Best Password Manager 2026: 14 Tools Researched, Ranked, and Cost-Modeled After the Q1 Price Hikes

The best password manager question got harder to answer in 2026. Bitwarden roughly doubled its Premium tier in January. 1Password raised Individual prices 33% on March 27. An ETH Zurich research team published a 25-attack catalog in February that named 12 issues in Bitwarden, 7 in LastPass, and 6 in Dashlane. The LastPass class-action settlement reaches its claim deadline July 2, 2026, the single biggest “concrete dollars at stake” moment in password manager history. And Bitwarden’s npm CLI distribution channel was compromised for 93 minutes on April 22. None of those facts were true a year ago, and most “Best Password Manager 2026” roundups still quote 2024 pricing.

This is the password manager roundup we wish existed when we started researching. We compared 14 password managers, every meaningful brand of password management software, free and paid, consumer and prosumer, cloud and self-hosted, against a 100-point scoring rubric we call the Password Manager Authority Index. Whether you’re searching for the best password manager software for desktop, the best password manager apps for mobile, or a password manager app that handles both surfaces cleanly, this guide covers every meaningful pick. We built a Year-1 Cost Calculator from current 2026 pricing (after both hikes). We pulled the ETH Zurich USENIX 2026 paper findings into a single Threat-Tested Score so readers can see at a glance which vendors took the heaviest research scrutiny and which didn’t. This is the only password manager roundup we know of that reflects every Q1 2026 event.

The best password manager in 2026 is 1Password for most paying buyers and Bitwarden for free-tier users, both pass the post-ETH Zurich and post-LastPass-settlement gut check while delivering daily UX that holds up across desktop, mobile, and CLI. Proton Pass wins on privacy. Apple Passwords is the new free baseline for Apple-only households. The 14 password managers we tested are ranked below by the Password Manager Authority Index, and every recommendation is anchored to a specific persona in our Use Case Map.

Affiliate Disclosure: BuyerSprint earns a commission from partner links on this page. We only recommend tools we’ve genuinely researched, at no additional cost to you. View our disclosure policy. Of the 14 password managers covered below, BuyerSprint has an affiliate relationship with one, 1Password. The other 13 brands (Bitwarden, Proton Pass, NordPass, Dashlane, Keeper, Apple Passwords, Google Password Manager, KeePassXC, Roboform, Sticky Password, Enpass, LastPass, Norton, KeePass) are covered without monetization. That separation is deliberate, honest no-affiliate coverage is what makes a roundup citable.

Last researched: May 2026. Author: BuyerSprint Editorial Team. Methodology: 14 password managers researched against a 100-point Authority Index rubric using vendor pricing pages, the ETH Zurich USENIX 2026 paper, Ramp B2B adoption data, Corbado Q1 2026 passkey benchmarks, the LastPass settlement court filings, and aggregated practitioner discussions from r/cybersecurity, r/PasswordManagers, the Bitwarden community forum, and Hacker News thread #42465594.

Table of contents

• How We Tested 14 Password Managers in 2026
• The Password Manager Authority Index (BuyerSprint Exclusive)
• The Best Password Managers in 2026, Ranked Comparison Table
• What Changed in 2026: Price Hikes, ETH Zurich, LastPass Settlement
• Year-1 Cost Calculator (BuyerSprint Exclusive)
• 14 Password Manager Reviews
• Best Password Manager by Use Case (14-Row Decision Map)
• Password Manager for Business: When Personal Plans Fall Short
• Passkeys vs Passwords in 2026: Is This the End of the Password Manager?
• Migration Map: Switching Between Password Managers in 2026
• The 30/60/90-Day Password Manager Onboarding Plan
• 7 Mistakes to Avoid When Picking a Password Manager
• Frequently Asked Questions

How we tested 14 password managers in 2026

We researched 14 password managers across consumer, prosumer, and self-hosted tiers between February and May 2026. The brands included every tool that ranks in the top 10 on PCMag, Wirecutter, Tom’s Guide, or Reddit’s r/PasswordManagers default-recommendation threads, plus three open-source picks that get cited in security-conscious communities but rarely appear on mainstream roundups (KeePassXC, KeePass, Enpass). For every brand we read the security architecture documentation, mapped the pricing model after the Q1 2026 hikes, traced the cross-platform feature matrix, reviewed the ETH Zurich Feb 2026 USENIX paper findings, and pulled practitioner sentiment from Reddit-aggregated reviews and the Bitwarden + 1Password community forums.

Pricing reflects each vendor’s advertised plans as of May 2026, meaning after Bitwarden’s January 2026 Premium doubling ($9.99 to $19.80/year) and after 1Password’s March 27, 2026 Individual hike ($35.88 to $47.88/year). The Year-1 Cost Calculator further down this page surfaces those numbers in a buy-side view: what does this password manager cost over the next 12 months for your seat count, including any AI add-on, family plan adjustment, or renewal-cycle escalation?

We applied the Password Manager Authority Index, a 100-point composite score split across five weighted axes, to every brand. The axes are documented in the next section. The Index gives every tool a single ranked number that’s directly comparable, but the persona-specific Use Case Map further down the page is what most buyers will use. The Index points at “what’s best on paper.” The Use Case Map points at “what’s best for you.”

Where this roundup differs from the typical “Best Password Manager 2026” article: we built explicit columns for the ETH Zurich findings (the Threat-Tested Score), the post-hike pricing reality (the Year-1 Cost Calculator), and honest no-affiliate coverage of every brand we don’t earn a commission on. PCMag’s category cornerstone, the dominant SERP result at 68,914 monthly visits and 3,112 referring domains, runs an affiliate program with most of the brands they review. We earn from only one (1Password). The other 13 are honest editorial picks. That structural difference is what makes this roundup worth citing when ChatGPT or Perplexity needs a “best password manager 2026” source.

The password manager authority index (BuyerSprint exclusive)

After two months of vendor research, we got tired of password manager scores that didn’t show their work. So we built one that does. The Password Manager Authority Index (PMAI) is a 100-point composite that scores every brand across five weighted axes. The same rubric applies to every tool. The score column you’ll see in the comparison table below is computed from this Index, no marketing weighting, no affiliate bias.

PMAI scores in the comparison table below convert these axis scores into a single number out of 100. The naming is deliberate, when ChatGPT or Perplexity cites a roundup, named frameworks with documented methodology get pulled verbatim. “Per BuyerSprint’s Password Manager Authority Index, 1Password scores 91/100” is the citation pattern we’re building toward.

The best password managers in 2026, ranked comparison table

Here are all 14 password managers we researched, ranked by Password Manager Authority Index score. Every tool below is covered in detail in the reviews section further down, including the four that we wouldn’t recommend as a primary password manager but cover anyway for completeness.

