Using a different, strong password for every important account is one of the simplest ways to improve your online security. The difficulty is remembering them all. A password manager can create, store and fill in passwords for you, but different options offer different levels of convenience and control.
This guide explains how to choose a password manager for Windows, Android, iPhone, Mac and other devices. It compares browser-based storage, dedicated password managers and passkeys, then highlights the features that matter most for everyday use.
Decide what you need first
Before comparing products, consider how you use your accounts:
- Do you use Windows alongside an Android phone, iPhone, Mac or tablet?
- Do you need to share passwords with family members?
- Do you want to store only passwords, or also passkeys, payment cards, notes and identity details?
- Would you be comfortable relying on one master password to unlock your vault?
- Do you need access when travelling or when an internet connection is unavailable?
The best choice is usually the one that works reliably on every device you use. A highly secure tool that you avoid because it is awkward is less useful than a well-designed option you use consistently.
Understand the main choices
Browser-based password storage
Web browsers such as Microsoft Edge, Google Chrome, Firefox and Safari can save passwords and synchronise them between signed-in devices. This is convenient and may be sufficient if you mainly use one browser ecosystem.
Browser storage usually provides password generation, autofill and basic security checks. It may also support passkeys. However, features for sharing, organising information, importing data and using multiple browsers can be more limited than in a dedicated manager.
Choose browser storage when you want a simple, low-maintenance solution and normally use the same browser on your devices.
Dedicated password managers
A dedicated password manager normally provides apps and browser extensions for several platforms. It stores an encrypted vault containing passwords and may also support passkeys, secure notes, payment details, recovery codes and document information.
Common advantages include better organisation, support for multiple browsers, secure sharing and more detailed auditing. Some services use a subscription, while others offer free plans or self-hosted options.
Choose a dedicated manager if you use several types of device, need more control, or want features such as family sharing and secure storage for information beyond passwords.
Passkeys
Passkeys are a newer way to sign in without typing a traditional password. They use public-key cryptography and are normally unlocked with your device PIN, fingerprint or face recognition. The private part of a passkey remains protected on your device or within a trusted synchronisation system.
Passkeys can resist many phishing attacks because they are tied to the correct website or app. They are not yet supported everywhere, so you will still need passwords for many accounts. A password manager that supports passkeys can help you keep them available across compatible devices.
Passkeys complement password managers rather than replacing every password immediately. Use them where reputable services offer them, while keeping a secure recovery method for your account.
Features that matter when choosing a manager
Encryption and account design
Look for clear information about how your vault is encrypted, both on your device and while it is being synchronised. A zero-knowledge design generally means the provider is not intended to have the information needed to read your vault, although the exact technical implementation varies.
Read the provider's documentation rather than relying only on a slogan. Check whether encryption happens before data leaves your device, how the master password is used, and whether independent security audits or transparent technical documentation are available.
Your master password is especially important. Make it long, unique and memorable. Never reuse it elsewhere, and do not store it in an unprotected text file.
Multi-device support
Check that the service has official support for the platforms you actually use, including:
- Windows app or browser extensions
- Android and iOS apps
- macOS or Linux, if required
- Your preferred browsers
Also check whether the plan limits the number of devices, browsers or users. A manager that synchronises only through one browser may be inconvenient if you regularly switch between Edge, Chrome or Firefox.
Reliable autofill
Autofill should recognise normal sign-in forms without filling sensitive details into the wrong website. Test it on a few sites before moving your entire collection.
Good managers let you review the website address before filling in a password, create strong passwords automatically and avoid offering credentials on lookalike domains. On mobile devices, you may need to enable the manager as an autofill provider in the system settings.
Import and export options
Moving from a browser or another manager should be straightforward. Look for supported import formats and clear instructions. An export option is also important if you later decide to change provider.
Exports are usually unencrypted files. Create one only when necessary, save it temporarily in a secure location, and delete it securely after confirming that the import worked. Do not email an unencrypted vault or leave it in a shared downloads folder.
Recovery and emergency access
Encryption protects your vault, but it can also mean that the provider cannot recover it if you lose your master password. Before committing, understand the recovery process.
Check whether the service offers recovery codes, a recovery key, trusted contacts, emergency access or account recovery through a family plan. These features can be useful, but they must be configured carefully and protected from unauthorised access.
