Choosing a password manager: what actually matters

A password manager is only as trustworthy as its design, so the first thing to check is how your data is protected. Look for a zero-knowledge approach: your vault is encrypted on your device with a key derived from your master password, and the service stores only the encrypted data. If the company cannot read your passwords, a breach on its side is far less damaging.

Next, look for independent security audits and a public track record of fixing problems quickly. No product is free of bugs, but a team that publishes audit results and explains incidents clearly deserves more trust than one that stays silent.

Practical features matter as well. Autofill that matches the exact web address helps against phishing, because a fake page on a different domain simply gets no suggestion. Support for all your platforms, a working browser extension and a clear export option keep you from being locked in. Alerts for reused or leaked passwords are a useful extra.

The master password should be a long passphrase that you do not use anywhere else, and two-factor authentication should be on for the account itself. Store the recovery key or emergency kit offline, for example printed and kept in a safe place, because nobody can reset a zero-knowledge vault for you.

Finally, move over gradually. Start with your email, banking and work accounts, change those passwords to generated ones, and let the rest follow as you log in during normal use.