The best password managers, and the best free one

Most people reuse a few passwords everywhere. It's understandable, because nobody can remember fifty different ones. The trouble is that when one website leaks, attackers try that same email and password everywhere else. A password manager fixes this quietly, in the background.

What a password manager does

It's a secure vault for your logins. It creates a long, random password for each account, saves it, and fills it in for you on your phone and computer. You only remember one strong main password, plus a second sign-in step.

Your vault is encrypted on your own device before it's stored, so the company running the service can't read your passwords. Most password managers also warn you about weak, reused or leaked passwords, and store passkeys, the newer password-free way to sign in.

Best overall: 1Password

1Password is the one we recommend to most people and small businesses. It's polished, easy to learn and works smoothly on Mac, Windows, iPhone, Android and every major browser.

Extra protection by design. Your vault is locked with your main password and a Secret Key that only you hold. Even if someone stole the encrypted data, they would need both.
Watchtower. Flags weak, reused and leaked passwords, and sites where you could turn on two-step sign-in.
Easy sharing. Shared vaults for family or a team, so you never send a password by text or email again.
More than passwords. Passkeys, two-step codes, secure notes and important documents in one place.

1Password is paid only, with personal, family and business plans. Check their site for current pricing. For most small teams, it's worth it for how easy it makes doing the safe thing.

Best free: Bitwarden

If you'd rather not pay, Bitwarden is the clear choice. Its free plan includes unlimited passwords on unlimited devices, which most free plans don't.

Open and audited. Bitwarden is open source and regularly checked by independent security firms, so its claims can be verified.
Works everywhere. Apps for every major phone, computer and browser.
A cheap upgrade. Premium is inexpensive and adds built-in two-step codes and reports on leaked passwords.

It's a little less polished than 1Password, but it's secure, reliable and genuinely free.

Others worth knowing

Apple Passwords and Google Password Manager

Both are free and built in. If everyone in your household or team uses only Apple devices, or only Chrome and Android, they're a big step up from reusing passwords. They're harder to use across different platforms, and they have fewer sharing and business features.

Proton Pass

From the privacy-focused company behind Proton Mail. Open source, with a useful free plan and email aliases that keep your real address private when you sign up for things.

KeePassXC

Free, open source and fully offline. Your vault is a file you control and nothing syncs to the cloud. Great for technical users, but you're responsible for backups and syncing.

One to avoid: LastPass

LastPass had serious breaches in 2022, when attackers stole copies of customers' encrypted vaults. If you still use it, we suggest moving to one of the options above and changing your most important passwords.

Getting started in an afternoon

Pick one and install it on your phone, computer and browser.
Create a strong main password. A short sentence of four or five random words is easy to remember and hard to guess.
Turn on two-step sign-in for the password manager itself.
Start with what matters most: email, banking, and anything you use for work.
Let it replace weak or reused passwords as you log in to each site over the next few weeks.

That's it. You don't need to move everything in one day. Every account you update is one less door left open.