Store recovery information somewhere safe, such as a locked physical location or a separate secure system. Do not keep the only copy inside the vault that it is meant to recover.
Sharing and family features
If you share accounts with relatives, look for shared vaults that let you control which items each person can see. Avoid sending passwords through ordinary email, messaging apps or shared documents.
Check whether sharing gives the recipient access to the current password without exposing unrelated entries, and whether you can revoke access promptly when circumstances change.
Security alerts and auditing
Useful tools may warn you about reused, weak or exposed passwords. These checks are helpful, but treat them as guidance rather than proof that an account is completely safe.
Prioritise important accounts first: email, banking, shopping, social media, cloud storage and your main device account. Change reused passwords, enable multi-factor authentication and review old accounts that you no longer need.
Browser storage versus a dedicated manager
| Feature | Browser storage | Dedicated manager |
|---|---|---|
| Setup | Usually quick if you already use the browser | Requires installing an app or extension and creating a vault |
| Multiple browsers | May be less convenient | Usually supported |
| Secure notes and extra records | Often limited | Usually more flexible |
| Sharing | May be basic or unavailable | Often includes controlled sharing |
| Portability | Closely tied to the browser account | Usually designed for several platforms |
| Cost | Often included with the browser service | May require a paid plan for advanced features |
Neither option is automatically right for everyone. If your accounts, devices and browser all belong to one ecosystem, browser storage may be perfectly practical. If you use several platforms or want stronger organisation and sharing tools, a dedicated manager is usually more suitable.
How to choose and set up a manager
- List your devices and browsers. Confirm that the provider supports each one and check any device limits.
- Read the security and recovery documentation. Make sure you understand encryption, account recovery and what happens if you lose access.
- Check the pricing and restrictions. Look for limits on devices, storage, sharing and passkeys rather than comparing only the headline price.
- Create a strong master password. Use a long phrase that is unique to the manager.
- Enable multi-factor authentication. Prefer an authenticator app or hardware security key where available. Store backup codes safely.
- Import carefully. Check the imported entries, then remove temporary unencrypted export files.
- Replace reused passwords. Start with your email account and other accounts that can reset access to many services.
- Turn on passkeys where supported. Use the manager or device system that you trust, and keep account recovery details available.
- Test access on another device. Confirm that synchronisation, autofill and recovery work before relying on the manager.
Common mistakes to avoid
- Using the same master password as your email or another online account
- Installing unofficial browser extensions or fake password manager apps
- Saving an unencrypted vault export permanently on the desktop
- Ignoring recovery codes until after losing access
- Assuming a security alert means every account has been compromised
- Sharing one family login instead of using controlled vault sharing
- Approving unexpected sign-in or autofill prompts
Troubleshooting common problems
Autofill does not appear
Make sure the official extension is installed and enabled, then check the browser's password and autofill settings. On Windows, update the browser and manager app. On Android or iPhone, confirm that the manager is selected as the system autofill provider.
Passwords do not synchronise
Check that you are signed into the same account on each device and that synchronisation is enabled. Verify the internet connection, update the apps and check whether the service is experiencing an outage. Do not repeatedly create duplicate entries until you know which device contains the latest version.
A website rejects an automatically generated password
Some websites impose unusual length or character rules. Generate a password that follows the site's requirements, then save it in the manager. If autofill enters the wrong value, use the manager's entry search rather than copying credentials from an unprotected note.
Safety checklist
- Use a unique, long master password.
- Protect the account with multi-factor authentication.
- Install software only from the provider's official website or your device's approved app store.
- Keep Windows, browsers and mobile devices updated.
- Review shared access and connected devices periodically.
- Store recovery information separately from the vault.
- Never disclose your master password to support staff, friends or anyone contacting you unexpectedly.
Conclusion
When learning how to choose a password manager, focus on the complete experience rather than a long feature list. Browser storage is convenient for people who stay within one ecosystem, while a dedicated manager is often better for multi-device users, families and anyone who needs secure notes or controlled sharing. Passkeys provide a strong passwordless option where available.
Whichever route you choose, use a unique master password, enable multi-factor authentication, plan for recovery and test access on your main devices. Those practical habits matter as much as the name of the product.