How to Choose a Password Manager: The Decisions That Actually Matter

Four decisions, not a feature matrix

Every mainstream manager has autofill, cross-platform apps, breach alerts, and secure sharing. Feature-matrix comparisons flatten real differences. What actually differs is the plumbing: who holds the keys, who has independently audited the implementation, how much the free tier covers, and what happens when things go wrong.

Four questions to answer before you compare prices: does the free tier do everything I actually need; do I want cloud sync or a local file I control; is the zero-knowledge claim backed by a recent third-party audit; and if I forget my master password or the company shuts down, how do I get my data out? This guide walks each in turn, using products from our best password manager rankings as examples.

Is the free tier actually enough for you?

Bitwarden's Premium price jumped from $10 to $19.80 a year in January 2026, a 98% increase, per SafePasswordGenerator's pricing summary. The Families tier moved from $40 to $47.88 a year for up to six people. The free tier itself was unchanged: unlimited passwords on unlimited devices. What stays behind the paywall is what it always has been at Bitwarden: the built-in TOTP generator, encrypted file attachments, emergency access, and 1 GB of encrypted file storage.

Proton Pass's free tier is currently the most generous for individuals: unlimited logins, unlimited devices, passkeys, a password generator, two vaults, and 10 hide-my-email aliases, per Cyber Insider's review. You lose the built-in authenticator, file attachments, dark web monitoring, and unlimited aliases if you stay on Free. Proton Pass is the one to beat for free-tier value in 2026.

Zoho Vault offers a free tier for individuals with unlimited passwords, though its business plans dominate its marketing. 1Password does not offer a free tier at all; you start on a paid annual subscription or not at all.

Pay when you need integrated TOTP so you can stop juggling an authenticator app, encrypted file attachments for passport scans or software license keys, emergency access so a family member can inherit your vault, or SSO and advanced admin controls for a team. If you only need password storage on a couple of devices, free is enough.

Cloud sync or a local file: which should you pick?

Cloud managers keep an encrypted copy of your vault on vendor servers and sync it to each device. Local managers, most notably KeePass and its fork KeePassXC, keep the vault as a .kdbx file on your own disk. Cloud is easier; local removes the vendor from the trust chain entirely.

KeePass's upsides are real, per Cybernews: the database never touches a third-party server by default, the source is public, and you hold all the keys. The downsides are also real: no automatic sync, no built-in sharing, no managed recovery, and a steeper learning curve. If your partner or coworkers need access, local-only is a hard sell.

A middle path is KeePassXC paired with your own sync target: Syncthing between devices, iCloud or Nextcloud for file-level sync, a USB drive for cold backup. You get local control with multi-device access, but you take on backups and conflict resolution yourself. For most people, a cloud manager with a properly audited zero-knowledge implementation is the right tradeoff. The attacker who steals the vendor's database still has to brute-force your master password to decrypt anything.

Zero-knowledge is only as good as the audit

Every major manager claims zero-knowledge encryption. The claim means the vendor cannot decrypt your vault, because your master password never leaves your device in a usable form. Bitwarden's whitepaper is a readable explanation: the master password runs through a key derivation function on your device, and only encrypted blobs travel to the server.

The architecture is standard. The question is whether the implementation matches the architecture. That is what third-party audits are for. Bitwarden publishes audit reports from the Berlin firm Cure53 across the web app, desktop app, browser extensions, core library, and network security, with additional 2024 and 2025 assessments from IOActive, Mandiant, Fracture Labs, Unit 42, and ETH Zurich's Applied Cryptography Group, per Bitwarden's compliance page.

1Password publishes a comparable program through its Trust Center. Cure53 and Independent Security Evaluators have both tested its clients and infrastructure, and the company maintains SOC 2 Type 2 attestation. Detailed penetration test reports now require an NDA to access, which is worth knowing if you want to read them before buying.

A concrete test for any manager you are evaluating: can you find a penetration test or source code audit from the last 18 months, by a named firm, with findings and remediation? If the vendor points only to encryption algorithm names (AES-256, PBKDF2) and the phrase zero-knowledge in marketing copy, that is not evidence. Open source is a second signal, not a replacement: Bitwarden and KeePassXC publish their code, and closed-source managers like 1Password and Dashlane rely on third-party auditors doing that reading on your behalf.

