A password manager can be excellent on your laptop and still be the wrong choice if it makes signing in on your phone a chore. That’s why a feature list is a poor place to start. List the devices and browsers you actually use, then test the manager where you’re most likely to need it: in a mobile app, on a new computer, and when you’ve forgotten how you signed in.
The security goal is straightforward: give every account a strong, unique password without having to remember them all. The harder decision is how you want those passwords stored, filled, shared, and recovered. A built-in manager may cover everything you need; a separate app may be worth it for a mixed-device household or more control over sharing. The right choice is the one you can use consistently.
Start with the devices, not the brand
Write down your operating systems, your main browser on each device, and any computer you use only occasionally. Then check three different capabilities: Can you open the vault there? Can it fill passwords in the browser? Can it fill them in apps? “Available on iPhone” doesn’t necessarily tell you how well a manager handles a particular banking app or how easily it saves a changed password.
Built-in tools deserve a serious look. Apple’s Passwords app manages passwords, passkeys, verification codes, and shared credentials across Apple devices. It isn’t confined to Macs and iPhones: with iCloud for Windows, iCloud Passwords can fill saved logins in Chrome, Edge, and Firefox on Windows. Google Password Manager can also be set as an autofill option on an iPhone. Those details matter more than a simple “Apple versus cross-platform” label.
A separate manager is worth testing if you regularly switch among Windows, Mac, Android, and iPhone, or use browsers outside one company’s ecosystem. If you prefer to keep the vault file under your own control, a local-database tool such as KeePassXC can store its encrypted database as a file you manage. That gives you more responsibility for backups and syncing. A cloud-synced vault is usually simpler for someone who wants a changed password to appear on their other devices without managing files.
Look past the word “encrypted”
A credible manager should explain when it encrypts your vault, who can decrypt it, and what protects the account if someone obtains a copy of the encrypted data. Look for end-to-end encryption: your device encrypts the vault before it’s stored with the provider, and the provider doesn’t have the keys needed to read its contents. For instance, Bitwarden describes encrypting vault data on the device before sending it to its servers, while 1Password explains how an account password and a separate Secret Key protect its data. Different designs can meet the same basic need; an impressive cipher name alone doesn’t tell you enough.
Check whether the provider publishes a security design, explains how it makes password guessing harder, and makes independent security assessments available. Bitwarden’s audit information is an example of the kind of material you can inspect. No audit guarantees that an app is free of flaws, but a clear, testable account of its security is more useful than an unsupported “military-grade” claim.
Your own setup remains part of the protection. Use a long, unique password or passphrase for the vault and enable multifactor authentication where the manager offers it. Keep the method for signing in to the vault accessible if you lose your phone—for example, by securely storing recovery codes or maintaining another approved sign-in method. NIST advises people using password managers to protect the master passphrase, use unique passwords, and enable multifactor authentication. Biometrics can make routine unlocking convenient, but don’t mistake a fingerprint prompt for a complete recovery plan.
Test autofill where it matters
Autofill is a security feature as well as a convenience: a manager that associates a saved login with the correct website can help you notice when a look-alike site doesn’t match. But matching rules and user controls differ. Bitwarden, for example, offers several website-matching options, while its browser extension lets users choose when to fill and keeps automatic filling on page load off by default. That’s a useful distinction to test: Does the manager merely suggest a matching login, or does it enter credentials as soon as a page loads?
Try a prospective manager with a few ordinary accounts before importing your entire vault. Create a new login on your phone, save it, open it on your computer, and change its password. Repeat with an app login, not just a website. Check that it offers the right account if you have both a personal and a work login for the same service. If you routinely copy passwords because filling fails, you may be less likely to use the manager everywhere.
Also ask whether it generates passwords that satisfy a site’s requirements and flags weak or reused ones. Those reports are helpful only if the tool makes it easy to replace the problem passwords. Start with your email account and other important logins rather than trying to fix every old account in one sitting.
Understand recovery before you need it
“Can I reset my password?” is too vague a question for an encrypted vault. Ask exactly what happens if you forget the vault password, lose a phone, or lose access to the email address used for the account. Can a trusted person help? Is there a recovery code? Does recovery restore your existing data, or only let you create a new, empty account?
The answers can differ substantially. If its other access options fail, Bitwarden says it cannot recover a personal account’s vault data. It offers an advance-planning option through which a designated contact can request emergency access, subject to a waiting period. With 1Password Families, members can generate recovery codes, and a family organizer can help another member recover an account; an organizer cannot recover their own account through that organizer role. These are different mechanisms, not a choice between security and convenience.
Set up the recovery method you choose immediately. Store any emergency kit or recovery code somewhere you can reach without the vault—such as a securely kept paper copy. Then think through one realistic failure: if your phone disappeared while you were traveling, what would you need to sign in on a replacement device? If the answer depends on a code saved only on that phone, the plan needs work.
Give each family member a private space
A family plan should not mean everyone shares one vault password. Look for individual accounts or private vaults, plus a separate place for credentials the household actually shares: perhaps a streaming service, home utility account, or school portal. Check who can invite members, who can edit a shared login, and what happens when someone leaves.
The options aren’t identical. Apple’s shared password groups let members add and update shared credentials, but participants need compatible Apple devices. 1Password Families separates private and shared vaults, while Bitwarden’s Families plan provides shared collections alongside individual vaults. For a household with mixed devices, test the shared account on every member’s phone before committing.
Sharing controls have a practical limit: someone who could view a password may have copied it. When a roommate, former partner, or other member should no longer access an account, removing them from the group may not be enough. Change that account’s password and review its signed-in devices.
Check passkeys, price, and the way out
If you’re beginning to use passkeys, confirm that the manager can save and use them on the devices you own. A passkey is a sign-in credential designed to resist phishing; passkeys can be managed by built-in tools or third-party password managers. Don’t assume that a manager’s password export will move its passkeys too. Check both its import and export instructions before making it your primary home for new credentials.
Price should follow your requirements, not lead them. Compare the full cost for the number of people who need accounts, then check which tier includes the features you’ll actually use—family sharing, emergency access, encrypted attachments, or advanced sign-in options. A free individual plan may be enough if you don’t need paid extras: Bitwarden’s free tier includes password storage and access across devices. Before paying for a family tier, make sure its sharing rules solve a problem your existing built-in tools don’t.
Finally, test how you would leave. An export may omit fields, attachments, or passkeys, and an unencrypted export needs careful handling. 1Password’s export instructions distinguish desktop password exports from passkey transfers on supported mobile apps. An Apple Passwords CSV export is unencrypted and has limits on which items it includes. If you make an unencrypted export, keep it off shared storage, import it promptly, and delete the file when you’re done.
The best short test is small and concrete: save three logins, fill them on every device you use, share one only if you need to, and work through the recovery instructions. Choose the manager that passes those tests with the least friction—not the one with the longest feature list.