You might’ve seen password managers in the news recently because of the breach affecting LastPass customers. We need to trust that all of our logins, banking credentials and other sensitive information has been neatly locked away, only accessible by us when we need it. But most tech is fallible, and the benefits of unique, strong passwords across your online presence outweigh the risks. Password managers remain a great way to securely store all of the credentials you need on a regular basis. We tested out nine of the best password managers available now to help you choose the right one for your needs.
How do password managers work?
Think of password managers like virtual safe deposit boxes. They hold your valuables, in this case usually online credentials, in a section of the vault only accessible to you by security key or a master password. Most of these services have autofill features that make it convenient to log in to any site without needing to remember every password you have, and they keep your credit card information close for impulse purchases.
But given that passwords are one of the top ways to keep your online identity secure, the real value of password managers is staying safe online. “It’s just not possible without a password manager to have unique, long and hard-to-guess passwords,” Florian Schaub, an associate professor of information and of electrical engineering and computer science at the University of Michigan, said.
Common guidance states that passwords should be unique, with the longest number of characters allowed and uppercase letters, lowercase letters, numbers and special characters. This is the exact opposite of using the same password everywhere, with minor variations depending on a site’s requirements. Think of how many sites you have credentials on — it’s an impossible task to remember it all without somewhere to store them safely (no, a sticky note on your desk won’t cut it). Password managers are more readily accessible and offer the benefit of filling in those long passwords for you.
It seems counterintuitive to store all your sensitive information in one place. One hack could mean you lose it all to an attacker and struggle for months or even years to rebuild your online presence, not to mention you may have to cancel credit cards and other accounts. But most experts in the field agree that password managers are a generally secure and safe way to keep track of your data, and the benefits of strong, complex passwords outweigh the possible risks.
The mechanics of keeping those passwords safe differs slightly from provider to provider. Generally, you have a lengthy, complex “master password” that safeguards the rest of your information. In some cases, you might also get a “security key” to enter when you log in to new devices. This is a random string of letters, numbers and symbols that the company will send you at sign up. Only you know this key, and because it’s stored locally on your device or printed out on paper, it’s harder for hackers to find.
These multiple layers of security make it difficult for an attacker to get into your vault even if your password manager provider experiences a breach. But the company should also follow a few security basics. A “zero-knowledge” policy means that the company keeps none of your data on file, so in the event of an attack, there’s nothing for hackers to find. Regular pentests and security audits keep the company up to par on best practices, and other efforts like bug bounty programs or hosting on an open source website encourage constant vigilance for security flaws. Most password managers now also offer some level of encryption falling under the Advanced Encryption Standard (AES). AES 256-bit is the strongest, because there are the most number of possible combinations, but AES 128-bit or 192-bit are still good.
Who are password managers for?
Given their universal benefit, pretty much everyone could use a password manager. They’re not just for the tech-savvy people or businesses anymore because so much sensitive information ends up online behind passwords, from our bank accounts to our Netflix watch history.
That’s the other perk of password managers: safe password sharing. Families, friends or roommates can use them to safely access joint accounts. Texting a password to someone isn’t secure, and you can help your family break the habit by starting to use one yourself, Lisa Plaggemier, executive director at National Cyber Security Alliance, said. Streaming is the obvious use case, but consider the shared bills, file storage and other sites you share access with the people around you as well.
Are password managers worth it?
You likely already use a password manager, even if you wouldn’t think to call it that. Most phones and web browsers include a log of saved credentials on the device, like the “passwords” keychain in the settings of an iPhone. That means you’ve probably seen the benefits of not having to memorize passwords or even type them out already.
While that’s a great way in, the downfall of these built-in options are that they tend to be device specific. If you rely on an Apple password manager, for example, that works if you’re totally in the Apple ecosystem — but you become limited once you get an Android tablet, Lujo Bauer, professor of electrical and computer engineering, and of computer science, at Carnegie Mellon University, said. If you use different devices for work and personal use and want a secure way to share passwords with others, or just don’t want to be tied to one brand forever, a third-party password manager is usually worth it.
How we tested
We tested password managers by downloading each of the nine contenders on iPhone, Android, Safari, Chrome and Firefox. That helped us better understand what platforms each manager was available on, and see how support differs across operating systems and browsers.
