Password Managers

You have more accounts than you can count and probably one reused password holding most of them together. Reused password. One breach. Every account. That’s the domino. Here’s the fix.

The average person has 100+ online accounts. Remembering a unique, strong password for each is not a memory problem — it’s a math problem. The answer is software, not willpower.

Why You Need a Password Manager

Password reuse is one of the most common ways accounts get taken over. When one site gets breached, attackers don’t stop there — they try those credentials on every other service. Gmail. Your bank. Your work email. That’s called credential stuffing, and it works because most people reuse passwords.

A password manager:

• Generates unique, random passwords for every site
• Stores them encrypted behind a single master password
• Autofills credentials so you never have to remember them
• Alerts you when your credentials appear in known breaches

The master password is everything. Make it long, unique, and memorable. It’s the only password you need to remember.

How Password Managers Work

1. You create one master password to access the vault
2. The manager generates a unique random password for each site (e.g., K7#mPqX9!vLw2...)
3. Passwords are stored encrypted — the provider cannot read them
4. When you visit a site, the manager autofills your credentials
5. The vault syncs encrypted across your devices

Zero-knowledge architecture: A properly built password manager encrypts your vault locally before it ever leaves your device. Even if the company is breached, your passwords are unreadable without your master password. The company can’t hand over what they can’t read.

Keeper

Overview: Keeper is a zero-knowledge password manager with a strong security architecture. Used by businesses and individuals.

Key Features:

• Zero-knowledge encryption — Keeper cannot access your vault
• Secure password generator — generates and stores complex passwords
• KeeperFill — browser extension and mobile autofill
• BreachWatch — scans the dark web for your credentials (paid add-on)
• Secure file storage — store documents and files in the encrypted vault
• Two-factor authentication support (TOTP, SMS, hardware keys)
• Emergency access — designate a trusted person to access your vault
• KeeperChat — encrypted messaging (separate app)

Platforms: Windows, macOS, Linux, iOS, Android, browser extensions

1Password

Overview: Widely regarded as one of the best-designed password managers. Strong privacy, clean interface, and a unique feature set for travelers and teams.

Key Features:

• Zero-knowledge encryption
• Travel Mode — temporarily hide selected vaults when crossing borders; if your device is searched, hidden vaults don’t appear
• Watchtower — monitors for breached passwords, weak passwords, and unsecured sites (built-in, no extra cost)
• Masked email (with Fastmail integration) — creates alias emails from within 1Password
• Secure Notes — store sensitive notes alongside passwords
• Document storage — attach files to vault items
• Family and team plans — shared vaults with granular permissions
• Secret Key — an additional security layer unique to 1Password; required in addition to your master password to access your vault from a new device

Platforms: Windows, macOS, Linux, iOS, Android, browser extensions

Travel Mode is a real differentiator. If you cross borders with sensitive data, this matters.

Bitwarden

Overview: Open-source, making it the most transparent option. The code is publicly audited. Also the most affordable — the free tier is fully functional.

Key Features:

• Open source — publicly audited code; anyone can verify the security claims independently
• Zero-knowledge encryption
• Free tier includes unlimited passwords and devices — no limits
• Self-hosting option — run your own Bitwarden server for complete data control
• Bitwarden Send — securely share encrypted text or files with a time-limited link
• Two-factor authentication support (TOTP, hardware keys, email)
• Bitwarden Authenticator — separate TOTP authenticator app
• Password health reports (weak passwords, reused passwords, exposed passwords)

Platforms: Windows, macOS, Linux, iOS, Android, browser extensions, web vault

If you want open source and you want free: Bitwarden is the answer.

Proton Pass

Overview: From the makers of ProtonMail and ProtonVPN. End-to-end encrypted, open source, and tightly integrated with the Proton ecosystem. If you’re already in the Proton world, this is a no-brainer.

Key Features:

• Open source — code is publicly available and independently audited
• End-to-end encryption — zero-knowledge architecture, same standard as ProtonMail
• Built-in email aliasing (hide-my-email) — generate unique email aliases directly from the password manager; no third-party integration needed
• Proton ecosystem integration — works seamlessly with ProtonMail, ProtonVPN, Proton Drive, and Proton Calendar
• Free tier — unlimited passwords and devices
• Passkey support — store and use passkeys alongside traditional passwords
• Two-factor authentication support (TOTP, hardware keys)
• Secure password and passphrase generator
• Breach monitoring (Proton Sentinel on paid plans)

Platforms: Windows, macOS, Linux, iOS, Android, browser extensions

The email aliasing is a standout. Every new account gets a unique alias. If one gets leaked or spammed, you burn it — your real address stays clean.

KeePassXC

Overview: The local-first option. Open source, offline by default, no cloud anything. Your vault is a file on your machine. You control where it goes.

