NeutralPickHow to choose the best password manager for you: what to check before you sign up
There is no single best password manager. The best one is the one whose security you can check, that works on every device you use, and that you can leave later without losing your passwords. This guide lists what to look up for each password manager you are considering, before you sign up, so you can compare them in the same way.
In this guide, a password manager is an app that stores your passwords in one protected place, fills them in for you, and creates new strong ones. You unlock it with one main password, often called the master password. Choose a long master password that you don't use anywhere else: even with strong encryption, someone who steals the company's copy of your encrypted data can try to guess a weak one.
Why the adverts and the review sites are not enough
Password manager adverts show the best result a product can reach. The detailed terms often say something different. For example:
- A free plan may only work on one type of device, or limit how many passwords you can store.
- "Military-grade encryption" says little on its own. What matters is who can read your passwords, and whether that has been checked by an independent company.
- Many review websites earn money when readers sign up through their links.
So check the same things for every password manager, using its own security and help pages, and check the plan you would actually pay for.
Before you look at any password manager
Write down your answers to these four points. They decide which checks in the list matter most to you.
- Your devices. Your phones, computers and tablets, their operating systems (the main software they run), and the web browsers you use.
- Who will use it. Just you, or family members who need to share some passwords.
- Where your passwords are now. Saved in a browser, in another password manager, in a file or on paper. Your browser or device may already include a password manager; if so, add it to your comparison as one of the options.
- What happens if you forget the master password. Whether you want a way to recover your account, or prefer that nobody, not even the company, can get in.
The checklist
The checks are in three groups. Must have means a problem here can put your accounts at risk or lock you out. Nice to have means it makes a real difference for many people. Optional means it only matters to some people. When you open the checklist in NeutralPick, you can move any check to a different group to match your answers above.
- Must have
- Only you can read your passwordsIs my data encrypted on my device so that the company itself cannot read my passwords, and is this explained on its security page?Often called "zero-knowledge" or end-to-end encryption. If the company can read your passwords, anyone who breaks into the company may be able to as well.
- Checked by independent security expertsHas an independent security company tested it recently, is the report summary published, and how did it handle past security problems?Anyone can claim to be secure. A recent independent test, and an honest account of past problems, are better signs.
- Works on all your devices and browsersDoes it work on every phone, computer and web browser I use, on the plan I would choose?Some free plans only work on one type of device. A password manager you can't use everywhere won't get used.
- You can take your passwords with youCan I export all my passwords, passkeys and notes in a standard file format at any time, including after I stop paying?This lets you move to another password manager later. Check what happens if a subscription ends. An exported file is unprotected: delete it once you have used it.
- Two-step login to protect your accountCan I protect my account with a second step, such as an authenticator app (an app that shows a changing code) or a security key, as well as the master password?A second step makes it much harder for someone who learns your master password to log in. It can't protect a copy of your data stolen from the company, so use a strong master password.
- Nice to have
- Imports your existing passwordsCan it import my passwords from my browser, another password manager or a file, without retyping them?Importing saves hours. Delete the old file afterwards, because it holds every password unprotected.
- A recovery plan you are comfortable withIf I forget my master password, what are my recovery options, and who could use them to get in?Easy recovery is convenient but can be a way in for others. No recovery is safer, but you lose everything if you forget.
- Safe sharing with familyCan I share chosen passwords with family members safely, and does the plan include the number of people I need?Only matters if you share accounts. Family plans differ in how many people they cover.
- Warnings about weak or leaked passwordsDoes it warn me about weak, reused or leaked passwords, and help me change them?Many people reuse passwords. A warning shows which accounts to fix first.
- Stores passkeysCan it store and use passkeys (a newer way to sign in without a password) on all my devices?More websites now offer passkeys. Storing them in your password manager lets you use them on every device.
- Optional
- Works without an internet connectionCan I see my passwords when my device has no internet connection?Useful when travelling or when the company's service is down.
- Emergency access for someone you trustCan I let a trusted person request access to my passwords in an emergency, after a waiting period I choose?Helps your family if something happens to you. Check how the waiting period works.
The button opens this checklist in NeutralPick. There you can:
- Remove the checks that don't matter to you, add your own, and move checks between groups.
- Add each password manager you are considering.
- For each password manager, fill in what you found on its website, its security and help pages, and its price page.
- See every password manager side by side.
Want to see what a finished comparison looks like first? See an example comparison with three made-up password managers.
Claims to look at carefully
Adverts and product pages often describe the points below in vague terms. When you see one, look for the specific information shown here. If you cannot find it, assume the answer is "no" or "only partly".
- "Military-grade" or "bank-level" encryption. Look for whether your data is encrypted on your device so the company cannot read it, and for a published independent test.
- "Free". Look for what the free plan leaves out: devices, number of passwords, sharing or recovery.
- "Never been hacked". Look for how the company describes past security problems. An honest explanation is a better sign than a claim that nothing ever happened.
- The price. Compare the yearly price of the plan you need, including family members, after any first-year discount ends.
What to do with what you found
- Put all the password managers side by side.
- Look at the Must have checks first. If one gets a No on one of your must-haves, remove it, however good the rest looks. Look closely at any Partial.
- Try the free plan or trial of the ones left on your own devices before you move all your passwords.
- After you move, turn on two-step login, write down your recovery details and keep them somewhere safe, and delete any old password files.
Why use NeutralPick to compare password managers
- The same checks for every password manager. You fill in the same checklist for each password manager you are considering, so you compare them in the same way.
- Everything in one table. You see every password manager side by side, check by check, instead of switching between shop pages and notes.
- Nobody can pay to influence it. There are no adverts, no paid placements and no "featured" products. No maker or shop can pay to be shown to you or placed higher.
- Free, with no account. You don't need to sign up or pay anything.