Password managers: the four things that actually matter
Feature comparison tables are mostly noise — every serious option encrypts your vault properly. The differences that will actually affect you are about what happens when something goes wrong.
Password manager comparisons tend to list forty features across a grid, which makes the decision look harder than it is. The encryption is not the differentiator: every credible option uses a zero-knowledge design where your vault is encrypted and decrypted on your device, and the provider cannot read it. Assume that as the baseline and ignore any product that doesn't meet it.
What varies, and what you'll care about eventually, is four things.
1. Recovery: what happens if you forget the master password
Zero-knowledge has an unavoidable consequence — if the provider can't read your vault, they usually can't restore access either. For a lot of people this is the failure mode that actually occurs, and it's worth understanding before you're in it rather than during.
Options differ:
- Recovery key or kit. A long code generated at setup that can restore access. It works, and it only works if you actually saved it somewhere durable. Print it.
- Emergency access. You nominate a trusted contact who can request access, with a waiting period during which you can decline. Good for the scenario nobody plans for.
- Biometric or device-based recovery. Some managers let an already-authenticated device authorise a reset.
- Nothing. Some offer no recovery path at all. Defensible, but know it going in.
Whatever the mechanism, set it up on day one. Recovery configured after you've forgotten the password is not a thing.
2. Export: can you get your data out
This is the question that separates a tool from a trap, and it's the one least likely to appear in marketing.
Check that the manager offers a full export in a standard format — usually CSV, sometimes encrypted JSON — covering not just passwords but notes, custom fields, TOTP seeds and attachments. Then actually run it once, early, while you have twelve entries rather than four hundred. You'll find out quickly whether the export is complete or whether it quietly drops your two-factor seeds.
A manager with a clean export is one you can leave. A manager without one has you by the vault.
Handle exports carefully. A CSV export is plain text — every password readable. Export to local storage, never to a cloud-synced folder, import it where it's going, then delete it securely and empty the trash. Don't leave one in Downloads.
3. Platform coverage and autofill quality
The best-designed manager is useless if autofill fails on the sites you use, because you'll route around it and start reusing passwords again. Coverage means every platform you personally use — each browser, desktop OS, and phone OS — not a long list in general.
Autofill quality varies more than you'd expect between products, particularly on:
- Multi-page logins that ask for the username first
- Banking sites asking for specific characters from a memorable word
- Native mobile apps rather than websites
- Sites with several saved accounts
This is untestable from a review. Use the free tier or trial with your own ten most-visited sites for a week before committing.
4. Track record and how they behave when it goes wrong
Security products get attacked; that's the job. The signal isn't whether a company has had an incident, it's how they handled it — how fast they disclosed, how specific they were about what was and wasn't affected, and whether the account of it changed repeatedly afterwards.
Look for regular independent security audits published in full, a clear public incident history, and documentation of the actual cryptography rather than marketing adjectives. Search the provider's name alongside "breach" and "incident" and read what happened, including the follow-up months later.
Things that matter less than they appear
Password strength reports. Pleasant, not decisive. Every manager has some version.
Built-in VPN, dark web monitoring, storage. Bundled extras that rarely beat a dedicated tool and complicate the pricing.
Local-only versus cloud sync. A real preference, not a security ranking. Local-only removes the provider from the picture and hands you the backup problem; cloud sync is the reverse trade. Both are defensible.
Passkeys, briefly
Passkeys replace passwords with a key pair — the site stores a public key, your device holds the private one, and you authenticate with a biometric or PIN. There's nothing to phish, because there's no shared secret to hand over.
Adoption is uneven, so you'll be running both models for years. When choosing a manager, check that it stores passkeys and can sync them across your devices, or you'll end up with credentials stranded on one phone.
A workable process
- Shortlist two or three that support all your platforms, publish audits, and offer a documented full export.
- Trial one for a week with your real daily sites. Judge it on autofill, not features.
- On day one: set a strong, memorable master password, enable two-factor on the manager account, and save the recovery key somewhere physical.
- Run a test export in week one and confirm it's complete.
- Change passwords gradually — most important accounts first, email before anything else, because email is how every other password gets reset.
The manager you'll actually use every day beats the one that scores better on a grid. Pick on recovery, export and autofill; the rest is close enough not to matter.