Password Manager Checklist

Choosing a Password Manager

Before choosing one, ask yourself:

1. Where will my passwords live?
   Cloud service, a file I manage myself, or something built into my devices?
   This determines who is responsible for storing and protecting the vault.

2. Can I get to my passwords when I need them?
   Can I use them across my devices? Can I retrieve and read a password when I'm using a computer that isn't mine?
   Convenience and accessibility matter because a system you can't use when you need it won't help you.

3. What happens if something goes wrong?
   How are the passwords protected? What happens if the provider is breached, my device is lost, or I lose access to my account?
   Look for strong encryption, MFA, and a recovery process you understand.

4. Can I get my passwords back out?
   Can I make a backup? Can I export my vault? Could I move to another password manager later?
   You don't want your choice to become a permanent commitment simply because leaving is difficult.

5. Does it fit the way I use technology, and the amount of responsibility I want to take on?
   How many devices do I use? Do I want automatic synchronization? Am I willing to manage backups myself? Am I willing to pay for convenience? Do I want passkey support?
   The right approach is one that fits your devices, your habits, and how much responsibility you want to take on.

Cloud-based password managers store an encrypted copy of your vault with a third party. If you are uncomfortable with that tradeoff, a file-based password manager may be a better choice.

When evaluating cloud-based services, look for end-to-end encryption and zero-knowledge architecture. These terms generally mean that your vault is encrypted before it leaves your device and that the provider cannot decrypt it without information known only to you, such as your master password.

Password Manager Decision Checklist

No single password manager is best for everyone. Every solution makes different tradeoffs between convenience, security, recovery, cost, and control.

Use these questions to help determine which approach fits your needs.

1. Where Will My Passwords Live?

Questions

• Cloud service?

• File I manage myself?

• Browser?

• Apple, Google, or another ecosystem?

• Who controls the storage?

Why it matters

This determines who is responsible for storing, synchronizing, backing up, and protecting your passwords.

What different answers mean

• Cloud services: Easier synchronization and recovery, but require trust in a provider.

• File-based managers: More control, but you are responsible for backups and recovery.

• Ecosystem managers: Convenient if most of your devices are within the same ecosystem.

• Browser managers: Easy to use, but closely tied to your browser account.

2. Can I Get to My Passwords When I Need Them?

Questions

• Can I access them from another computer?

• Can I view a password if autofill isn't available?

• What happens if my phone or laptop is lost?

• Can I recover access while traveling?

Why it matters

A password manager only helps if you can access your passwords when you need them.

What different answers mean

• Anywhere access: Convenient when devices are lost or unavailable.

• Device-dependent access: May offer more control but can make recovery harder.

• Good recovery options: Reduce the risk of being locked out of your own accounts.

3. What Happens if Something Goes Wrong?

Questions

• Is my vault encrypted before leaving my device?

• Can the provider read my passwords?

• What happens if the company suffers a breach?

• How is my vault protected from password-guessing attacks?

Why it matters

• No system is immune from mistakes, breaches, or device failures.

• What different answers mean

• Zero-knowledge encryption: The provider cannot normally decrypt your vault.

• Strong MFA and recovery options: Help protect against account compromise.

• Poor recovery procedures: Can be as risky as weak security.

4. Can I Get My Passwords Back Out?

Questions

• Can I create backups?

• Can I restore from them?

• Can I export my vault?

• Can I move to another password manager later?

Why it matters

• Technology changes. Companies change. Your needs change.

• What different answers mean

• Easy exports and imports: Give you flexibility.

• Backup options: Protect against mistakes and disasters.

• Vendor lock-in: May make switching difficult later.

• A password manager should not trap you.

5. Does It Fit the Way I Use Technology?

Questions

• Does it work on all my devices?

• Does it synchronize automatically?

• Does it support passkeys?

• Am I willing to manage backups myself?

• Am I willing to pay for convenience?

Why it matters

• The best security solution is often the one you'll actually use.

• What different answers mean

• Convenience-focused solutions: Less work, more automation.

• Self-managed solutions: More control, more responsibility.

• Passkey support: May become increasingly important as websites move beyond passwords.

Remember: "Supports passkeys" is not simply a yes-or-no feature.

Consider:

• Can passkeys sync across devices?

• Can they be recovered?

• Do they work on all the platforms you use?

Final Question: Will I Actually Use It?

This may be the most important question of all.

A theoretically perfect password manager that is inconvenient or difficult to maintain often leads people back to:

• Reusing passwords

• Weak passwords

• Storing passwords in unsafe places

• Avoiding MFA because it feels inconvenient

The best password manager is usually the one that:

• Works on all of your devices

• Fits naturally into your workflow

• Supports recovery when something goes wrong

• Helps you use unique passwords for every account

• Is easy enough that you'll use it consistently

If a password manager helps you create and use strong, unique passwords without making your life harder, it is probably the right choice for you.