Paying for a password manager is optional. The free tiers of the well-known tools now cover what most people actually need: a vault that syncs between your laptop and phone, autofill that works, and encryption you don't have to think about. The trick is telling the generous free plans apart from the demos designed to push you into a subscription.
Two questions decide almost everything. Does the free plan let you stay logged in on more than one device? And can you export your data if you leave? Answer those, and the rest is preference.
What "free" means in practice
Free plans limit you in three ways, and they are not equally painful.
- Number of items. Usually the least painful. Most free tiers store unlimited logins; Dashlane's free plan caps you at 25 items, which sounds fine until you add email, banking, utilities, and streaming. Most people who count their logins are surprised to find 80 to 150 of them, not 20.
- Number of devices. This is the dealbreaker. A manager locked to one device is nearly useless, since half your logins happen on a phone. Picture standing at a pharmacy counter trying to reach an insurance portal on your phone while your vault sits on a laptop at home.
- Sync between devices. Some single-device plans also stop syncing entirely, so your laptop vault and phone vault drift apart. Save a new password on one and the other never learns it, which is how people lock themselves out of their own accounts.
Sharing, breach reports, file attachments, and built-in authenticator codes are almost always paid features. None of them is required to be safer than reusing the same password everywhere. A plain, unlimited, syncing vault is already a bigger security upgrade than almost anything else you can do in a single afternoon.
Bitwarden: the default recommendation
Bitwarden's free plan is the one to beat. Unlimited passwords, unlimited devices, apps for Windows, macOS, Linux, Android, and iOS, extensions for every mainstream browser, and a web vault. The code is open source and audited, and you can host it yourself if you want to.
The free tier also includes one shared vault with one other person, which covers couples splitting streaming accounts and household Wi-Fi passwords, plus passkey support. Behind the paid wall: the built-in authenticator for your logins' 2FA codes, password-health reports, and encrypted file attachments. Importing from almost any other manager is a few clicks, which matters if you're migrating from a browser's built-in store.
The interface is plain, and autofill setup on Android takes a few minutes of fiddling. That's the whole trade-off.
Proton Pass: the friendliest free tier
Proton Pass arrived later but ships a genuinely usable free plan: unlimited logins, unlimited devices, browser extensions, and clean mobile apps. It also generates email aliases, which help when a shop demands an address for a one-off purchase — you hand over shopname@passinbox.com instead of your real inbox, and if that shop gets breached or starts spamming, you switch the alias off. How many aliases you get depends on the plan.
If you already use other Proton services, the single login is convenient. If you don't, you're trusting a younger product than Bitwarden, and most sharing features sit behind the paid tier.
KeePassXC: no account, no company
KeePassXC takes the opposite approach. There's no server and no signup. Your vault is a single encrypted file on your disk, protected by a master password and optionally a key file. Sync it yourself with Syncthing, Nextcloud, or any cloud folder you already trust.
You get unlimited everything, forever, because there is no plan. You also get the responsibility: back up that file regularly, and don't sync it through a service that keeps dozens of old versions containing old passwords. Browser integration works but needs a native messaging setup beginners often find fussy. KeePassDX and KeePassium fill the gap on Android and iOS, reading the same file.
Whatever you choose, the rule is the same: the vault is only as strong as the master password, so make it long and unique.
The one-device free plans
Several well-marketed managers use free access as a sample. Dashlane's free tier stores 25 items on one device. NordPass and Keeper both limit free users to a single device, which defeats the point for anyone carrying a phone. 1Password has no free plan at all, only a trial.
If you work from one desktop and never log into anything elsewhere, those plans can work. Otherwise you'll hit the wall within a week and pay, which is a legitimate choice. Just make it deliberately, not by accident.
What about the manager already in your browser?
Chrome, Safari, Edge, and Firefox all store passwords for free, and if you're signed into a Google or Apple account they sync across your devices. For many people that's genuinely better than nothing, and it beats the habit it replaces: one password reused everywhere.
The catch is what the browser store doesn't do well. It's tied to one ecosystem, so an iPhone and a Windows laptop in the same house don't share a vault cleanly. Protection is often just your device PIN, with no separate master password. There's no secure sharing with a partner or colleague, no breach monitoring, no password-health check, and export options range from clunky to nonexistent. Use it as a starting point if you must, but treat it as a stepping stone rather than the destination.
Making the switch without losing anything
Moving vaults is less scary than it sounds, but the order matters.
- Install your new manager and set a strong, unique master password first.
- Export your current passwords as a CSV file from the old tool or browser.
- Import that file into the new vault and check that the item count matches.
- Delete the CSV file properly — empty the trash or recycle bin too. That export is plain, readable text.
- Keep the old vault around for a week or two as a safety net before deleting it.
Do this on a laptop, not a phone, and avoid doing it on public Wi-Fi.
A 20-minute setup you'll actually finish
Most people abandon setup because they try to fix everything at once. Do this instead, in one sitting:
- Install the manager and its browser extension, and enable autofill.
- Make the master password a long passphrase of four or five unrelated words. Write it on paper once and store that paper somewhere physically safe.
- Turn on two-factor authentication for the vault account itself.
- Change the passwords for your five most important accounts — primary email, banking, main social account, work login, and cloud storage — to generated ones.
- Leave the rest for later. Every time you log into something over the next month, update that password as you go.
That last habit is the whole trick. You don't need to fix 120 logins today; you need the five that would hurt most, then a routine that quietly improves the rest.
Encryption: what to check in five minutes
You don't need to read a cryptography paper. Look for these, and walk away from anything missing them.
- Zero-knowledge design. The provider should never see your master password or your plaintext vault.
- Strong key derivation. Argon2id is the modern choice; high-iteration PBKDF2 is acceptable.
- Modern ciphers. AES-256 or XChaCha20.
- Independent audits or a public codebase you can inspect.
- Export. If you can't export your vault, you don't own it.
Equally important: turn on two-factor authentication for the vault account itself. A strong vault behind a weak account login is a locked door with no wall.
Photo: khezez / خزاز