As we got set up with each, we took note of how they iterated on the basic features of autofill and password generators. Nearly all password managers have these features, but some place limits on how much you can store while others give more control over creating easy-to-type yet complex passwords. From there, we looked at extra features like data-breach monitoring to understand which managers offered the most for your money.
Finally, we reviewed publicly available information about security specs for each. This includes LastPass, which more experts are shying away from recommending after the recent breach. For the sake of this review, we’ve decided not to recommend LastPass at this time as fallout from the breach still comes to light (The company disclosed a second incident earlier this year where an unauthorized attack accessed the company’s cloud storage, including sensitive data).
Password managers we tested
Best password manager: 1Password
Many security experts trust 1Password with their private information and, after testing it out, it’s clear why. The service includes industry standard encryption, a “secret key” that only you know on top of your master password, a zero-knowledge policy that means it keeps no data, and other security features like frequent audits and a bug bounty program.
Plus, it has a pretty intuitive feel. A tutorial at download helps you import passwords from other managers onto 1Password so that you don’t feel like you’re starting over from scratch. It also clearly rates the strength of each password and has an “open and fill” option in the vault so that you can get into your desired site even more quickly. We also liked the option to scan a set up code to easily connect your account to your mobile devices without too much tedious typing.
At $3 per month, the individual subscription comes with unlimited passwords, items and one gigabyte of document storage for your vault. It also lets you share passwords, credit card information and other saved credentials. If you upgrade to the family plan for $5 each month, you’ll get to invite up to five people (plus more for $1 each per month) to be a part of the vault.
-
Number of tiers: 4
-
Pricing: $3/month for Individual, $5/month for Families, $20/month for Teams Starter Pack, $8/month per user for Business
Best free password manager: Bitwarden
Bitwarden’s free plan includes unlimited passwords on an unlimited number of devices, which is more than we’ve seen from some of its competitors. There are drawbacks like you can only share vault items with one other user, but we think that’s a fair tradeoff.
Bitwarden is based on open-source code, meaning anyone on GitHub can audit it, which is a good measure of security. On a personal level, it includes security audits of your information, like a data breach report, that can keep you in the know about when your passwords have been leaked and when it’s time to change them. Plus, it’s widely available across the platforms we tested with a level of customization, options to access your vault and more.
Bitwarden may be the best free password manager, but it does have a paid version and we do think it’s worth it. At $10 annually for individuals or $40 for families, you unlock encrypted file storage, emergency access, unlimited sharing and more. But the free version comes with the basics that can get anyone set up on password management easily.
-
Number of tiers: 3
-
Pricing: Free, $3/month per user for Teams Organization, $5/month per user for Enterprise Organization
Best cross-platform availability: NordPass
Across password managers we tested, cross-platform availability was relatively similar. Most are widely available across web browsers and different operating systems, including our other top picks on this list. But we wanted to give a nod to NordPass here because of how easy the service makes it to access your vault from any platform.
NordPass has a free option with unlimited passwords and syncs across devices. A $2-per-month premium subscription keeps you logged in when switching devices, comes with security notifications and allows for item sharing. A family subscription comes with six premium accounts and only costs $4 per month. This makes it a pretty good budget option as well. Besides the pairing code to connect accounts, NordPass is a pretty standard password manager. Scanning a code gets me from my laptop to mobile device to work computer super easily. If you’re constantly switching devices and those extra few seconds save your sanity, it’s worth considering.
Best for shared access: Dashlane
Dashlane has four subscription options: A free user gets access to one device with unlimited passwords; an advanced user pays $3 per month to get upgraded to unlimited devices and dark web monitoring; for $5 per month, a premium user also gets VPN access and an $7.49-per-month family plan includes access for up to 10 people.
It met all the criteria we looked for, but with a clear emphasis on sharing credentials. Dashlane highlights “secure sharing” starting at its free level, which is a feature that some competitors keep behind a paywall. Access for up to 10 members in a family plan is one of the bigger plans we’ve seen as well. While we were testing it, password sharing seemed front of mind with a tab dedicated to it in Dashlane’s browser extension. Arguably the biggest caveat here, though, is lack of Linux support.
-
Number of tiers: 4
-
Pricing: Free, $3/month for Advanced, $5/month for Premium, $7/month for Friends and Family
This story originally appeared on Engadget
