How Password Managers Actually Work

Every reputable password manager runs on a zero-knowledge architecture. Your vault — the encrypted container holding all your credentials — is encrypted locally on your device before it ever reaches the company’s servers. The encryption key is derived from your master password, which the company never sees and never stores. Even if a provider’s servers were breached, attackers would only find encrypted data that’s useless without your master password. The gold standard encryption is AES-256, used by most providers here; NordPass uses XChaCha20 with Argon2id, which is newer and equally robust.

When you log into a website, the browser extension decrypts your vault locally and fills in your credentials. Nothing is transmitted in plaintext. The browser extension also detects phishing by verifying the actual domain — if you land on paypa1.com instead of paypal.com, the extension won’t autofill, which is one of the more underrated protections.

Passkeys are worth mentioning here. A passkey replaces your password entirely with public-key cryptography tied to your device’s biometric authentication — your fingerprint or face scan approves the login instead of a typed password. 1Password, Bitwarden, Dashlane, and NordPass all support passkey storage in 2026. The transition is gradual since thousands of sites still require traditional passwords, but any manager worth using today should handle both.

💡 Save this guide for later — switching password managers takes about 20 minutes, and this breakdown will help you pick the right one before you start.

Bitwarden — Best Free Option (and Best Value Overall)

Bitwarden’s free plan is the most generous in the category by a significant margin. Unlimited passwords, unlimited devices, cloud sync, browser extensions for Chrome, Firefox, Safari, and Edge, mobile apps for iOS and Android — all free, with no device cap. Most competitors restrict free users to a single device or a limited number of entries. For someone who just wants basic protection across all their devices without spending anything, Bitwarden’s free tier is the obvious answer.

The premium plan costs $10 per year — that’s 83 cents per month — and adds TOTP (two-factor authentication code) generation directly in the vault, encrypted file attachments up to 1 GB, vault health reports, and YubiKey support. Family plans covering six users are $40 per year. At these prices, Bitwarden is genuinely hard to argue against on value.

The trade-off is the interface. Bitwarden’s design is functional but utilitarian — it doesn’t hold your hand the way 1Password does. Vault organization requires more manual effort, and new users occasionally find the settings and two-factor setup less intuitive than competitors. The mobile app has improved considerably since 2024, but it’s still not as polished as NordPass or 1Password. Bitwarden is fully open-source, and its code is publicly auditable by anyone — which is a meaningful advantage for users who care about transparency.

1Password — Best for Families and Teams

1Password sits at the premium end of the market, but it justifies the price with the most polished experience and one of the most thoughtful security architectures available. Beyond AES-256 encryption, 1Password adds a unique 128-bit Secret Key that’s generated locally when you create your account and never stored on their servers. Your vault can only be decrypted with both your master password and this Secret Key — which means even if someone gets your master password through phishing, they still can’t access your vault without the key file. This two-factor approach to vault decryption is unique to 1Password.

Individual plans are $36 per year ($3/month). The Families plan costs $60 per year and covers up to five users — each member gets their own private vault plus access to shared family vaults for things like streaming account credentials and home Wi-Fi passwords. This shared-vault model is better implemented in 1Password than anywhere else, with granular permission controls for what each family member can see or edit.

The Watchtower feature continuously monitors your saved passwords against known data breach databases and flags weak, reused, or compromised entries with specific advice on what to fix. Travel Mode is a genuinely useful feature that lets you hide specific vaults when crossing borders — you temporarily remove sensitive credentials from your device with a single toggle and restore them once you’re through customs.

The limitation: 1Password has no free plan at all. There’s a 14-day trial, and that’s it. If you’re not ready to commit, start with Bitwarden and migrate later — vault exports are standard across all platforms.

NordPass — Best for Everyday Users Who Want Simple

NordPass takes the opposite design approach from Bitwarden — it’s built to be approachable for people who don’t want to think about settings. The interface is clean, vault entries are quick to create, and the app guides new users through setup without overwhelming them. It’s available on Windows, macOS, Linux, iOS, Android, and all major browsers, and its free plan allows one active device at a time — enough to test it before committing.

Premium costs $23.88 per year (roughly $2/month) and unlocks unlimited devices, dark web monitoring, emergency access, and 3 GB of encrypted file storage. The Family plan covers six users for $44.28 per year — one of the better family price points available. NordPass also includes email masking through SimpleLogin integration, which generates disposable email addresses so you don’t expose your real address when signing up for services.

On the security side, NordPass uses XChaCha20 encryption with Argon2id for key derivation, has never experienced a breach, and is independently audited and SOC 2 certified. The encryption choice is modern and considered more resistant to side-channel attacks than AES, though both are effectively unbreakable with current computing.

Where NordPass falls short: the password health reports are less detailed than 1Password’s Watchtower, and there’s no equivalent to 1Password’s Travel Mode or Bitwarden’s self-hosting option. It’s the right pick for users who want something that works without configuration — not the right pick for power users who want maximum control.

RoboForm — Best for Form Filling

RoboForm has been around since 1999 and has spent most of that time focused on one thing other managers treat as secondary: filling out web forms accurately. Most password managers fill username and password fields well. RoboForm fills complex multi-field forms — shipping addresses, credit card details, tax forms, checkout pages with custom field structures — more reliably than any competitor. If you regularly fill out detailed forms online, that specificity is worth a lot.