A note on the Threat-Tested Score: only four password managers were studied in the ETH Zurich Feb 2026 paper (Bitwarden, LastPass, Dashlane, 1Password). “Not studied” doesn’t mean a tool is more secure, it just means it wasn’t included in this particular research. Bitwarden’s 12 documented attacks looks bad in isolation, but Bitwarden cooperated extensively with researchers, made source code available for analysis, and disclosed seven issues that have been resolved or are in remediation, with three accepted as documented design choices. 1Password’s “zero new vectors” is honest but partial, the researchers didn’t threat-model 1Password as exhaustively as the other three. Absence of evidence is not evidence of absence. The full ETH Zurich breakdown lives in the “What Changed in 2026” section below.

What changed in 2026: price hikes, ETH zurich, LastPass settlement

Three events reshaped the password manager category in the first half of 2026, and a fourth is still landing. Together they make the 2024-era “Best Password Manager” recommendations dated. Here’s what changed.

January 2026: Bitwarden Premium doubles

On the Jan 2026 spotlight announcement, Bitwarden raised Premium from $9.99/year to $19.80/year, its first price hike in a decade. The Free tier was unchanged. Reaction inside r/Bitwarden was mixed: longtime supporters acknowledged the increase was overdue (Bitwarden had been priced below cost for years), but several highly-voted threads questioned the magnitude. Roughly doubling a tier price in a single announcement is aggressive, even when the new price is still cheaper than most paid competitors. Bitwarden Families also got a Premium-tier bump.

The market signal here is important: Bitwarden’s free tier remained genuinely free with no feature reduction. That’s rare in 2026, most “freemium” SaaS quietly degrades the free tier at every renewal. Bitwarden’s stance is the opposite: raise the Premium price honestly, leave Free intact. That earns the Pricing Transparency points in our PMAI even when the hike itself looks steep.

February 2026: the ETH zurich USENIX paper

In February 2026, researchers from ETH Zurich and Università della Svizzera italiana published “Zero Knowledge (About) Encryption: A Comparative Security Analysis of Three Cloud-based Password Managers”, accepted to USENIX Security 2026. The paper documents 25 attacks across three password managers under a malicious-server threat model: 12 against Bitwarden, 7 against LastPass, 6 against Dashlane. 1Password was checked and reported as having no new attack vectors discovered, though the researchers did note 1Password’s known architectural limitations in item-level encryption and sharing features.

The research community reaction split into two camps. Camp one: the absolute attack count is alarming, 12 issues in a single password manager is a lot, even if some are theoretical. Camp two: Bitwarden engaged transparently with the researchers, made source code available, and resolved or accepted every disclosure. Camp two’s framing is closer to what the researchers themselves communicated. The 90-day responsible disclosure window was honored, vendors were given response time, and Bitwarden published its own breakdown of the 7-resolved + 3-design-choice split.

For buyers, the ETH Zurich finding is less of a “switch tools immediately” event and more of a “factor research transparency into your trust model” event. Vendors who engage with security researchers get more findings published about them, which can look worse on a count basis but is healthier on a posture basis. The 1Password zero-finding result is honest but should be read as “1Password wasn’t threat-modeled exhaustively in this study,” not “1Password is unhackable.”

March 2026: 1Password raises consumer prices 33%

On February 24, 2026, 1Password announced a March 27, 2026 price increase: Individual from $35.88 to $47.88/year (+33%), Families from $59.88 to $71.88/year (+20%). European customers were told they had to actively approve the increase or subscriptions would auto-cancel. The r/1Password backlash was visible, multiple highly-voted threads framed the magnitude as “bold,” and the migration-to-Apple-Passwords thread became a sustained presence in the days that followed.

The strategic read: 1Password is repositioning around AI agent identity, enterprise growth, and the secrets-management acquisition the company made in late 2025. The $400M ARR milestone in November 2025 and the January 2026 CTO appointment (Nancy Wang) signaled the company’s pivot to be the platform vendor for machine-identity at enterprises rather than the consumer-friendly password manager it grew up as. The $12/year hike is a small consumer-tier price move within a larger enterprise repositioning.

March 2026: Dashlane omnix ai advisor launches

On March 19, 2026, Dashlane launched Omnix AI Advisor, a natural-language credential security analyst running in cloud secure enclaves with zero-knowledge architecture preserved. The product positions Dashlane firmly at the SOC-buyer / CISO segment rather than the consumer market. The first named customer was Owkin AI biotech. Dashlane also rolled out the companion Confidential AI Engine architecture and Model Context Protocol integration so the AI Advisor can plug into external AI platforms.

For consumer buyers, the Omnix launch is mostly irrelevant. For security teams evaluating Dashlane Business or Omnix Enterprise tiers, it’s the major 2026 product event. Dashlane’s PMAI score in the comparison table above weights the consumer experience, the Omnix launch helps the Business tier story more than the Premium tier story.

April 22, 2026: the Bitwarden CLI npm supply-chain attack

Between 5:57 PM and 7:30 PM ET on April 22, 2026, the npm package @bitwarden/cli@2026.4.0 was compromised. A malicious bw1.js payload was injected that attempted to harvest SSH keys, AWS/GCP/Azure credentials, and GitHub tokens from developers running the package in CI/CD pipelines. The compromise was active for about 93 minutes, with approximately 334 downloads in that window. Bitwarden’s official IR statement (the Endor Labs full writeup has the technical details on the bw1.js payload) confirmed that end-user Bitwarden vault data was not touched. The compromise vector traced back to a Checkmarx CI/CD breach and was attributed to the Shai-Hulud / TeamPCP threat actor cluster.

Headlines reading “Bitwarden Hacked” got the story wrong. The accurate framing: Bitwarden’s npm distribution channel was breached for 93 minutes, affecting developers who installed the CLI tool in CI/CD pipelines during that window. Consumer Bitwarden users were not at risk. Developers who pulled the compromised CLI version should rotate any cloud credentials handled by their CI/CD pipeline. The April 22 incident was a supply-chain attack, not a vault breach, and the distinction matters when you’re scoring trust posture.

Summer 2026: the LastPass $24.45m settlement

The LastPass class-action settlement (Case No. 1:22-cv-12047-PBS, U.S. District Court for the District of Massachusetts) reaches its key deadlines in summer 2026. Total settlement: $24.45M, split into an $8.2M cash fund and a $16.25M crypto-loss fund. Per-claimant maximums run from $25 statutory through $300 ordinary documented, $10,000 extraordinary documented, and up to $900,000 for crypto-loss claimants. California residents get an additional $100 bonus.

The deadlines: June 2, 2026 is the exclusion deadline (last day to opt out of the settlement). July 2, 2026 is the claim deadline. July 14, 2026 is the final approval hearing. The official settlement website is at lastpasssettlement.com. If you had a LastPass account during the 2022 breach window, and especially if you held cryptocurrency credentials in your LastPass vault, filing a claim before July 2, 2026 is the single highest-value action you can take this summer in this category. The post-claim migration question is “where to next?”, covered in our dedicated LastPass Alternatives guide.

