Password managers are universally recommended by security professionals. They are also widely not used by the general public. The gap exists because the onboarding feels risky — what if you lose access? This guide addresses the real concerns honestly.
The Core Security Case
The average person has 100+ online accounts. A person who reuses passwords (the majority) needs only one of those services to be breached for all accounts to be at risk. Password managers solve this by making unique, random, high-entropy passwords practical — you only memorise the master password.
Types of Password Manager
Cloud-based (Bitwarden, 1Password, Dashlane): passwords encrypted and synced across devices. Most convenient. Security depends on the provider's encryption implementation. Local (KeePass, KeePassXC): passwords stored only on your device. Maximum privacy but no automatic sync. Browser-built-in (Chrome, Safari, Firefox): convenient but tied to one browser ecosystem and generally weaker security model.
Before using any password manager, generate strong unique master passwords with the Password Generator. Use maximum length (24+ characters) with all character types for the master password — it is the only one you need to remember.
The Getting Started Reality
You do not need to change all your passwords on day one. Install a password manager, start saving passwords as you naturally log into sites over the following weeks. As you encounter each site, generate and save a new strong password. Within a month, your most-used accounts are secured without an overwhelming single session.
Choosing and Setting Up a Password Manager
The choice between password managers comes down to three dimensions: cross-device sync capability, local vs cloud storage, and cost. Cloud-synced managers (Bitwarden, 1Password, Dashlane) sync your vault across all devices automatically — a password saved on your laptop is available on your phone within seconds. Local managers (KeePassXC, KeePass) store your vault as a local file that you control entirely, with no cloud component. The security tradeoff is straightforward: cloud managers trade some theoretical security risk for significantly better usability; local managers provide maximum control but require manual sync between devices.
Bitwarden is the most recommended option for most users in 2026: it is open-source (the code is publicly auditable), has a genuinely functional free tier with no limits on passwords or devices, offers optional cloud sync through Bitwarden's servers or self-hosting, and has been independently audited. 1Password is the preferred choice for teams and families because of its superior sharing and access control features, though it has no free tier. Browser-built-in password managers (Chrome, Safari, Firefox) are acceptable for single-device users but lack the cross-browser and cross-device capability that makes a dedicated manager essential.
The Password Manager Landscape in 2026
The major password manager options have consolidated around a few clear leaders, each with distinct strengths. Bitwarden remains the top recommendation for most users: open-source (publicly auditable code), independently audited, completely free for individual use with no meaningful limitations, and cross-platform across all browsers, iOS, Android, Windows, macOS, and Linux. The open-source nature means security researchers worldwide can and do scrutinise the code — any backdoor or data collection would be discovered.
1Password has evolved into the leading option for teams and businesses, with strong sharing features, fine-grained access control, and the Watchtower feature that monitors for weak, reused, or breached passwords across the vault. Its Travel Mode — hiding designated vaults when crossing international borders where device inspection might occur — addresses a specific security concern for business travellers. The £3-5/month per person cost is justified for professional use where shared vault management and audit trails are needed.
Migration: Switching Password Managers
Migrating from one password manager to another, from browser-saved passwords to a dedicated manager, or from no manager to one is a one-time investment that most users overestimate in difficulty. All major password managers export to CSV format. Most accept CSV imports with field mapping. The migration process: export all passwords from the current system, import into the new manager, verify a sample of critical accounts imported correctly, then purge the old system.
The trickier migration challenge is identifying all accounts stored in the current system. Most users discover, during migration, that they have 200-400 active accounts — significantly more than they consciously remembered. This is an opportunity to audit: delete accounts for services no longer used, remove duplicate entries, identify accounts with weak or reused passwords for immediate remediation. A post-migration password audit typically reduces the list from 300 messy entries to 200 clean, unique ones while strengthening security across the board.
Securing the Password Manager Itself
The master password is the single most important password in the system — it protects all other passwords. Three properties are essential: it must be unique (not used anywhere else), strong (sufficient entropy to resist attack), and memorable (not written down or stored electronically). A 6-word Diceware passphrase (randomly selected words from a curated wordlist using physical dice) satisfies all three: it has approximately 77 bits of entropy — impractically strong for brute force — while being substantially more memorable than a random character string of equivalent strength.
Multi-factor authentication on the password manager account is mandatory. All major managers support TOTP authenticator apps. Bitwarden also supports hardware security keys via FIDO2/WebAuthn. Losing access to the MFA method while locked out of the password manager creates a serious account recovery challenge — maintain recovery codes (provided by the MFA service) in a physically secure location (a safe, a safety deposit box) separate from any electronic device.
Password Manager for Business Teams
Team password managers solve problems that individual managers cannot: credential sharing across team members without exposing the underlying password, access revocation when team members leave, audit logs of who accessed which credentials and when, and credential organisation by role and project. Without a team password manager, shared credentials are typically stored in Slack messages, shared spreadsheets, or email threads — all insecure, all unauditable, and all at risk when any team member's device or account is compromised.
The security incident that most clearly demonstrates team password manager value: an employee with access to 50 shared credentials leaves the company. Without a password manager, rotating all 50 credentials requires identifying each one, which service it belongs to, and who needs the new credential. With a password manager, the departing employee's access is revoked instantly with a single action, all shared credentials remain secure, and the IT team receives a complete list of credentials the former employee had access to for the rotation prioritisation decision.
Generate strong unique passwords for every account with the Password Generator. Use alongside your password manager for cryptographically secure credentials. Free, nothing stored.