Most of us juggle dozens of accounts, and the honest way we handle that is by reusing two or three passwords. It works right up until it doesn't. The password on your email shows up in a breach at a forum you signed up to years ago, and suddenly the mailbox that can reset everything else is exposed.

A password manager fixes this: one passphrase you memorize, dozens of long random passwords you never have to. But "password manager" describes a wide range of designs, and the differences that matter most to a privacy-conscious beginner are usually not the ones the homepage leads with. Encryption, sync, recovery, and the privacy policy each shift the risk in a different direction. Here's how to weigh them.

Decide What You're Defending Against

Before features, name the threat. Are you mainly worried about credential stuffing after someone else's site gets breached? A stolen laptop? A shared computer at work? A partner or family member reading over your shoulder? Or a targeted attacker, a subpoena, or a border search?

Your answer changes the right pick. If you want a vault that never touches anyone's server, a local file-based manager such as KeePassXC is the clean answer. If you want autofill on a phone, a laptop, and a browser you don't own, cloud sync with zero-knowledge encryption is far more usable. Someone worried about a court order has a different priority than someone worried about forgetting passwords.

Encryption: The Parts Worth Checking

Almost every manager claims "military-grade encryption," which tells you nothing. What matters is whether the vault is encrypted on your device before anything leaves it, and whether the provider holds a key. Look for AES-256 or XChaCha20 for the vault itself, and Argon2id for turning your master password into a key, with PBKDF2 and a high iteration count as the older fallback. Open source clients are a real advantage here: outside reviewers can check the claims instead of taking them on faith.

The soft spot is never the cipher. It's your master password. A passphrase of four or five unrelated words beats a clever substitution of one word, and it should exist nowhere else. Then add two-factor authentication to the manager account itself, because the vault is only as secure as the login protecting it.

A vault is only as strong as the master password in front of it and the sync path behind it.

Questions to ask before trusting an encryption claim

• Is data encrypted on my device before it leaves, or on the server after it arrives?
• Which cipher protects the vault, and how is the key derived from my master password?
• Is the client open source, and has it been audited by an independent security firm?
• Can the company reset my password or recover my vault? If they can, so can anyone who compromises them.
• What happens if I forget the master password and lose my recovery kit?

Sync: Where the Vault Lives

Cloud sync is the reason password managers feel effortless. It also means your encrypted vault sits on someone else's disk. That's fine when encryption happens client-side, but it's worth knowing the shape of the arrangement. Some services sync through their own servers; others let you self-host; others leave you to sync a file through whatever you already use, like Syncthing or a cloud drive.

Test three things before committing. First, can you read your passwords with the network off? Second, does autofill work in the mobile apps you actually use, not just the demo? Third, what does a new device need in order to join the account, and can you approve or revoke devices yourself?

Recovery: The Section Nobody Reads Until It Matters

Two philosophies exist, and both are defensible. One camps says the provider should never be able to recover your vault, which means losing your master password means losing everything. The other offers emergency access, trusted contacts, or account recovery that can restore access.

Whichever you choose, do the boring work now:

• Print the recovery kit or emergency sheet and store it somewhere physical and private.
• Write the master passphrase by hand and keep it offline, not in a photo or a note on your phone.
• Check what your recovery email address is, and secure that inbox first — it is the reset path for everything else.
• If a family or emergency-access feature exists and you need it, set it up and actually test it.

If your threat model includes legal exposure or an employer's device policy, get advice from a lawyer familiar with your jurisdiction rather than trusting a general guide.

Read the Privacy Policy and Business Model

A password manager sits at the center of your digital life, so its incentives matter. Ask what the company logs: IP addresses, device data, telemetry, crash reports, payment records. Check where the servers are, whether the company publishes a transparency report, and how the product is funded. A free tier is fine if a paid tier or a foundation funds the work; it's a warning sign if your vault is the product.

Also check the export story. Can you export your vault in a standard format, such as CSV or JSON, without begging support? Being able to leave is what keeps your provider honest.

A Comparison Checklist You Can Run in an Afternoon

1. Start one trial at a time — two or three candidates, a week each.
2. Import a handful of logins, not your whole life, so a mistake stays small.
3. Test autofill on the sites you visit daily, including one with a weird login form.
4. Turn off Wi-Fi and confirm you can still open and edit the vault.
5. Export the vault and confirm the file opens somewhere else.
6. Read the privacy policy for ten minutes and note anything that surprises you.
7. Check the recovery flow before you have anything to recover.

Put It to Work This Week

Create your master passphrase, write it down on paper, and store it somewhere a burglar wouldn't look and a fire wouldn't reach. Turn on two-factor authentication. Import your browser's saved passwords once, then delete the exported file properly and stop letting the browser store new ones.

Don't try to change 90 passwords tonight. Do the high-value accounts first: email, banking, cloud storage, and anything with a saved card. Then replace a few logins each week, using generated passwords of 16 characters or more, and let the manager remember them. Within a month, the only password you'll know by heart is the one that matters most — and that's exactly the point.

Photo: Brett Jordan / Pexels