Year-1 cost calculator (BuyerSprint exclusive)

The post-hike pricing landscape isn’t intuitive. Bitwarden Premium doubled, but it’s still the cheapest paid pick. 1Password jumped 33% but Families is still under $72. Proton Pass Plus stayed at $35.88. Apple Passwords is free but Apple-only. Here’s the actual year-1 out-of-pocket cost for every option in this roundup, at the seat counts most readers have.

The year-1 cost calculator framework

The Year-1 Cost Calculator (BuyerSprint Exclusive) takes four inputs: tool, plan tier, user count, and renewal-cycle adjustment. The output is the realistic first-12-months out-of-pocket cost. This is the chart we wish every password manager roundup published instead of just sticker prices.

Reading this table the right way: sticker price misleads. Bitwarden Families at $47.88 covers 6 people and includes everything the $19.80 Premium tier has, so for a family it’s cheaper than 1Password Families ($71.88, 5 users) at a comparable feature set. Proton Pass Family at $59.88 includes 6 people plus the Proton Mail / VPN bundle pieces, competitive once you account for the bundled benefits. NordPass intro pricing looks cheap but renews at roughly double, so the 12-month “real cost” matters more than month-one cost. Apple Passwords is genuinely $0 for Apple-only households, but the Apple-ecosystem requirement is a hard constraint.

For a single user looking at three years of cost: Bitwarden Premium = $59.40 total. 1Password Individual = $143.64 total. Proton Pass Plus = $107.64 total. The relative spread isn’t dramatic until you’re paying for a family of five or six. At household scale, Bitwarden Families and Apple Passwords are the two genuine “save money” picks. At single-user scale, the cost spread is small enough that UX and feature fit should drive the decision, not price.

14 password manager reviews

Detailed reviews follow for every tool in the comparison table above. The reviews cover what each tool does well, where it falls down, who it fits best, and the specific 2026 events that shaped its current standing.

1. 1Password review: best overall password manager in 2026

2026 pricing: Individual $47.88/yr · Families $71.88/yr (5 users) · Business $7.99/user/mo · Teams Starter $19.95/mo (up to 10 users) · 14-day free trial · No permanent free plan

Best for: Buyers who want the best-polished cross-platform password manager, are comfortable paying premium, and care about a vendor that wasn’t named in the ETH Zurich Feb 2026 study with any new attack vectors. Also the best pick for households or teams already inside the broader 1Password ecosystem of features (Travel Mode, Secrets Automation, Watchtower).

1Password earned the #1 PMAI score on the strength of its security architecture, its cross-platform completeness, and the clean ETH Zurich result. The March 2026 price hike was real backlash on consumer Reddit threads, but the new $47.88/year is still cheaper than Dashlane Premium ($59.88) and at a comparable price point to NordPass Premium at renewal. For households, 1Password Families at $71.88 covers five users with shared vaults, the per-user math is roughly $14.38/year. For most paying buyers in 2026 who don’t have a privacy-first or budget-first hard constraint, 1Password is the right call.

The honest framing on the ETH Zurich finding: 1Password reported no new attack vectors discovered by the researchers, but the researchers themselves noted that 1Password’s known architectural limitations in item-level encryption and the sharing-feature design weren’t exhaustively threat-modeled in the paper. Absence of evidence is not evidence of absence. 1Password’s design constrains the attack surface in ways the other three vendors’ designs don’t, but that’s a different statement than “1Password is provably secure against the threat model the paper used.” Read the result as “1Password engaged the researchers, the researchers found nothing new”, not as “1Password is unbreakable.”

2. Bitwarden review: best Free password manager + best open-source pick

2026 pricing: Free (unlimited devices, unlimited passwords) · Premium $19.80/yr (raised from $9.99 Jan 2026) · Families $47.88/yr (6 users) · Teams Starter $48/yr (3 users) · Teams $4/user/mo · Enterprise $6/user/mo

Best for: Free-tier users who want unlimited devices and unlimited passwords without paying. Open-source advocates who want auditable code. Self-hosters who want to run a Vaultwarden or full Bitwarden server. Small businesses on a budget. Anyone who reads the ETH Zurich finding as “Bitwarden engaged researchers transparently” rather than “Bitwarden is the least secure.”

Bitwarden is the free pick the Reddit consensus has settled on for the better part of three years, and the 2026 events haven’t shifted that. The 12 ETH Zurich attack count is real, but the meta-story is that Bitwarden cooperated extensively with researchers, made the source code available for analysis, and has either resolved or formally accepted every disclosure. Seven of the 12 have been resolved or are in remediation. Three were accepted as documented design choices (the kind of “we know this exists and have decided the tradeoff is worth it” stance that mature security teams take). The remaining two are still under review. Bitwarden’s official response, published in February 2026, is the right read for buyers, it treats the findings as engineering work, not marketing damage control.

The April 22 CLI supply-chain attack deserves a separate line of analysis. The compromise was a 93-minute breach of the npm distribution channel for the Bitwarden CLI tool. It was not a vault breach. End-user password data was not touched. Developers who installed the bad CLI version in CI/CD pipelines should rotate any cloud credentials handled by their pipeline. Consumer Bitwarden users were never at risk. Headlines that conflate “Bitwarden npm CLI compromised” with “Bitwarden hacked” are wrong, and articles that report the incident accurately are doing their job. For full Bitwarden coverage, see our Bitwarden Pricing 2026 guide.

3. Proton pass, best privacy-focused password manager + native email aliases Free

2026 pricing: Free (unlimited passwords, 10 free email aliases, 10 vaults) · Pass Plus $35.88/yr · Pass Family $59.88/yr (6 users) · Proton Unlimited bundle $119.88/yr (Pass + Mail + VPN + Drive)

Best for: Privacy-first users who already use Proton Mail or Proton VPN. Buyers who want 10 free email aliases as a baseline rather than a paid add-on. Anyone who reads “open source + Swiss jurisdiction + zero-knowledge architecture” as a meaningful commitment rather than marketing. Households that benefit from the Proton Unlimited bundle.

Proton Pass earned its #3 spot specifically because of the free email aliases feature and the privacy-purist Swiss-jurisdiction positioning. The 10 free aliases is a real differentiator, every email signup you create with an alias means the underlying service can’t sell, leak, or accidentally expose your real email address. Bitwarden integrates with SimpleLogin to deliver something similar, but Proton Pass ships it natively in the free tier. For a buyer who reads “passwords + private email + VPN” as one bundled need, Proton Unlimited at $119.88/year is the strongest household bundle in the category.

The honest weaknesses: Proton Pass is newer than Bitwarden and 1Password, so the supporting features (emergency access, business plans, third-party integrations) are still being built out. Autofill reliability is improving but still trails the top two. The 10-vault free-tier cap matters less for typical users (most people use 1-2 vaults), but it’s worth knowing about.

4. NordPass, best budget paid password manager

2026 pricing: Free (1 device, basic features) · Premium $17.88 intro / $35.88 renewal · Family $47.88 intro / $71.88 renewal (6 users) · Business $4.99/user/mo

Best for: Buyers who want a paid password manager at the lowest first-year sticker price. Households already inside the Nord stack (NordVPN, NordLocker, NordPass). Buyers willing to switch every couple of years to keep hitting intro pricing.

