How to Choose a Password Manager: A Security Checklist
How to choose a password manager: pick one that works on all the devices you use, lets you control generated passwords, supports two-step verification on the manager itself, has a recovery option you understand, and that you will actually use. The UK NCSC's summary is that the best one is the one that best meets your needs and is easiest for you to use.
We deliberately do not rank products and have no affiliate links. This is a checklist you can apply to any candidate. Need to make a password first? Use the password generator.
Updated 3 November 2026
Why use one
CISA advises a different strong password for each account and describes a password manager as a program that generates, stores and fills in your passwords, and can flag weak or reused ones. NIST's authentication guidelines go further for service providers: verifiers shall allow password managers and autofill, and should permit pasting. In other words, using a manager is the behaviour the standard expects.
The checklist
Items marked (source) come from the guidance below; items marked (our judgement) are questions we think worth asking, not findings from those sources.
| Question | Why it matters |
|---|---|
| Does it work on every device and operating system you use? (NCSC) | A manager you cannot reach on your phone or work laptop gets bypassed. |
| Can you control generated passwords, such as length and characters? (NCSC) | Some sites restrict characters; you want strong output that still fits. |
| Can you protect the manager account with two-step verification? (NCSC) | The NCSC says that even if someone learns your primary password they cannot access the account. |
| Is the master password long? (CISA) | CISA: at least 16 characters, or a passphrase of 4 to 7 unrelated words. |
| What recovery options exist, and are you comfortable with them? (NCSC) | Hints or emergency access through trusted contacts exist in many products; know before you need it. |
| Does it warn you about breached or reused passwords? (NCSC, CISA) | Helpful extra; the NCSC lists breach notification as an optional feature. |
| Is it free or paid, and are the paid features worth it? (NCSC) | Browser-built-in options are free and fine on your own devices. |
| Does the vendor publish how your vault is encrypted and whether independent reviewers have audited it? (our judgement) | You are trusting the vendor with every password; look for documentation you can read. |
| What happened when the vendor had a security incident, and how did it communicate? (our judgement) | Transparency in a past incident is evidence about the next one. Check the vendor's own statements. |
| Can you export your data? (our judgement) | Avoid lock-in. |
Habits that matter more than the brand
- Use a unique password for every account (CISA).
- Turn on two-step verification for the manager and for important accounts such as email (NCSC).
- Do not save passwords in a browser on a shared device outside your home (NCSC).
- Keep the device, browser and manager updated; the NCSC says stored passwords are only as secure as your devices and accounts.
- Change any password found in a known breach, and stop using any password found in Pwned Passwords.
Organisations running their own sign-in should read the NIST rules: minimum 15 characters for single-factor passwords (8 where the password is only part of multi-factor), accept at least 64 where possible, impose no composition rules, no periodic forced changes, and check new passwords against a blocklist of common or compromised ones. See the password policy lab.
Last reviewed 3 November 2026. No vendor is endorsed or rated here.
Frequently asked questions
Are password managers safe?
The UK NCSC says a password manager stores passwords safely for you so you can use a unique password for every account, and that the built-in manager in a browser or operating system is fine on your own devices. It also notes stored passwords are only as secure as your devices and accounts, so keep them updated and protect the manager with two-step verification.
Which password manager is best?
We do not rank products. The NCSC’s answer is that the best one is the one that best meets your needs and that you find easiest to use. Use the checklist on this page to compare the candidates you are considering.
Is the browser’s built-in password manager good enough?
CISA notes that some password managers are free, such as built-in browser options, and the NCSC says the browser or operating system option is fine on your own devices. The NCSC advises never saving passwords on a shared device outside your home. Cross-device support and the extra features in the checklist may push you to a standalone manager.
How long should my master password be?
CISA advises at least 16 characters and suggests a random string or a passphrase of 4 to 7 unrelated words. NIST SP 800-63B-4 requires services to accept passwords of at least 15 characters when the password is the only factor, and to allow at least 64 characters where possible. Turn on two-step verification for the manager itself.
What if I forget my master password?
The NCSC says many managers offer recovery options such as password hints or emergency access through trusted contacts. Check what recovery your manager offers before you rely on it, because a design with no recovery means a lost master password can mean lost data.
Should I use passkeys instead?
Passkeys replace passwords on sites that support them. Many accounts still use passwords, so a manager remains useful for those. See our passkey guide for how they work.
Can I check whether a password I use has been breached?
Yes. Have I Been Pwned’s Pwned Passwords checks a password against known breaches while sending only the first five characters of its SHA-1 hash. A password found there should never be used. Some managers also notify you if a password is found in a breach, as the NCSC lists among optional features.
Sources
- NIST SP 800-63B-4, Digital Identity Guidelines: Authentication and Authenticator Management (final, 31 July 2025), section 3.1.1
- NIST CSRC: SP 800-63B-4 publication page, accessed 3 Nov 2026
- CISA Secure Our World: Use strong passwords, accessed 3 Nov 2026
- UK NCSC: Password managers, accessed 3 Nov 2026
- Have I Been Pwned: Pwned Passwords, accessed 3 Nov 2026