Everyone Needs a Password Manager
Authentication via password is a system designed to protect your online accounts from misuse by others, but half the time it seems to protect against your own access. Was that password Tr0b4dor&3? Or Tr0m30nE#8? You might be tempted to give up and just use the same simple password everywhere, but really, that’s a very bad idea. A hacker who finds your email address (whether in a data breach or a public post) can run a brute-force attack, trying thousands of common passwords, to break into your account. And if all your accounts use the same password, exposing one exposes them all. You need to use a unique, strong password for every site, and the only way to accomplish that is by using a password manager.
What’s that you say? You can’t afford to buy yet another security tool? In truth, you can’t afford not to. The potential hit, financial and otherwise, that could result from using weak passwords could cost you plenty. Never fear. Quite a few password managers cost precisely nothing, and some of them come close to the best paid password managers.
Your typical password manager integrates with the browser and captures the username and password when you log in to a secure site. Occasionally, you’ll find one that doesn’t automate password capture and replay, but these may have other virtues, such as filling in passwords for secure applications, not just webpages.
The best password managers capture your credentials during account creation; when you change your password online, they offer to update the stored password for that site. Of course, password capture only works if the password manager recognizes that you’re logging in to a secure site, so non-standard login pages can cause trouble. Some products cleverly solve this problem by letting you manually capture all data fields on a page. Others actively analyze popular secure sites whose login pages don’t fit the norm, creating scripts to handle each site’s oddball login process.
See Our Top Paid Password Managers
When you revisit a site for which you’ve saved credentials, most password managers automatically fill the saved data, offering a menu if you’ve saved more than one set of credentials. Another handy (and common) feature is a browser toolbar menu of available logins, so that with one click you can navigate to a site and log in. One great thing about free password managers is that you can try several and find out which one you like best. If you’re thinking of making such a survey, look for products that can import from other password managers. Otherwise, you’ll have to go through the password capture process over and over for each candidate.
The point of adding a password manager to your security arsenal is to replace your weak and duplicate passwords with strong, unguessable passwords. But where do you get those strong passwords? Most password managers can generate strong passwords for you; many let you take control of things like password length, and which character sets to use. The very best ones offer a password strength report that eases the process of identifying and fixing poor passwords. A very few can even automate the password-change process.
Filling in usernames and passwords automatically isn’t so different from filling other sorts of data in Web forms. Many commercial password managers take advantage of this similarity and thereby streamline the process of filling forms with personal data. Not many free password managers offer this feature.
When you put all of your passwords into one repository, you had better be really, really careful to protect that repository. Yes, your master password should be as strong as possible, but you really need two-factor authentication to foil any possible hack attack. Two-factor authentication could be biometric, requiring a fingerprint, facial recognition, or even voice recognition. Some password managers rely on Google Authenticator or apps that emulate Google Authenticator; others use an authentication code texted to your smartphone. Allowing access only from registered, trusted devices is yet another form of two-factor authentication.
Speaking of smartphones, many of us are just as likely to log into a secure site from a mobile device as from a desktop computer. If that describes you, look for a password manager that can sync your credentials between your desktop and the mobile devices that you use. Most password managers use encrypted cloud storage to sync between devices. A few keep your data entirely local, syncing between databases on different devices without keeping anything in the cloud.
In addition to using your passwords on multiple devices, you may find you want to share certain logins with other users. Not all free password managers support secure sharing; many of those that do allow you to share the login without making the password visible. A very few let you define an inheritor for your passwords, someone who will receive them in the event of your demise.
Free Editions of Paid Programs
If you’re willing to give up a little something, you can use many for-pay password managers for free. If you see a paid password manager with features you like, check out its conditions. You may be able to get it without paying. For example, some companies let you use all the features of their product for free if you give up syncing across multiple devices. RoboForm is one that’s free for use on a single device, no syncing. Dashlane, too—but it also imposes a limit of 50 passwords for free users.
Another common tactic is to let you use the product for free, but limit the number of passwords you can store. The limit for free usage tends to range between about five and 15 passwords. If you can stick to that, you needn’t pay. If not, the company will happily accept your payment for upgrading to the paid edition.
The Top Free Password Managers
LastPass and Myki Password Manager & Authenticator are our Editors’ Choice picks for free password management. LastPass has a feature set that goes way beyond most of its free competitors. Myki also boasts a wealth of features, and the fact that it stores your passwords locally rather than using the cloud is a huge plus for those worried about password security. If you’re concerned about security, you should also read our best antivirus and best VPN roundups.