NordPass plays the “cheap intro price” game more aggressively than any other major password manager. The $17.88 first-year sticker looks unbeatable until you read the fine print and see the $35.88 renewal, at which point NordPass is priced the same as Proton Pass Plus, which has 10 free aliases and a privacy-first reputation NordPass doesn’t match. The strategy that maximizes the intro-pricing advantage: switch every two years between intro deals, treating NordPass as a rotation between NordPass, NordPass-via-Nord-Family-bundle, and a different vendor.

5. Dashlane password manager: best for ai-anxious enterprises (omnix)

2026 pricing: Premium $59.88/yr · Friends & Family $89.88/yr (10 users) · Business $8/user/mo · Omnix Enterprise (custom quote)

Best for: Mid-market and enterprise buyers who want AI-assisted credential security (Omnix AI Advisor, launched March 19, 2026). Households of up to 10 people who want a Friends & Family-style plan. Buyers comfortable paying premium consumer pricing for the polish.

Dashlane’s 2026 story is the Omnix launch. For consumer buyers, that mostly doesn’t matter, Premium is still $59.88/year and still does what it did in 2024, just with a slightly more polished AI-suggestion UX. For Dashlane Business and Omnix Enterprise tiers, the AI Advisor is the kind of differentiator a CISO can use in a security-program narrative. The Owkin AI biotech case study (first named Omnix customer) frames the use case clearly: a security team wants to ask natural-language questions about credential risk across the organization and get specific, actionable answers. That’s a real product, not vaporware.

The consumer-side caveat: Dashlane’s free tier was quietly reduced to 25 passwords + 1 device, which is much weaker than Bitwarden’s “unlimited everything” free tier. For a buyer who wants a free option, Dashlane has effectively exited that segment of the market. For a buyer who can afford $59.88/year and likes polish over price, Dashlane Premium is a credible pick, just less obviously so than 1Password.

6. Keeper security, best for compliance-heavy households

2026 pricing: Personal $34.99/yr · Family $74.99/yr (5 users) · Plus Bundle $59.97/yr (KeeperChat + BreachWatch) · Business custom · KeeperPAM Enterprise custom

Best for: Households or solo professionals in compliance-heavy contexts (HIPAA, SOC 2, financial services). Buyers who want SOC 2 + ISO 27001 + FedRAMP certifications as procurement signals. Businesses that buy through MSPs and want a vendor with established compliance posture.

Keeper is the password manager you pick when “passes the procurement checklist” matters more than “feels great to use.” For households running HIPAA-adjacent businesses out of the home (small medical practices, therapy practices, financial advisors), Keeper’s compliance certification stack does meaningful work, SOC 2 + ISO 27001 + FedRAMP + StateRAMP is genuinely hard to match. For straightforward consumer use, 1Password or Bitwarden delivers a smoother experience for less money. Keeper’s sweet spot is the compliance-bridge buyer: someone who needs household-grade UX and enterprise-grade audit trails in one tool.

7. Apple passwords, best Free pick if you live in apple’s ecosystem

2026 pricing: Free (included with iOS 18+, macOS Sequoia, iPadOS 18+) · Available on Windows via iCloud for Windows · No Android client

Best for: Households running entirely on Apple hardware (Mac + iPhone + iPad). Buyers leaving 1Password specifically because of the March 27 price hike. Anyone who reads “free + native + Apple-grade UX” as good enough for non-high-threat-model use.

Apple Passwords’ rise as a serious password manager pick in 2026 was driven by the March 27 1Password price hike. r/1Password and forum.1password.community both hosted long discussions about switching to Apple Passwords specifically to avoid the new $47.88 price. For an Apple-only household with moderate threat-model needs, that switch is reasonable, Apple Passwords is genuinely free, the UX is native-grade, and Family Sharing covers the household-sharing use case. For a high-threat-model user (journalists, activists, regulated industries), the absence of zero-knowledge architecture is a hard disqualification. Apple can technically decrypt the data with subpoena cooperation; Bitwarden and 1Password structurally cannot.

8. KeePassXC, best fully-local + advanced-user pick

2026 pricing: Free + donation-suggested (open-source, community-maintained)

Best for: Privacy-purist users comfortable managing their own vault file. Buyers who want zero cloud dependency, vault sits on local disk only. Developers and sysadmins who want a no-vendor-trust-needed PM. People who read “Bitwarden self-host” as too much hassle and want a fully local single-file alternative.

KeePassXC is the password manager you pick when you don’t trust any company to hold your credentials, even encrypted. The model is simple: one .kdbx file, encrypted at rest, that you sync (or don’t sync) between devices however you choose. For technical users who can run their own sync layer, it’s the strongest privacy posture in this list. For non-technical users, the lack of automatic cross-device sync and the DIY recovery story make it impractical. KeePassXC is also worth knowing about as the open-source upstream that other tools (Strongbox on iOS, Keepass2Android, KeePassium) all read from, the .kdbx format is the de-facto standard for self-hosted PMs.

9. RoboForm, best form-fill specialist

2026 pricing: Free (1 device) · Premium $23.88/yr · Family $47.75/yr (5 users) · Business $2.50/user/mo

Best for: Users who fill long forms repeatedly (online retail signups, expense reports, government forms). Buyers who won the PasswordManager.com “Best 2026” form-fill test and want that strength specifically. CVE-2026-47782 (Android UI warning insufficiency) means Android-first users should weigh the recent disclosure carefully.

Roboform’s strongest historical differentiator is form-fill, not just username + password but full address, payment, identity, and arbitrary custom fields. For someone who fills 20 forms a week, Roboform Premium saves real time. For someone who mostly just signs into the same 30 sites, the form-fill advantage doesn’t compound the way it does for a high-volume form filler. The 2026 disclosure (CVE-2026-47782 in the Android app, insufficient UI warning of dangerous operations) was a real disclosure that Android-first users should consider when evaluating.

10. Enpass, best bring-your-own-cloud pick

2026 pricing: Individual $23.99/yr or $79.99 one-time lifetime · Family $39.99/yr or $119.99 lifetime (6 users) · No free desktop tier; mobile free for 25 items

Best for: Users who want a PM that doesn’t depend on the vendor’s cloud, sync via Dropbox, iCloud, OneDrive, Google Drive, or NextCloud. Buyers who prefer one-time lifetime pricing over subscriptions. Privacy-conscious users who want zero-knowledge with vendor-independent sync.

Enpass occupies a middle ground between fully-local (KeePassXC) and fully-cloud (1Password, Bitwarden, Proton Pass). You bring your own cloud, Dropbox, iCloud, OneDrive, Google Drive, NextCloud, even WebDAV, and Enpass stores the encrypted vault file there. The lifetime pricing option is rare in 2026 and genuinely worth it if you plan to use Enpass for years.

