Choosing a password manager is not a contest to find the longest feature list. The practical question is whether you can access everyday accounts, protect credentials and respond when a device or piece of information is lost. This guide connects selection with a usable plan, distinguishing tasks without offering a commercial product ranking. Provider documentation is used to illustrate differences, not to claim hands-on testing or recommend a subscription. Consult the documentation for your chosen product because interfaces and features can change. Never use a password published in a tutorial for a real account.
Start with your needs, not a product name
A password manager can generate and store distinct passwords, with features such as synchronisation and compromised-login warnings. The UK National Cyber Security Centre frames the choice around devices, usability, cost and required features. A high position in a generic ranking is therefore not enough. List the devices and browsers you need, and whether access is individual or shared, before checking compatibility. Avoid saving credentials in a public computer’s browser or on devices accessible to people you do not trust. The manager’s protection also depends on the device and account around it. National Cyber Security Centre
Give your primary password deliberate attention
The NCSC suggests combining random words into a memorable passphrase while avoiding names, dates and personal details that others can discover. Predictable character substitutions do not automatically make a predictable choice strong. Do not copy a password example from any article or tutorial. Create your own choice within the service’s requirements, without reusing another account’s password. If you need a written record, consider its storage and who can reach it as part of the decision. The aim is a secret you can use safely, not a puzzle you immediately forget. National Cyber Security Centre
Protect the email account used for recovery
The NCSC prioritises a strong, separate email password because access to email can help an attacker reach other accounts. Before moving credentials, review the recovery address associated with important services: do you still control it, and can you access it? Do not reuse the same password for email and your password vault. A separate record of which account depends on which recovery address can help, without placing the secrets in that record. This dependency map makes priorities visible before an incident rather than revealing them only when something goes wrong. National Cyber Security Centre
Enable additional verification and understand its use
Additional verification protects an account when its password is exposed, although available methods vary between services. The NCSC recommends enabling it for important accounts and consulting each provider’s instructions. Do not assume one application’s procedure applies verbatim to another. Use the official security settings and understand what a sign-in from a new device will require. Do not approve a verification request you did not initiate. Treat choosing a method and planning its recovery as separate tasks, and consult current service guidance rather than relying on memories of an old setup. National Cyber Security Centre
Check the results after importing
Google’s guidance notes that migration may not place every app or site name in the expected field, and suggests searching for a service when an imported entry is hard to find. It also instructs users to delete the password file and offers unsafe-password checks. Inspect the result rather than relying solely on a completion message. Start with a less sensitive account and check the username and website. Do not delete similar-looking entries at random. A successfully transferred record does not, by itself, demonstrate that its saved password still works. Google Help
Distinguish synchronisation from a vault export
Bitwarden offers plaintext and encrypted export formats and warns against sending an unencrypted export through insecure channels or retaining it after use. It also explains that adding a device to an existing cloud account does not require exporting: users can sign in with that account. This illustrates the distinction between accessing a service on another device and moving data outside it. Do not create a sensitive file unnecessarily when your provider documents another route. If an export is needed, understand its format, contents and import limitations before treating it as a complete recovery plan. Bitwarden
Emergency access is a trust decision
Bitwarden explains that a trusted contact requests emergency access; the account holder can approve or reject it, or access can be granted after the configured waiting period. This is a service-specific mechanism, not a feature guaranteed in every manager. Discuss when the contact should request access and how you will verify communication. Understand the permission being granted rather than accepting options blindly. Revisit the arrangement if trust or circumstances change. Merely listing a contact is not enough to declare recovery solved: understand the request, response and limits documented by the provider. Bitwarden
Leaving a sharing group does not undo earlier access
Apple warns that former sharing-group members may retain access to accounts previously shared, and recommends changing the passwords or passkeys for accounts you own when access should end. Removing a name is not the same as undoing earlier knowledge of credentials. Establish ownership and who may change shared account details before sharing them. When an arrangement ends, follow the account provider’s instructions as well as the group settings. An organisational change inside a password manager should not be assumed to revoke every route of access to the underlying service. Apple Support
Recovering a deleted entry is a different task
Apple documents a limited recovery window for deleted entries in its Passwords app, with options to restore a previously shared item to its group or recover it without sharing. Do not assume another application offers the same feature, or confuse it with recovering an account or forgotten primary password. Name the situation precisely: a deleted record, a lost device, or an inaccessible account. Different problems require different instructions. When restoring a shared item, inspect the sharing choice so that recovery does not unintentionally restore access you meant to end. Apple Support
Check that a backup contains what you need
The NCSC’s backup guidance emphasises separate storage and checking that important data is actually present, distinguishing cloud storage from removable media and advising disconnection when media is unused. Applied to password planning, do not assume a general device backup is sufficient: consult the manager’s instructions about what is included and how recovery works. Record where the instructions are and who can access them without placing passwords in the same document. A file labelled “backup” is not a recovery test. Establish what it contains and what is needed to open it. National Cyber Security Centre
A decision worksheet before migration
This is our suggested worksheet, not a security certification. Open a document containing no passwords and list the devices, browsers and people who use them. Add important services and account identifiers only where recording that information is appropriate for you. For each service, note whether you can reach its security settings, identify its recovery email and locate official support instructions. Mark unanswered questions as tasks rather than presumed successes. This makes selection depend on actual requirements instead of advertising impressions or search rankings, and leaves a clear record of what still needs checking.
Three hypothetical situations
Someone using a phone and computer within one ecosystem might first examine the built-in option available to them. Someone working across different systems needs to check behaviour on each device, not simply whether an application appears in an app store. A family sharing a particular account should distinguish account ownership, permission to use it and everyone’s unrelated private credentials. These examples do not establish that a particular product is superior. They describe different questions requiring different evidence. Write “not checked” beside anything you have neither read about nor tried, rather than turning an assumption into a fact.
Try a limited setup before extending it
We suggest starting with a less sensitive account that you can recover through its official process, and checking saving, searching and filling on your personal devices. Review the destination and username before submission. Do not use the exercise to sign in through a suspicious message merely because a page looks familiar. If behaviour is unclear, pause at that point and consult official support. The purpose is to discover confusing steps before adding important accounts, not to test resistance to attack or attempt access to anyone else’s accounts. Record the result without copying the secret into your evaluation notes.
Deciding whether setup is complete
Installing the application is not the endpoint. Ask whether you can explain signing in on your device, responding to an unexpected verification request, locating recovery guidance and identifying any export file that still requires deletion. For a shared account, establish ownership and the steps for ending sharing. This is an operational review to help you use the tool, not a guarantee against every attack. Revisit the plan when devices, recovery addresses or sharing arrangements change. Your requirements can change even while the application remains the same, so keep the evaluation tied to real use.
Sources and scope
The references attached to the sections are security guidance and product instructions, not reporting of a new breach or a laboratory comparison. Describing a feature does not establish its availability in every plan, country or device; check current terms before relying on it. We have not introduced unverified prices or protection percentages, or claimed an independent human review. The aim is a decision you can examine: understand what you chose, why it fits your circumstances and where to turn when those circumstances change.