What happens if you forget your master password

Real zero-knowledge means no reset. The vendor cannot see your master password and cannot help you if you lose it. Different managers handle this very differently, and the differences matter more than most buyers realize.

1Password gives every user a Secret Key at signup, printed on an Emergency Kit PDF alongside the account password. The Secret Key is a 34-character string combined with your master password to derive the final encryption key. If you forget the master password, a family or team admin can initiate recovery using the Secret Key, or you can use a recovery code you set up in advance.

Bitwarden does not use a secret key. If you forget the master password and have no recovery path set up, you lose the vault, per Bitwarden's own documentation. The escape hatches Bitwarden lists are: a device-based login or passkey login on a device already authorized, a trusted contact under Premium Emergency Access, or an administrator reset on an organization plan. An emailed password hint is not a reset.

Practical rule: before you save your first login, set up whatever recovery flow your manager offers. Print the 1Password Emergency Kit and store it somewhere physical, not inside the vault it would unlock. Register a passkey or authorized device for Bitwarden. Name an emergency contact.

What happens if the vendor is breached or shuts down

This is the scenario most buyers skip and later regret. In August and November 2022, LastPass disclosed two linked incidents in which attackers pulled a cloud backup containing encrypted customer vaults. The encrypted contents (passwords, secure notes) stayed encrypted, so users with long, random master passwords and high iteration counts were mostly protected. The unencrypted parts, per BleepingComputer, included site URLs, file paths, and certain email addresses; Wikipedia adds names, billing addresses, and partial credit card numbers to that list.

The downstream damage is measurable. The Hacker News reported in late 2025 that TRM Labs tied roughly $35 million in subsequent cryptocurrency theft to the stolen LastPass vaults, with about $28 million laundered through Wasabi Wallet. The same reporting notes that the UK Information Commissioner's Office fined LastPass $1.6 million in December 2025 for failing to implement adequate technical and security measures; Wikipedia records that over one million UK data subjects were affected.

The lessons are concrete. Assume the encrypted vault can be exfiltrated: use a long, random master password that resists years of offline cracking. Do not store crypto seed phrases, SSH private keys, or recovery codes for your other high-value accounts as plain notes. After any vendor breach, treat it as a credible prompt to rotate critical credentials (email, bank, domain registrar) rather than waiting for forensic certainty. Shutdowns are the other failure mode: Dropbox Passwords was permanently sunsetted on October 28, 2025, with all credential and payment data deleted from servers after that date, per 1Password's coverage. Before you commit to any vendor, confirm the export options and export a backup at signup.

The checklist that catches year-two regrets

Run through this list before you commit a subscription or install an app. It applies equally whether you are picking an individual tool or comparing options from our teams and business rankings.

• Third-party audit (penetration test or source code review) from the last 18 months, by a named firm like Cure53, Independent Security Evaluators, NCC Group, or Trail of Bits, with findings and remediation published.
• Zero-knowledge architecture documented in a security whitepaper, not just mentioned on a marketing landing page.
• Clear recovery flow: a Secret Key equivalent, a printable recovery code, a passkey or device-based login, or a named emergency contact.
• Export options: CSV plus at least one native or encrypted format. If there is no export button, that alone is a reason to pass.
• Free tier that matches your actual device count and feature needs, or a paid tier that is worth the specific features you will use.
• Breach and incident history you have actually read, including the 2022 LastPass breach and its ongoing consequences.
• 2FA support beyond SMS: hardware key (YubiKey), authenticator app, or passkey login.

What to check before switching

Switching is easier than it used to be. Bitwarden's import documentation lists direct support for migrating from 1Password, and 1Password supports direct import from Bitwarden through its in-app migration flow. CSV remains the universal fallback for every manager worth considering.

The practical sequence: export the full vault from your current manager as CSV or the native encrypted format; import into the new manager on a desktop rather than through a browser extension; spot-check that TOTP seeds, secure notes, and file attachments transferred (CSV frequently drops TOTP and attachments); reconfigure autofill; log into a handful of accounts to confirm; then revoke sessions on the old account and delete the vault. Keep an encrypted copy of the export offline for a month in case something was missed.

Two specific gotchas. CSV exports are plaintext by definition; delete the file securely after importing, or encrypt it with an archive password first. If you are switching because of a breach, change the passwords for every high-value account as part of the migration rather than trusting that the encrypted vault held.