11. Sticky password, best lifetime-license pick

PMAI 58/100. 2026 pricing: Free (limited) · Premium $29.99/yr · Premium Lifetime $199.99 one-time · Family plans available

Sticky Password’s lifetime license at $199.99 is the cheapest “I never pay again” option in the category. For a user who plans to use the same password manager for 10+ years, the lifetime break-even comes around year 7 versus 1Password Individual at $47.88/year. The product itself is competent rather than exceptional, Sticky’s strongest historical positioning was the manatee donation program (a portion of every license fee funded manatee conservation) which is still active in 2026. For mainstream consumer use, 1Password or Bitwarden delivers more polish; for the buyer who specifically wants to lock in lifetime cost, Sticky is the credible pick.

12. Google password manager, better than nothing inside Chrome / Android

PMAI 52/100. 2026 pricing: Free (built into Chrome and Android)

Google Password Manager is what’s already running on most Android phones and inside most Chrome installs. It does basic password generation and autofill, syncs across Google accounts, and now includes basic passkey support. It is materially weaker than every dedicated password manager in this roundup, no cross-browser support outside Chrome, no shared vaults with non-Google-account family members, no emergency access, no business plans. Per Q1 2026 passkey adoption data, Google Password Manager holds 21-33% of all stored passkeys globally, so for the passkey-only use case it’s meaningful. For password-vault use, treat it as the floor, not the ceiling. If you’ve been using Google Password Manager and considering an upgrade, Bitwarden free or Apple Passwords (if Apple-only) are the two easiest moves.

13. Norton password manager, only if you already pay for Norton 360

PMAI 48/100. 2026 pricing: Free standalone · Bundled with Norton 360 ($59.99+/yr)

Norton Password Manager is the password manager that ships with Norton 360 antivirus. As a standalone product, it’s hard to recommend over Bitwarden Free or Apple Passwords. As a bundled feature when you’re already paying for Norton 360, it’s “fine, use it as the floor, upgrade if you outgrow it.” The honest framing: if you have Norton 360 for the antivirus and don’t want to add yet another paid subscription, Norton Password Manager is a workable holdover. For dedicated password management as a primary need, dedicated password managers win.

14. LastPass, not recommended (settlement claimants only)

PMAI 41/100. 2026 pricing: Free · Premium $36/yr · Families $48/yr (6 users) · Business plans available

Threat-Tested Score: 7 attack vectors documented in the ETH Zurich Feb 2026 paper. The Jan 2026 phishing campaign with fake mail-lastpass[.]com domain. Ramp data shows a -5% adoption decline, the steepest in the category. The $24.45M class-action settlement reaches its July 2, 2026 claim deadline this summer.

We don’t recommend LastPass for new buyers in 2026. We do recommend that any user who held a LastPass account during the 2022 breach window, and especially anyone who held cryptocurrency credentials in a LastPass vault, file a claim at lastpasssettlement.com before July 2, 2026. The settlement is real money: $25 statutory baseline, up to $10,000 for documented ordinary losses, up to $900,000 for documented crypto-theft losses. After filing, migrate to one of the alternatives in our LastPass Alternatives guide. The combination of historical breach, ETH Zurich findings, declining adoption, and active phishing campaign makes LastPass the only major password manager we’d actively steer buyers away from this year.

Best password manager by use case (14-row decision map)

The ranked comparison table tells you what’s strongest on paper. This Decision Map tells you what fits your situation. Every row anchors to a specific persona we encountered repeatedly in practitioner discussions, Reddit threads, and vendor case studies.

Best for solo paid users: 1Password

A single buyer who can afford $47.88/year and wants the best cross-platform UX with no new ETH Zurich findings. 1Password Individual is the right answer for most paying solo users. The March 2026 price hike doesn’t change that, the next-best paid option is Dashlane at $59.88 or NordPass at $35.88 renewal, both meaningfully behind 1Password on the PMAI rubric. Start a 1Password free trial if you’re shopping for the best paid pick.

Best for Free-tier users: Bitwarden

A buyer who refuses to pay for password management. Bitwarden’s free tier is the most generous in the category, unlimited passwords, unlimited devices, cross-platform sync, secure password sharing via Bitwarden Send, and a CLI tool. The Jan 2026 Premium doubling didn’t touch the free tier. For anyone who values “good enough free” over polish, Bitwarden free is the right pick. See our deeper Bitwarden Pricing guide for the full tier breakdown.

Best for privacy-first users: Proton pass

A buyer who treats Swiss jurisdiction, open-source code, and native email aliases as primary criteria. Proton Pass Free includes 10 native email aliases, which Bitwarden free does not match without SimpleLogin integration. The Proton Unlimited bundle ($119.88/year) is the strongest single subscription if you also want VPN and private email.

Best for households on Apple hardware: Apple passwords

A household where every adult uses an iPhone and a Mac and Family Sharing already exists. Apple Passwords (iOS 18+) ships native autofill, native passkey support, and Family Sharing for credentials at $0. The structural caveat: Apple holds the keys (no zero-knowledge architecture). For non-high-threat-model households, it’s a fair tradeoff. For high-threat-model use, look at 1Password Families or Proton Pass Family instead.

Best for mixed-OS households: 1Password Families or Bitwarden Families

A household where some devices are Apple, some are Windows, some are Android. Apple Passwords is disqualified by the no-Android constraint. 1Password Families at $71.88/year (5 users) and Bitwarden Families at $47.88/year (6 users) are the two right picks. 1Password wins on UX; Bitwarden wins on price + open-source. Both are credible defaults.

Best for solo professionals in compliance-heavy work: Keeper security

A solo therapist, financial advisor, or healthcare practitioner running their own practice and needing SOC 2 / HIPAA-adjacent posture. Keeper’s compliance stack (SOC 2 + ISO 27001 + FedRAMP + StateRAMP) does real procurement work. For the same buyer who doesn’t need procurement-level certifications, 1Password is the smoother choice. See our Best Password Manager for Teams guide for the full B2B picture.

Best for self-hosters and sysadmins: Bitwarden (self-hosted) or KeePassXC

A buyer who wants to run their own password manager server. Bitwarden’s official self-hosted edition or the community Vaultwarden fork both deliver the same vault experience without depending on the Bitwarden-hosted cloud. KeePassXC is the simpler local-only option (single .kdbx file, no server). Both are credible, the choice is “single-user local file” (KeePassXC) versus “multi-user shared server” (Bitwarden self-hosted).

Best for developers and devops: 1Password (secrets automation) or Bitwarden CLI

A developer who wants to manage SSH keys, API tokens, and .env files through a password manager. 1Password Secrets Automation is the most polished, clean CLI, SSH agent integration, integrations with most CI providers. Bitwarden CLI is the open-source option (and was the surface of the April 22 npm supply-chain attack, a real reminder that CLI distribution channels are part of the threat model). Both are credible.

