Best Password Manager

A password manager stores all login credentials in an encrypted vault, protected by a single master password, and fills them in automatically on the relevant sites and apps. It solves a concrete problem: remembering dozens of distinct, sufficiently strong passwords is beyond most people’s memory, which is why so many end up reusing the same credential across several accounts. This guide covers how these tools work, the criteria that set the available solutions apart, and good habits for setting one up.

Comparing password management solutions

The main solutions on the market share the same principle (an encrypted vault and a single master password), but differ in their storage model, extra features and pricing. A comparison by user profile, in no particular order:

Each solution is worth trying against your own use case (number of devices, browsers used, need for sharing) before committing to a paid plan.

What is a password manager

Technically, the tool relies on an encrypted vault: each saved credential (site, username, password) is stored in a form that is unreadable without the decryption key, itself derived from the master password chosen by the user. This encryption happens locally, on the device, before any syncing to a remote server: the software provider therefore does not, in principle, know the content of the vault.

Beyond simple storage, most solutions offer:

• Autofill of credentials on login forms, via a browser extension or a mobile app; on smartphones, this feature integrates directly with the operating system (both iOS and Android provide a dedicated framework for third-party managers), which avoids retyping a long password on a touchscreen keyboard.
• A password generator that creates random passwords of adjustable length for each new account.
• Encrypted syncing across several devices (computer, smartphone, tablet).
• A security audit that flags weak or reused passwords, or ones already found in a known data breach, usually relying on a database of known breaches comparable to the public reference service “Have I Been Pwned,” which can be checked for free to see if an email address appears in a recorded breach.
• Support, in some recent solutions, for passkeys: a login method that replaces the password with a pair of cryptographic keys stored on the device and unlocked by fingerprint, face recognition or a local code. Adoption remains partial, as only some sites offer this option, and a traditional password manager is still needed for the rest.

Why use a manager rather than your memory

The problem these tools solve is not theoretical: France’s data protection authority (CNIL) adopted, through deliberation no. 2022-100 of 21 July 2022, a new recommendation on passwords, replacing the one from 2017. This recommendation now reasons in terms of entropy rather than imposed complexity rules, and encourages the use of a dedicated password manager to obtain a distinct, sufficiently strong credential for each service, rather than relying solely on memory.

For its part, France’s national cybersecurity agency (ANSSI) recommends, in its guide “Recommendations on multi-factor authentication and passwords” published on 8 October 2021, using a password vault as one of its main security recommendations, alongside multi-factor authentication.

A single password reused across several accounts exposes all of them as soon as one service suffers a data breach: credentials stolen from a poorly secured site can then be used to log in elsewhere, through a technique called “credential stuffing.” A distinct, randomly generated credential for each service removes this risk of spreading.

Criteria for choosing a password manager

Storage model and encryption

Two approaches coexist: storage in the provider’s cloud, automatically synced across devices, or fully local storage, which the user must back up and transfer themselves to access it on another device. The first option is more convenient day to day, the second gives more control over where the encrypted data resides.

Compatibility with the devices you use

Before choosing, it is worth checking that the tool offers an app for every system actually used (Windows, macOS, Linux, iOS, Android) as well as an extension for the main browser. A tool compatible with only one environment forces manual re-entry of credentials on other devices, which limits the benefit of automation.

Price and the free offer

Several solutions offer a functional free plan, sometimes limited to one device or a reduced number of stored credentials, alongside a paid plan that adds multi-device syncing, family sharing or priority support. The choice depends on the number of devices to cover and whether access needs to be shared with other people.

Family or business sharing

For a household or a small team, some solutions let you share a specific credential (a Wi-Fi code, a shared subscription) without ever revealing the password in clear text to the recipient, who can use it without being able to read it. This avoids sending a password by message, a practice best avoided since it leaves a plain-text trace of the shared secret. For a small business, the same principle centralises shared access (the company’s social media accounts, invoicing tools, website hosting) without every person needing to know the password in clear text: when a team member leaves, their access to the shared vault can simply be revoked, instead of manually changing every affected password one by one.

Browser-built-in manager or cloud-based solution

The most widely used browsers include a basic password manager, able to generate and remember credentials with no extra installation. This built-in option works for simple, single-browser use, but rarely covers every need: secure sharing between several people, detailed security auditing, access outside the browser, or storage of data other than login credentials (secure notes, payment card details). A dedicated app, installed independently of the browser, works regardless of the browser used day to day and stays accessible even after switching computer or default browser.

The choice between a solution hosted in the provider’s cloud and a fully local one mainly comes down to the trade-off between convenience and control over the data. A cloud solution automatically syncs the vault across every device signed into the same account, with no manual work from the user, at the cost of depending on the provider’s servers and security policy. A local solution keeps the encrypted file only on the chosen device, which removes that dependency, but requires the user to manage backup and transfer of the file themselves to access it from several devices.

Either way, the vault’s encryption relies on the same principle: without the master password, the content stays unreadable, even to the software provider in the case of a “zero-knowledge” cloud solution.

Setting up a password manager securely

Choosing a strong master password

The master password protects the entire vault: its strength determines the strength of every credential it contains. ANSSI recommends a long passphrase, made up of several words with no obvious link between them, rather than a short password packed with special characters that is hard to remember. This master password should never be reused elsewhere or shared with anyone.

Turning on two-factor authentication

Most managers let you protect access to the vault with a second factor (an authentication app, a physical security key) in addition to the master password. This extra layer blocks access to the vault even if the master password were to be discovered, and is ANSSI’s first recommendation on authentication.

Importing existing credentials gradually

Most tools offer an import feature from the browser or a file exported from another manager. Once the import is done, it is worth using the built-in security audit to spot weak or reused passwords, and replace them one by one with a randomly generated password, rather than leaving the old history unchanged. This migration happens gradually, account by account, at each login: there is no need to change everything in a single session to start seeing the benefit.

It is also worth setting up, right from installation, a recovery process in case the master password is forgotten: backup codes to print and keep somewhere safe, a trusted contact designated in advance, or a recovery key generated when the account is created. This step, often overlooked, prevents total loss of access to the vault if the master password is forgotten, and is worth doing before even storing the first credential.

Frequently asked questions

To secure your browsing more broadly, choosing a reliable VPN usefully rounds out the approach, as does a properly configured cloud service for sensitive documents. If you are unsure how to set these tools up, IT support at home lets you get help from a professional.