase. The third is having no recovery plan and no offline copy of the master password, which is exactly how people permanently lose access. And the last is fixating on "AES-256" in the marketing while ignoring the KDF and iteration settings that actually decide how a stolen vault holds up.

FAQ#

Are the browser-built-in password managers good enough?#

For someone who lives in one ecosystem, Apple Passwords or Google Password Manager are a real upgrade over reuse and cost nothing. Dedicated apps pull ahead when you mix platforms, such as an Android phone with a Mac, or when you want passkey handling, secure notes, and easy family sharing. Either is far safer than reusing a handful of passwords.

Is it safe to keep all my passwords in one place?#

Yes, provided the manager is zero-knowledge, you use a strong and unique master password, and you enable 2FA. A reputable vault is far safer than the realistic alternative, which is reusing the same few passwords everywhere. Password reuse, not password managers, is what causes most account takeovers.

What happens if I forget my master password?#

With a true zero-knowledge manager, the company cannot reset it or read your data, so a forgotten master password can mean a lost vault. This is precisely why you set up emergency access and keep an offline written copy before you ever need it. Do this on day one, not after something goes wrong.

Should I pay, or is a free manager fine?#

Bitwarden's free tier is genuinely sufficient for most people, and Proton Pass's is close behind. Pay when you want family sharing, integrated breach monitoring, priority support, or 1Password's Secret Key design. Free does not mean less secure; the paid tiers mostly add convenience and sharing.