ES EN

PasswordSecure.org

Password managers: how to choose one

How they work under the hood, what to check, and how to get started.

Published Who we are

A password manager resolves the underlying contradiction: to be safe you need a different, long password on every site, and that is impossible to memorise. The manager remembers them so that you only have to remember one.

The objection is always the same, and it is a fair one: isn't putting all your eggs in one basket worse? The short answer is that the real alternative is not eggs spread across baskets, it is the same egg in every basket. Here is the long one.

How it works under the hood

Everything rests on an idea called zero-knowledge encryption. Your master password is never sent to the manager's server: it is used on your device to derive an encryption key, and the only thing that leaves for the cloud is an already-encrypted block the provider cannot read.

That has two consequences worth understanding properly:

  • If the provider is breached, attackers walk away with encrypted data. With a long, unique master password that material is useless in practice. With a short or reused master password, it is not.
  • If you forget the master password, nobody can recover it. There is no "forgot my password" flow, because the provider does not have it either. That is why they all hand you a recovery key or kit when you sign up: keep it outside the manager itself.

Cloud or local

Cloud-syncing managers (Bitwarden, 1Password, Proton Pass) keep your encrypted vault on their servers and mirror it across your devices. It is by far the most convenient option, and for most people the right one.

Local managers (KeePassXC and compatible apps) keep an encrypted file that you look after yourself: on your disk, in your own cloud, or on a USB stick. You get complete control and no third-party dependency, in exchange for handling backups and syncing.

Neither option is "the good one". The useful question is whether you would rather delegate the infrastructure or run it.

What to look for

  1. It must work on all your devices. A manager that does not run on your phone is one you will not use, and a manager you do not use protects nothing.
  2. Independent audits and open source. Neither guarantees there are no flaws, but both mean outsiders have been able to look. Serious projects publish the reports.
  3. You must be able to export your data. It is your safety net against a pricing change or a shutdown. Check it before you put 300 passwords in, not after.
  4. Two-factor authentication on the manager's own account. Non-negotiable: turn it on the day you sign up.
  5. It has to feel comfortable. Autofill, search and the browser extension decide whether you are still using it in three weeks or back to the notebook.

Well-established options, with no interest on our part in which one you pick: Bitwarden (open source, a genuinely usable free tier), 1Password (paid, very polished, good family support), Proton Pass (built into the Proton ecosystem) and KeePassXC (local, free, for anyone who wants full control).

What about the browser's one?

It is a legitimate option and vastly better than reusing passwords, with specific limitations we go through in is it safe to save passwords in your browser?. In short: if you currently repeat the same password everywhere, starting with the browser's manager is an enormous, immediate improvement.

How to start without drowning

The classic mistake is trying to migrate 200 accounts in one afternoon, getting bored at number thirty and giving up. A plan that actually gets finished:

  1. Pick one and install it on your computer and your phone the same day.
  2. Create the master password as a long passphrase: it is the only one you will genuinely memorise.
  3. Save the recovery key on paper, away from the computer.
  4. Import whatever the browser already has, then delete it there so you do not end up with two copies drifting apart.
  5. Change the five critical accounts first: email, bank, and anything holding payment details. Generate each new password at random.
  6. Let the rest migrate on its own. Every time you sign in somewhere, change that password and save it. In a month it is done without ever setting an afternoon aside.

First, see where you stand

If you want a quick picture of the situation, run your current passwords through the checker: it tells you which are weak and which appear in known breaches. And if any comes back flagged, here are the steps to fix it in the right order.

Sources