The premium plan comes in at roughly $0.99 per month (billed annually at $11.88/year), making it the cheapest paid option among established providers. It includes unlimited passwords, multi-device sync, secure sharing, emergency access, and local-only storage as an option — which means you can keep your vault entirely offline and never sync to any server if privacy is a priority.

The design is dated compared to NordPass or 1Password, and the mobile apps feel less refined. The security center is useful for identifying weak or reused passwords but isn’t as detailed as Watchtower. For pure password management without the form-filling use case, Bitwarden and NordPass offer more for similar or lower prices. RoboForm is the specialist choice.

Proton Pass — Best for Privacy-First Users

Proton Pass is built by the same Swiss company behind ProtonMail and ProtonVPN. If you’re already inside the Proton ecosystem, Proton Pass is a natural extension — it shares the same account and integrates with Proton’s suite of privacy tools. More broadly, Proton’s legal jurisdiction (Switzerland) means its data isn’t subject to EU or US surveillance laws in the same way, which matters to some users.

The free plan includes unlimited logins and notes across unlimited devices — no device cap, which is unusual among free tiers. Proton Pass Plus costs $47.88 per year standalone, though it’s included in any Proton Unlimited subscription ($107.88/year), which bundles ProtonMail, ProtonVPN, ProtonDrive, and ProtonCalendar. The built-in alias system generates unlimited email aliases that forward to your real address, helping you sign up for services without exposing your actual email.

Proton Pass is the newest of the major options and it shows — some interface features are less polished than established players, browser extension reliability has had occasional issues, and the vault health tools are less comprehensive. But it’s the only provider here with an open-source codebase, Swiss jurisdiction, and zero-knowledge encryption across an entire productivity suite. For users whose primary concern is minimizing surveillance exposure, that combination is unique.

For more on privacy-first app choices across platforms, the AI tools and privacy guide covers how to evaluate what data different services actually collect.

What About Google Password Manager and Apple Passwords?

Both are free, built in, and convenient — and both are real options for users who are already deep in those ecosystems. Apple Passwords (the standalone app introduced in iOS 18 / macOS Sequoia) has improved significantly and handles passkeys natively, syncs via iCloud Keychain with end-to-end encryption, and now includes a Windows app via iCloud for Windows. If you exclusively use Apple devices, it’s a legitimate choice.

Google Password Manager is more limited. It works smoothly within Chrome, but functionality outside Chrome is reduced, and the security is tied directly to your Google account — if your Google account is compromised, your passwords are too. It lacks the vault-separation that standalone managers offer.

The core limitation of both built-in options is ecosystem lock-in. Moving your passwords from Apple Passwords to Android, or from Google Password Manager to Safari, is far more painful than exporting a CSV from any of the dedicated managers above and importing it elsewhere. If there’s any chance you’ll switch platforms in the next few years, a dedicated manager is the more flexible investment.

Quick Comparison by Priority

Best free option: Bitwarden — unlimited devices, unlimited passwords, open-source, $0.
Best for families: 1Password Families ($60/year, up to 5 users) or NordPass Families ($44.28/year, up to 6 users).
Best for simplicity: NordPass — clean interface, fast setup, no configuration required.
Best for privacy: Proton Pass — Swiss jurisdiction, open-source, email alias system included.
Best for form filling: RoboForm — under $1/month, local storage option, most accurate form autofill.
Best for teams and enterprise: 1Password Teams ($19.95/month for up to 10 users) or Keeper Business ($4/user/month).
Best for Apple households: Apple Passwords — free, built-in, passkey-native, end-to-end encrypted via iCloud.

For software selection guidance beyond password managers, the essential software roundup covers the broader stack of tools worth having in 2026.

❤️ Bookmark this post to try these ideas later — setting up a password manager properly takes one sitting, and this guide has everything you need to do it right.

One Thing No Password Manager Fixes

A password manager protects you from reused and weak passwords. It doesn’t protect you if someone gets hold of your master password. That means the master password itself needs to be strong — a four-word passphrase you can remember is more secure than a complex string you write on a sticky note. It also means enabling two-factor authentication on your password manager account is non-negotiable. Every provider on this list supports authenticator apps (Google Authenticator, Authy, Ente Auth) and hardware security keys (YubiKey).

Additionally, set up emergency access or account recovery before you need it. Every major provider handles this differently — 1Password uses an Emergency Kit PDF you print and store, Bitwarden allows trusted emergency contacts, NordPass has account recovery options via email. Lose access to your master password with no recovery method set up and you lose your vault permanently. Spend five minutes on this when you set up the account.

The Bottom Line

If you don’t currently use a password manager, start with Bitwarden. It’s free, it’s open-source, it works on every platform, and it has no meaningful limitations for personal use. You can be set up and importing your existing passwords in under 20 minutes. If you try it and want something more polished — or you’re covering a family — 1Password at $3/month or NordPass at $2/month are both worth the cost.

The most important step is picking one and actually using it. Generating a unique 20-character password for every account and never reusing credentials is what the product exists for. Any of the options above does that reliably. The differences between them are about interface, extras, and price — not about whether your passwords are actually protected.

For the technical security standards behind password manager certifications, the FIDO Alliance passkeys documentation is the authoritative reference for understanding how modern passwordless authentication works alongside these tools.

📌 Don’t forget to save this post — if you’re helping someone else set up a password manager, this breakdown covers every common question they’ll have about which one to pick.