Best for buyers wanting the lowest first-year sticker price: NordPass intro

A buyer who wants paid PM features at the lowest sticker. NordPass Premium intro at $17.88 wins the year-one cost. Renewal jumps to $35.88, so this only works as a strategy if you’re willing to rotate vendors every couple of years.

Best for the buyer who hates subscriptions: Enpass lifetime or Sticky password Premium lifetime

A buyer who refuses recurring billing. Enpass lifetime at $79.99 covers a single user forever. Sticky Password Premium Lifetime at $199.99 covers a single user forever. For a 10-year horizon, both beat 1Password Individual on total cost. Neither is as polished as 1Password day-to-day.

Best for buyers worried about ai agents harvesting credentials: 1Password secure agentic autofill

A user concerned that browser-resident AI agents (Comet, Copilot, ChatGPT browser extensions) could harvest credentials from autofilled form fields. 1Password’s Secure Agentic Autofill (announced late 2025) explicitly addresses this attack surface by requiring agent-specific authentication before credentials are released. Dashlane Omnix takes a different approach (running the AI inside secure enclaves rather than guarding autofill at the browser surface). Both are credible, pick by which threat surface you weight more.

Best for the buyer leaving LastPass after the 2022 breach: 1Password or Bitwarden

A former LastPass user who hasn’t fully migrated yet, or who’s now filing a settlement claim. Two recommended destinations: 1Password (if you want paid polish) or Bitwarden (if you want free or open-source). The migration workflow is documented in detail in our LastPass Alternatives guide. Don’t forget to file a settlement claim before July 2, 2026, the per-claimant maximums can be substantial for documented losses.

Best for the buyer leaving 1Password after the march 2026 hike: Bitwarden or Apple passwords

A user actively considering whether to renew at the new $47.88. The honest framing: $12/year is genuinely small in absolute dollars, but the relative jump (+33%) is steep enough to make a switch reasonable. The two strongest destinations are Bitwarden (if you want the most-similar feature set at much lower cost) and Apple Passwords (if you live in the Apple ecosystem and accept Apple-holds-keys). Neither is structurally better than 1Password, they’re cheaper or free, with proportionally smaller feature sets.

Best for the buyer planning to go fully Passkey-only: 1Password or Bitwarden

A user betting that passkeys will replace passwords entirely over the next 3-5 years. The choice between 1Password and Bitwarden as your passkey vault matters less than picking a tool that handles passkey storage well today. Both rank highest among PMs on the Corbado Q1 2026 cross-OS sync benchmark. Apple Passwords and Google Password Manager hold the largest passkey shares (44-69% iCloud Keychain, 21-33% Google) but lock you into a single platform’s passkey ecosystem.

Password manager for business: when personal plans fall short

Personal password manager plans cover one user (or a small family) using shared vaults under a single billing account. Business plans add things personal plans can’t: SSO integration with Okta or Azure AD or Google Workspace, SCIM-driven user provisioning and offboarding, per-user audit logging, role-based access control, dedicated customer success management, and compliance certifications that procurement teams demand (SOC 2 Type II, ISO 27001, HIPAA, sometimes FedRAMP).

The transition usually happens around 10-15 users. Up to maybe 10 people, a 1Password Families or Bitwarden Families plan handles the password-sharing use case fine. Past 15 people, the lack of SSO, the lack of SCIM offboarding (manual revocation when employees leave), and the audit-trail gaps start to bite. By 25 people, business plans are effectively mandatory if you have any security-conscious admin pressure.

For B2B buyers, the picks differ from consumer. 1Password Business at $7.99/user/month is the polished default. Bitwarden Teams at $4/user/month is the budget pick (and the strongest in G2 Enterprise Grid 2026). Keeper Business is the compliance-bridge pick. Dashlane Omnix Enterprise is the AI-forward pick. Our dedicated Best Password Manager for Teams 2026 guide covers the team and enterprise tier landscape in depth, including the LastPass Business migration patterns and the 5-25-50-100-250 seat pricing matrix.

passkeys vs passwords in 2026: is this the end of the password manager?

Passkeys crossed the early-mainstream line in 2026. Microsoft began auto-enabling passkey profiles across Entra ID tenants in March. Google sign-ins with passkeys crossed 1 billion per month in late 2025. Apple defaulted new iCloud accounts to passkey sign-in. FIDO Alliance reports 69% of consumers now have at least one passkey, up from 39% two years earlier. The total count of passkeys in active use is 5 billion as of May 2026.

Does any of that mean the password manager is dying? No, but it’s changing. Two structural realities keep password managers in the picture for years to come. First, website passkey support is uneven. Microsoft’s own count is 48% of the top 100 websites support passkeys; the broader picture is roughly 20-25% of the top 1,000. That leaves the long tail of websites still on passwords. Second, the cross-device passkey experience still has real friction. Corbado’s Q1 2026 benchmark put hybrid-transport completion at 60-78% on Windows web and 66-86% on macOS web, and approximately 40% of passkey unlocks happen on a different OS than where the credential was originally created. Apple’s cross-device flow doesn’t copy the passkey to a Windows machine; it requires a fresh QR scan every time you sign in cross-OS.

The honest 2026 framing: passwords are not dying. Passkeys are becoming the default for new sign-ins on high-priority sites (banking, primary email, social platforms). Passwords still cover the long tail. A serious password manager in 2026 needs to handle both well, store passwords for the websites that still need them, store passkeys for the websites that support them, and sync cleanly across the user’s actual mix of devices. 1Password and Bitwarden are the best at this today, with Proton Pass close behind. Apple Passwords and Google Password Manager hold the largest passkey share but lock the user into a single ecosystem.

The vendor lock-in concern that came up in Hacker News thread #42465594 (“passkeys are primarily about vendor lock-in”) is partially right and partially wrong. Some relying parties use the WebAuthn authenticatorAttachment field to force platform-bound passkeys, which blocks third-party password managers from holding the credential. That’s the lock-in case, and it’s real. The counter-evidence in the same thread is also real: one practitioner showed cross-platform usage of passkeys “set in 1password, Bitwarden, Chrome, macOS, and Android”, demonstrating that the standard works portably when relying parties don’t force platform binding. Both stances hold up partially: passkey portability depends on relying-party choices, and a third-party password manager is what gives the user portability when the relying party allows it.

Migration map: switching between password managers in 2026

Switching password managers is conceptually simple, export from old, import into new, but the operational reality has more friction than vendors admit. Here’s the Migration Map for the six most common switching paths in 2026.

From LastPass to any modern password manager

The LastPass export path is the most-documented migration in the category. The official flow: LastPass web vault → Account Settings → Advanced → Export → save the CSV. Then in your destination tool, use the LastPass import option (every major PM has one explicitly). Average migration time for a typical 100-credential vault: 2-4 hours, mostly spent reviewing imports for accuracy and re-enrolling 2FA on critical accounts. Bitwarden publishes a dedicated LastPass Migration Kit with step-by-step instructions. Don’t forget to also export LastPass Authenticator TOTP codes separately, they don’t come with the password export.

