How many online accounts do you have? A dozen? A hundred? Do you remember a hundred different strong passwords, or do you use the same simple password for all of them? Hackers routinely cross a list of weak passwords with a list of, say, PayPal accounts, trolling for matches. If they crack your account, you could lose big money. Worse, if you use the same password for other accounts, the hackers could take control of your email, social media, and financial accounts.
Using a unique, strong password for every site is essential, and the only way to do it is to enlist the help of a password manager. We’ve evaluated dozens of password managers to help you choose the one that suits you best.
THE PASSWORD BASICS
The typical password manager installs as a browser plugin to handle password capture and replay. When you log in to a secure site, it offers to save your credentials. When you return to that site, it offers to automatically fill in those credentials. And when you’ve saved multiple logins for the same site, the password manager offers you multiple account login options. Most also offer a browser toolbar menu of saved logins, so you can go straight to a saved site and log in automatically.
Some products detect password-change events and offer to update the existing record. Some even record your credentials during the process of signing up for a new secure website. On the flip side, a password manager that doesn’t include password capture and replay automation needs to offset that lack with significant other assets.
Getting all of your existing passwords into the password manager is a good first step. Next, you need to identify the weak and duplicate passwords and replace them with tough ones. Many password managers flag weak and duplicate passwords, and some offer help with the update process. The very best ones can automate the password-change process for you.
When you create a new secure account or update a weak password, you don’t want to strain your brain trying to come up with something strong and unique. Why bother? You don’t have to remember it. Nearly all of our top-rated products include a built-in password generator. Make sure your generated passwords are at least 16 characters long; too many products default to a shorter length.
Entering a password like @2a&AY8mePu8HU@H on your smartphone’s tiny keyboard can be tough. Fortunately, almost all of our top password managers can sync across all of your Windows, Mac, Android, and iOS devices. A few even let you authenticate on iOS or Android with your fingerprint or face rather than typing the master password. Most include some form of two-factor authentication, be it biometric, SMS-based, Google Authenticator, or something else entirely.
FILL FORMS AUTOMATICALLY
Since most password managers can auto-fill stored credentials, it’s just a small step for them to automatically fill in personal data on Web forms—first and last name, email address, phone number, and so on. Most of the top-rated products include a Web form-filling component. The breadth and flexibility of their personal data collections vary, as does their accuracy when matching Web form fields with their stored items. Even if they miss a field or two, the ones they do fill are ones you don’t have to type. Think about how many sites you go to that want all the same information; this feature is a huge time-saver.
Some websites offer to save your address, credit card details, and so on, for convenience. If you accept that offer, you’ve put your personal data at risk. Who knows if the site is storing your deets securely? Equifax certainly didn’t. Just let the password manager fill the form each time. It’s safer.
ADVANCED PASSWORD-MANAGEMENT FEATURES
Given that all these products take care of basic password management tasks, how can a product stand out from the pack? One handy advanced feature is managing passwords for applications in addition to websites. Another is provision of a secure browser, designed to protect sensitive transactions and invoked automatically when you visit a financial site.
On a grimmer note, what happens to your secure accounts after you die? A growing number of products include some provision for a digital legacy, a method to transfer your logins to a trusted individual in the event of your death or incapacity.
And finally, these top products let you sync your passwords across all of your devices. Some of them also include a built-in mechanism for securely sharing passwords with other users. Some let you share a login without making the password visible, some let you revoke sharing, and with some the sharing goes both ways—that is, if the recipient makes a change, it will change the original.
Dashlane
$39.99
EDITORS’ CHOICE
5/5 Stars
PROS: Standalone all-platform browser extension. Apps for PC, Mac, Android, iOS. Two-factor authentication. Password strength report. Automated password change. Secure sharing. Password inheritance. Captures online shopping receipts.
CONS: No special handling for nonstandard logins. Limited support for Internet Explorer.
BOTTOM LINE: The well designed and executed Dashlane makes smart password management a breeze. And its new standalone browser extension means you can use the service on just about any platform.
LastPass 4.0 Premium
$12.00
EDITORS’ CHOICE
5/5 Stars
PROS: Syncs passwords across all your devices. Powerful multifactor authentication. Automated password changing. Enhanced password sharing. Actionable security report. Password inheritance.
CONS: Default settings for password generator could be more secure.
BOTTOM LINE: LastPass 4.0 Premium builds on the excellent free version’s features, adding enhanced multifactor authentication, application password management, and password sharing groups.
LogMeOnce Password Management Suite Ultimate 5.2
$39.00
EDITORS’ CHOICE
4.5/5 Stars
PROS: Works on Windows, macOS, Linux, Android, and iOS. Extensive two-factor options including selfie-based and USB-based authentication. Anti-theft system can locate a lost device and remotely log out or wipe your data. Fills Web forms, including credit card data. Actionable password strength report.
CONS: SMS-based two-factor authentication can cost money. Some mobile features didn’t work quite right in testing. Massive feature set may overwhelm less-technical users.
BOTTOM LINE: With innovative features like selfie-based two-factor authentication and built-in anti-theft, LogMeOnce Password Management Suite Ultimate 5.2 is the most feature-rich password manager around.
Sticky Password Premium
$29.99
EDITORS’ CHOICE
4.5/5 Stars
PROS: Syncs across devices. Secure no-cloud Wi-Fi sync available. Captures even oddball logins. Manages application passwords. Online console manages trusted devices. Fingerprint authentication on mobile.
CONS: Report lists only the very weakest passwords. No online access to passwords. USB/Bluetooth authentication replaces master password, hence it’s not two-factor.
BOTTOM LINE: Sticky Password Premium does everything you’d expect from a password manager and more. If you choose the unusual no-cloud Wi-Fi sync, your passwords never leave your home networ.
Keeper Password Manager & Digital Vault 10
$29.99
4/5 Stars
PROS: Supports all platforms and common browsers, even Linux. Emphasizes two-factor authentication. Secure password sharing. Secure, synced storage for up to 10GB of files available.
CONS: Lacks some features found in competing products. No drag/drop for organizing passwords in folders. Password capture and replay not entirely automated.
BOTTOM LINE: Keeper Password Manager & Digital Vault 10 syncs your passwords and files across all platforms, and it’s built from the ground up with security as its main focus.
Password Boss Premium v2.0
$29.99
4/5 Stars
PROS: Syncs across all your Windows, iOS, and Android devices. Two-factor authentication. Secure sharing and password inheritance. Fills web forms. Password generator default length 20.
CONS: Lacks Mac support. No online access. Some configuration settings could be more flexible.
BOTTOM LINE: Password Boss Premium v2.0 handles all basic password management tasks and includes advanced features, such as secure sharing and password inheritance. It’s definitely worth a look.
