How Do You Choose a Password Manager?
The short answer: the best password manager for you is one that works on every device you use, encrypts your passwords on your own device (look for "zero knowledge"), lets you export your data, offers emergency or family access, and has been independently audited. For most families, a paid plan at a few pounds a month is worth it. NordPass is the one I use myself.
Every week someone tells me they know they should be using a password manager, and then asks me which one to get. It is a fair question, and it is usually where people stall. There are dozens of them, the marketing all sounds the same, and a lot of the "best password manager" lists online are written by people paid per click rather than people who have set these things up for real families. So rather than hand you a ranked list, I want to show you how I actually decide. Once you understand the criteria, you can choose the right one for your life and stop worrying that you have picked wrong.
Start With How You Actually Live Online
Before looking at a single product, I ask people three questions. How many devices do you use in a normal week? Does anyone else need access to some of your logins? And what happens to your accounts if something happens to you?
The answers change the recommendation completely. A retired gentleman who uses one iPad and nothing else needs something very different from a couple juggling two phones, a shared laptop, a work machine and a teenager who keeps borrowing the tablet. If you and your partner both need the electricity account login, sharing matters more than any feature on the box. If you are the only person who knows how to get into the family email, emergency access matters more than price.
Write your answers down before you start comparing. Most people end up with the wrong tool because they compared features before anyone asked them about their own situation.
The Five Things I Check Before Anything Else
When I look at a password manager, I check the same five things every time.
First, does it work everywhere you are? If it does not have a proper app on your phone and an extension in the browser you actually use, you will stop using it within a fortnight. Convenience is not a luxury here, it is the whole point.
Second, is the encryption done on your device rather than on their servers? The phrase to look for is zero knowledge. It means the company cannot read your passwords even if they wanted to, and it means a breach of their systems does not hand a criminal your bank login.
Third, can you get your data back out? Any manager worth using lets you export everything to a plain file. If a company makes leaving difficult, that tells you something about how they see you.
Fourth, is there proper emergency or family access? This is the feature people never think about and always end up needing. Being able to nominate someone who can reach your accounts after a set delay has saved more than one family I have worked with a great deal of grief.
Fifth, has the company been independently audited, and did they say anything when they had a problem? Every large provider will eventually have an incident. What matters is whether they published it quickly and in plain English. I have looked closely at NordPass on this front and it holds up well, which is why it sits in my toolkit rather than a dozen alternatives.
What I Ignore in the Marketing
Plenty of what gets shouted about on pricing pages makes no practical difference to an ordinary household.
Military grade encryption is a phrase with no technical meaning. Almost everything reputable uses the same underlying standard, so it tells you nothing about which product is better.
Unlimited password storage sounds generous until you realise nobody has ever hit a sensible limit. The average person I sit down with has somewhere between eighty and two hundred logins.
Dark web monitoring is the one I get asked about most. It is a nice extra, not a reason to choose. Being told your email turned up in a breach is only useful if you then change the password, and a good manager helps you do that whether or not it sent you the alert.
Bundled VPNs thrown into a password subscription are usually the weakest version of that company's product. If you want a VPN, choose one on its own merits. That is why I point people to NordVPN separately rather than treating it as a freebie.
Free, Paid, or the One Built Into Your Browser
The managers built into Chrome, Safari and Edge have improved enormously, and if the honest choice is between using one of those and carrying on with the same password everywhere, use the browser one today. It is a genuine improvement over what most people are doing.
The catch is that they tie you to one ecosystem. Move from an iPhone to an Android handset, or use Chrome at home and Edge at work, and things get awkward fast. They also tend to have thin sharing and recovery options, which brings us back to those questions at the start.
Free standalone plans are a reasonable middle step, but read what is limited. Some cap the number of devices, which quietly defeats the purpose. Paid plans usually run somewhere between two and four pounds a month, and family plans covering five or six people often cost barely more than a single licence. If more than one person in the house needs this, the family plan is almost always the better value.
Zero-Knowledge Encryption Isn't Optional
This is the one I check first and the one I won't compromise on at all. A proper password manager encrypts your data on your own device before it ever reaches the company's servers, using a master password only you know, which means even the company running the service can't read your stored passwords if they wanted to. That's what "zero-knowledge" actually means in practice, not just a marketing phrase on a features page. If a provider can reset your master password for you, or their support team can technically view your vault contents, that's a structural weakness, not a convenience feature. I ask this question directly when I'm evaluating anything new, because everything else on this list matters a lot less if the underlying architecture doesn't hold up.
Password Manager Questions I Get Asked
Are password managers safe?
A reputable one is far safer than reusing passwords or keeping them in a notebook. With zero-knowledge encryption, a strong master password and two-factor authentication on the vault, your passwords are protected even if the company itself is attacked.
What happens if my password manager gets hacked?
With a zero-knowledge manager, what's stored on their servers is scrambled, and it can't be unlocked without your master password. That's exactly why your master password needs to be long and used nowhere else.
What if I forget my master password?
Most password managers can't recover it for you, because they never see it. Set up the recovery options and emergency access on day one, while you still remember everything.
Is the password manager built into my phone or browser good enough?
It's a big improvement on reusing passwords, so use it if that's the choice. The downside is that it ties you to one company's devices and usually has weaker sharing and recovery options.
Can I share passwords safely with my family?
Yes. Family plans let you share specific logins, like the electricity account or the streaming service, without handing over everything else. It's much safer than texting passwords to each other.
How to Move In Without Losing a Weekend
The biggest reason people abandon this is that they try to fix all two hundred logins in one sitting, get halfway, and give up.
Do it the slow way instead. Install the manager and set a long master password you can actually remember. A short phrase of three or four unrelated words beats a jumble of symbols, and the National Cyber Security Centre has said as much for years. Turn on two factor authentication for the manager itself before you put anything in it, because that vault is now the most valuable thing you own online.
Then change nothing. Just let it save logins as you use them over the next month. Once it has captured your regular accounts, sit down for twenty minutes and update the important handful properly: email first, then banking, then anything holding a saved card. Email comes first because whoever controls your inbox can reset everything else.
That is the whole method. Answer the three questions, check the five things, ignore the noise, and move in gradually. If you would rather talk it through with someone before you commit to anything, get in touch and I will happily walk you through it.
If you want the full picture on spotting the scams that go after your accounts, grab my free Safety Checklist and I'll send you a short email series with the rest. If you'd rather have it all in one place, my book Spot the Scam: A Plain English Guide to the Ten Cons Trying to Catch You Out is on Amazon.
Affiliate disclosure: some links on this page, including NordPass and NordVPN, are affiliate links. If you buy through them I may earn a commission at no extra cost to you. I only recommend tools I'd use myself.
I also share printable checklists and quick safety tips as pins, so follow me on Pinterest too.
Keep reading
This guide is part of Kells Security Solutions, where I explain online safety in plain English. Next, have a look at how to build a password worth trusting or how to choose a VPN service. If something has already gone wrong, here is where to report a scam in the UK.