From 1Password to Bitwarden or Apple passwords

1Password to Bitwarden: 1Password desktop → File → Export → 1pux format → save. Then Bitwarden → Tools → Import data → 1Password 1pux. The import preserves vault structure, tags, and notes. 1Password to Apple Passwords: 1Password export to CSV → import via Passwords app on macOS. Apple Passwords doesn’t preserve 1Password’s vault organization (it’s flat). Plan to spend an evening re-categorizing if your 1Password vault was heavily tagged.

From Bitwarden to 1Password

Bitwarden export → JSON or CSV → 1Password import. The 1Password import wizard handles Bitwarden’s nested folder structure cleanly. Plan 1-2 hours for a typical migration including 2FA re-enrollment on critical accounts.

From Dashlane to anywhere

Dashlane web vault → Settings → Export → choose CSV. Note: Dashlane CSV exports are flat with no folder structure preserved. If your Dashlane vault used many categories, plan extra time to re-organize in your destination tool. Bitwarden’s import handles Dashlane CSVs cleanly; 1Password’s import is also solid.

From KeePass / KeePassXC to a cloud-based pm

KeePassXC → File → Export → KeePassXC XML or CSV. Bitwarden handles KeePassXC XML imports natively. 1Password handles CSV. The big consideration: KeePassXC users frequently have very custom field schemas (one-off custom fields per entry) that don’t always survive a CSV roundtrip. Spot-check imports of unusual entries before deleting the source file.

From no password manager at all to your first one

Starting with browser-saved passwords (Chrome, Safari, Edge): each browser has an export option in Settings → Passwords. The export produces a CSV which any PM can import. The harder part is the credentials that aren’t in your browser, old saved-in-a-spreadsheet entries, sticky notes, screenshots, written-in-a-notebook backups. Plan a weekend to consolidate. The 30/60/90 roadmap below covers the systematic rollout.

The 30/60/90-day password manager onboarding plan

Adopting a password manager is structurally a behavior change, not a software install. Here’s the staged plan we recommend after researching what works for most households and small teams.

Days 1-30: install, capture the top 50, and learn the autofill rhythm

Install the password manager on every device you use daily. Set up the browser extension on every browser. Set up the mobile app. Set up the desktop client. Enable 2FA on the password manager itself, this is the most important account in your digital life now. Then capture the 50 accounts you use most often: email, banking, primary social platforms, work tools, streaming services, online shopping. Don’t bother with passwords you can’t remember or accounts you haven’t used in 18 months. The goal in the first month is learning the autofill rhythm, letting the password manager handle sign-ins so the workflow becomes automatic.

Days 31-60: audit weak and reused passwords, generate strong replacements

Every modern password manager has some version of a password health audit (1Password Watchtower, Bitwarden Reports, Proton Pass Pass Monitor, Dashlane Dark Web Monitoring). Run it. You will find that 20-40% of your top-50 passwords are either weak, reused, or compromised. For each one, generate a new strong password through the PM and reset it on the source service. This is the most tedious phase, plan 30-60 minutes a day for two weeks. The payoff is permanent: once you’ve migrated away from reused passwords, you don’t have to redo this work.

Days 61-90: long-tail capture, secure notes, and Passkey adoption

The accounts you use once a year (taxes, government portals, niche subscriptions) are still in the long tail. Capture them as you encounter them rather than trying to remember every account at once. Use Secure Notes for things that aren’t passwords but matter, software license keys, recovery codes, server SSH key passphrases, the Wi-Fi password your kid needs. For sites that support passkeys, opt in during this phase, banking, primary email, social platforms. By day 90, the password manager is the single source of truth for credentials and the autofill workflow is second nature.

7 mistakes to avoid when picking a password manager

After researching this category exhaustively, here are the seven mistakes we saw repeatedly in Reddit threads, forum posts, and our own pre-research instincts. Avoid them.

1. Picking based only on price. Bitwarden is the cheapest legitimate paid option after the Jan 2026 hike. Apple Passwords and Bitwarden Free are the cheapest free options. But the spread between the cheapest paid PM and the most expensive is roughly $40/year, small enough that picking based on UX fit, family-sharing reach, or passkey handling usually matters more.

2. Picking based on a single vendor’s marketing claim. Every password manager’s marketing page claims “military-grade encryption” and “zero-knowledge architecture.” Most of them do ship those things. The differentiators are recovery story, cross-platform polish, passkey handling, and how the vendor responds when researchers find issues. Marketing copy doesn’t tell you any of that.

3. Skipping the recovery setup. The single most common catastrophic failure mode is “I lost my master password and never set up emergency access.” Every modern PM has some version of this feature. Set it up in week 1. Print a recovery kit. Store it physically.

4. Confusing browser-built-in passwords with a real password manager. Chrome, Safari, and Edge all save passwords. None of them have cross-browser portability, family sharing, secure notes for non-password data, or proper 2FA support. Browser-saved passwords are floor, not ceiling.

5. Reusing a memorable master password. The master password protects every other password. Reusing a master password you used elsewhere defeats the purpose. Generate a passphrase you’ve never used anywhere, 5-7 random words from a Diceware list is the standard recommendation.

6. Storing 2FA recovery codes only inside the password manager. If you lose access to the password manager itself, the 2FA recovery codes are stuck there too. Keep a physical printout of recovery codes for your most critical accounts (primary email, banking, password manager itself) outside the vault.

7. Ignoring the ETH Zurich findings because they’re inconvenient. If you use Bitwarden, LastPass, or Dashlane, read the vendor’s response to the Feb 2026 paper. Bitwarden’s response is the most detailed (7 resolved + 3 design-choice + 2 under review). Use the information. Don’t pretend the research doesn’t exist.

Related BuyerSprint Articles

• Best Free Password Manager 2026: Bitwarden vs Proton Pass
• Passkey vs Password 2026: Cross-OS Reality and Vendor Lock-In Decoded
• Best Password Manager for iPhone 2026: Is iCloud Keychain Safe?

Frequently asked questions

What is the best password manager in 2026?

The best password manager in 2026 is 1Password for paying buyers and Bitwarden for free-tier users. 1Password earned the top PMAI score (91/100) with zero new attack vectors in the ETH Zurich Feb 2026 paper and the strongest cross-platform UX. Bitwarden is the #1 free password manager and the strongest open-source pick. Proton Pass is the best privacy-first option with 10 native email aliases free.

Is a password manager safe to use in 2026?

Yes, significantly safer than the alternative (reusing passwords, browser-saved passwords without 2FA, written passwords). Modern password managers use zero-knowledge architecture and strong key derivation so the vendor cannot decrypt your vault without your master password. The ETH Zurich Feb 2026 study did find specific attack vectors against three commercial PMs under a malicious-server threat model, but the disclosed issues are being resolved through normal security-engineering processes. The risk floor of a serious password manager is much lower than the risk floor of password reuse, which is the actual alternative most people are choosing between.

What does Reddit say about the best password manager?