Key Features:

• Open source — community-maintained fork of KeePass with a modern interface
• Fully offline — no cloud sync, no account creation, no third-party servers
• Database is a local file — standard KDBX format; back it up however you want (USB drive, encrypted cloud folder, whatever)
• Browser integration — KeePassXC-Browser extension for autofill
• Strong password and passphrase generator
• TOTP support built in
• YubiKey / hardware key support — use a hardware key as an additional factor to unlock your vault
• SSH agent integration — use KeePassXC to manage SSH keys
• Cross-platform with consistent interface

Platforms: Windows, macOS, Linux, browser extension (KeePassXC-Browser). No official mobile app — use KeePassDX (Android) or Strongbox/KeePassium (iOS) with the same KDBX database file.

If you don’t trust any company with your passwords — not even an encrypted vault on someone else’s server — KeePassXC is the answer. The tradeoff: you’re responsible for your own backups and sync.

Password Manager Comparison

Cloud Sync vs. Local-Only

Not all password managers work the same way. The big divide: cloud-synced or local-only.

Cloud-synced (Keeper, 1Password, Bitwarden, Proton Pass):

• Vault syncs automatically across all your devices
• Seamless setup — install the app, log in, everything’s there
• Provider handles backups and availability
• Risk: if the provider gets breached, your encrypted vault is in someone else’s hands. The encryption better be solid, and your master password better be strong.

Local-only (KeePassXC):

• Your vault is a file on your machine. It never leaves unless you move it.
• No account creation, no third-party servers, no trust required
• You handle sync yourself — USB drive, Syncthing, encrypted cloud folder, whatever works
• Risk: if you lose the file and have no backup, your vault is gone. No “forgot password” button. No support ticket. Gone.

Both approaches use strong encryption. The question is who you trust more: a company’s infrastructure or your own discipline. Most people are better served by cloud sync. If you’re the kind of person who maintains backups and understands the tradeoff, local-only gives you full control.

Not All Password Managers Are Equal — The LastPass Breach

In 2022, LastPass suffered multiple breaches. Attackers got in through a compromised developer machine, accessed cloud storage, and walked away with encrypted customer vaults. The actual vault data — URLs, usernames, encrypted passwords — was stolen.

The encryption held for users with strong, long master passwords. But users with weak or short master passwords? Their vaults were brute-forced. Attackers cracked them and drained cryptocurrency wallets, among other things.

Key takeaways:

• Encrypted doesn’t mean invincible. Encryption buys time. A weak master password burns that time fast.
• Your master password strength is the last line of defense. If your vault is stolen, that master password is the only thing between an attacker and everything you own.
• Not every provider handles security the same way. LastPass stored vault metadata (URLs) unencrypted. 1Password, Bitwarden, and Proton Pass encrypt everything. Architecture matters.
• Zero-knowledge means nothing if the implementation is sloppy. Audit reports, open-source code, and breach response all matter.

This is why the recommendation isn’t just “use any password manager.” It’s “use a good one.”

Passkeys

Passkeys are the next step beyond passwords. Instead of a string you type, a passkey is a cryptographic credential tied to your device. No phishing. No reuse. Nothing to leak in a breach.

Several password managers now support storing and syncing passkeys:

• 1Password — full passkey support, cross-platform sync
• Bitwarden — passkey storage and autofill
• Dashlane — passkey support across devices
• Proton Pass — passkey storage integrated with the Proton ecosystem

Passkeys don’t replace your password manager — they live inside it. Your manager stores the passkey, syncs it across devices, and uses it to log you in. As more sites adopt passkeys, your password manager becomes even more important, not less.

Platform Coverage

A password manager that doesn’t work everywhere you do is a password manager you’ll stop using. All of the recommended options cover the essentials:

• Desktop: Windows, macOS, Linux
• Mobile: iOS, Android
• Browsers: Chrome, Firefox, Safari, Edge, Brave (via extensions)
• Web vault: Bitwarden and Proton Pass offer full-featured web vaults as a fallback

KeePassXC covers desktop and browsers natively. For mobile, use compatible apps: KeePassDX on Android, Strongbox or KeePassium on iOS. Same database format, same vault file.

Pick a manager that’s on every device you use. If it’s not convenient, you won’t use it — and the best security tool is the one you actually use.

Setting Up Your Master Password

Your master password is the one thing between everyone and everything:

• Minimum 16 characters — longer is stronger
• Passphrase format recommended: 4–6 random words (e.g., “correct-horse-battery-staple”) — easier to remember, harder to crack
• Never reuse it anywhere else — ever
• Write it down and store it in a physically secure location — losing your master password may mean losing access to everything in your vault

If it’s easy for you to remember, it’s easy for them too. Use a passphrase, not a word.

Using a good password manager is better than using none. Pick one, migrate your passwords today, and enable 2FA on the vault itself. Make sure your master password is long and unique — that’s your last line of defense if anything goes wrong. That’s the move. Do it this week, not eventually.