What actually matters in a password manager
Password managers are the rare purchase where the marketing matters less than the engineering — and where trusting the wrong signal is expensive. What our security-first evaluation prioritises:
Architecture determines worst-case outcomes
When a password manager is breached — and assume it can be — the design decides what attackers get. 1Password's Secret Key model means stolen server data alone cannot decrypt vaults; master-password-only designs depend entirely on your password strength and the vendor's key-stretching. Read the architecture, not the adjectives.
Breach response is the trust signal
Every vendor claims your trust; the ones that earned it show their work: rapid disclosure, technical post-mortems, published audits. The category's cautionary tales were made not by the breach but by the silence and minimisation after. We weight response history as heavily as the incident itself.
Passkeys change the job, not the need
As passkeys spread, the manager's role shifts from password vault to credential wallet — syncing passkeys across ecosystems that would rather keep you in theirs. Managers that embrace passkeys fully (all four we review do) future-proof your one security purchase for the next decade.
For business, offboarding is the hidden test
The moment an employee leaves is when a business vault earns its keep: instant revocation, transfer of work credentials, audit trail intact. Demo the leaver scenario before buying — it compresses every admin weakness into five minutes.
Compare password managers
Put these decision factors to work side by side.
How to choose a password manager
The practical buying guide for this category.
Password managers reviews
Scores and verdicts on individual products.
About our insights: editorial analysis drawn from our ongoing category research. Insights explain the market; scores and recommendations live in our reviews and comparisons.