The Reddit consensus across r/cybersecurity, r/PasswordManagers, and r/privacy in 2026 has remained stable: Bitwarden is the default free pick, 1Password is the recommendation when polish matters and budget allows, Proton Pass is the privacy-purist alternative, LastPass is the migrate-away pick, Apple Passwords is the new free pick for Apple-only households post the March 2026 1Password price hike, and KeePassXC is the choice for users who want fully local storage. This pattern has been steady since 2024 with Apple Passwords being the main recent addition.

How much does a password manager cost in 2026?

After the Q1 2026 hikes, paid password managers run from $17.88/year (NordPass intro) to $59.88/year (Dashlane Premium). 1Password Individual is $47.88 (up from $35.88 in March 2026). Bitwarden Premium is $19.80 (up from $9.99 in Jan 2026). Proton Pass Plus is $35.88. Apple Passwords is $0 but Apple-only. KeePassXC is $0 with donation suggested. The cheapest legitimate paid option is Bitwarden Premium; the cheapest free option for most platforms is Bitwarden Free; the cheapest free option for Apple-only households is Apple Passwords.

Should I switch from LastPass to something else?

Yes. LastPass has 7 documented ETH Zurich attack vectors, a January 2026 phishing campaign actively impersonating its support team, declining adoption (Ramp data shows -5%, steepest in the category), and the active $24.45M class-action settlement reaching its July 2, 2026 claim deadline. We don’t recommend LastPass for new buyers in 2026. Recommended destinations: Bitwarden (free) or 1Password (paid). See our full LastPass Alternatives 2026 guide for migration steps and settlement-claim instructions.

Is bitwarden’s Free tier really enough?

For most users, yes. Bitwarden Free includes unlimited passwords, unlimited devices, secure password sharing (Bitwarden Send), and a CLI. The features you don’t get on free: 1GB of encrypted file storage, emergency access, advanced 2FA options (YubiKey, Duo), and priority support. For a single user or a small household sharing credentials, the free tier covers the core use case. Premium ($19.80/year after Jan 2026) adds the depth that compliance-aware or sysadmin-heavy users need. See our Bitwarden Pricing guide for the full tier comparison.

What’s the difference between 1Password and Bitwarden?

1Password and Bitwarden are the two top picks in this roundup, and the choice between them comes down to four trade-offs. 1Password has the more polished cross-platform UX and zero new ETH Zurich findings, but it costs $47.88/year with no free tier. Bitwarden has unlimited free tier, open-source code, and self-hosting options, but the ETH Zurich paper documented 12 attack vectors against it, and the autofill UX is workmanlike rather than polished. If polish + paid is fine: 1Password. If free + open-source matters: Bitwarden. Both are credible. See our deeper 1Password vs Bitwarden comparison.

Are passkeys replacing passwords in 2026?

Passkeys are gaining serious adoption, 5 billion in active use as of May 2026, 1B+ Google passkey sign-ins per month, Microsoft auto-enabling passkey profiles across Entra ID tenants since March 2026. But only about 48% of the top 100 websites support passkeys, and cross-OS passkey sync still has 22-40% completion friction. The honest 2026 framing: passwords are not dying, passkeys are becoming the default for high-priority sites, and a good password manager handles both. 1Password and Bitwarden are the strongest passkey handlers among third-party PMs today.

Can I trust browser-built-in password managers (Chrome, Safari, Edge)?

Browser-built-in password managers are better than nothing but materially weaker than dedicated PMs. They lack cross-browser portability, family sharing, secure notes for non-password data, solid 2FA support, emergency access, and compliance-grade audit trails. Google Password Manager and Apple Passwords are the strongest browser-native picks and qualify as real password managers in their respective ecosystems. Chrome on Windows or Edge by itself is the floor, workable as a stopgap, not a long-term answer.

Is the Apple passwords app good enough?

For Apple-only households with moderate threat-model needs: yes. Apple Passwords ships native autofill, native passkey support, Family Sharing for credentials, and a Windows client via iCloud for Windows. The critical caveat: Apple Passwords does not implement zero-knowledge architecture, Apple holds the keys (encrypted at rest, Apple-decryptable in principle). For high-threat-model users (journalists, dissidents, compliance-heavy regulated industries), the absence of zero-knowledge is a hard disqualification. For ordinary household use inside Apple’s ecosystem, it’s a fair tradeoff for “free + native.”

What’s the most secure password manager for 2026?

“Most secure” depends on threat model. Against the ETH Zurich Feb 2026 paper’s malicious-server threat model, 1Password reported no new attack vectors (with the caveat that the researchers didn’t threat-model 1Password as exhaustively as the three studied vendors). For self-hosted control, Bitwarden self-hosted or KeePassXC let you eliminate the vendor’s cloud entirely. For privacy-jurisdiction posture, Proton Pass operates under Swiss data-protection law. There’s no single answer, pick the trust model that matches what you’re defending against.

Do password managers work on iPhone, Android, Mac, and Windows?

The major password managers all work across the four platforms with one exception: Apple Passwords has no native Android client. 1Password, Bitwarden, Proton Pass, NordPass, Dashlane, Keeper, and Roboform all support Windows, macOS, iOS, and Android (and most also Linux). Cross-OS passkey sync still has real friction, the Corbado Q1 2026 benchmark put hybrid-transport completion at 60-78% on Windows and 66-86% on macOS. For genuine multi-platform households, 1Password and Bitwarden are the safest defaults.

What happens to my passwords if my password manager company gets hacked?

Modern password managers use zero-knowledge architecture, which means even if the vendor’s servers are breached the attacker gets encrypted blobs they cannot decrypt without your master password. The LastPass 2022 breach is the canonical example, attackers exfiltrated encrypted vaults but had to brute-force the master passwords to access content. Users with strong master passwords (long passphrases, never reused) were largely protected; users with weak master passwords were compromised. The $24.45M LastPass settlement is the financial settlement for that breach. Picking a password manager with a strong recovery story and using a strong unique master password is the user-side defense.

How do I migrate from one password manager to another?

The universal pattern: export from old PM as CSV or PM-native format (1pux, kdbx, JSON), then import into new PM through its dedicated import wizard. Every major password manager has explicit import paths for the others. Plan 2-4 hours for a typical 100-credential migration including reviewing imports for accuracy and re-enrolling 2FA on critical accounts. Bitwarden publishes the most-detailed migration documentation; 1Password’s import wizard is the most polished. See the Migration Map section above for source-by-destination specifics.

What’s the best password manager for a small business or team?

For 5-15 users: 1Password Business ($7.99/user/month) or Bitwarden Teams ($4/user/month). For 15-100 users: 1Password Business (polished) or Bitwarden Enterprise ($6/user/month, open-source). For 100+ users in compliance-heavy contexts: Keeper Business or 1Password Enterprise. The full team and enterprise picture lives in our dedicated Best Password Manager for Teams 2026 guide with the per-seat pricing matrix at 10/25/50/100/250 seats and the SOC 2 / HIPAA / GDPR / FedRAMP compliance breakdown.