AdSense in-article ad (replace with your code)
Good security feels boring. The goal isn’t to memorize everything—it’s to never reuse passwords, add 2FA where it matters, and let passkeys log you in without drama. This guide shows exactly how to choose a password manager in 2025 and set it up for yourself, your family, or a small team.
How to choose a password manager in 2025
Ignore brand wars; focus on the security model and the daily experience. Your pick should:
- Use end-to-end encryption (E2EE) with a strong, local key derived from your master password or device secrets. Providers shouldn’t be able to read your vault.
- Support passkeys (FIDO2/WebAuthn) on desktop and mobile, with easy sync and backup.
- Offer seamless autofill in browsers and apps, with platform integrations for iOS and Android.
- Handle TOTP 2FA codes (optional) with clear export options so you’re not trapped.
- Provide secure sharing for families/teams, plus emergency access if you’re unavailable.
- Export cleanly (CSV/JSON/Encrypted) so migration later is simple.
Everything else—icons, themes, fancy dashboards—is secondary. Pick the one that feels obvious in your browser and phone, then actually stick with it.
Our recommended setup (works with any good manager)
- Create a strong master password: a 4-5 word passphrase beats complex gibberish you’ll forget. Example pattern: noun-verb-adjective-noun-year. Store a paper copy in a safe.
- Turn on account 2FA for the manager itself. Prefer security keys (hardware) or platform keys (Face ID/Touch ID + device secure enclave). Use TOTP only as a backup.
- Enable passkey sync/backup inside the manager or your OS keychain. This lets you sign in with a face/fingerprint and no password on many sites.
- Import existing logins from your browser or old manager. Clean as you go—merge duplicates, remove dead sites, label work vs personal.
- Autofill rules: keep autofill on, but disable “auto-submit” where it misfires. Add domain aliases for services that log in from multiple URLs.
- Create shared collections for household logins (streaming, utilities, kids’ school portal). Give each person the right level of access.
Passkeys in 2025: when to use them (and how they live with passwords)
Passkeys replace passwords on sites that support them. They’re phishing-resistant and sign in with your device’s biometric. You can:
- Create a passkey on sign-in pages that offer it (“Use a passkey”). Your manager or OS will save it to your synced keychain.
- Keep the old password for now if the site still asks for it in some flows. Over time, many sites shift fully to passkeys.
- Back up passkeys via your manager or platform account so losing a phone doesn’t lock you out.
If you share an account, check whether your manager supports shared passkeys. If not, create individual logins for each person when possible (best practice anyway).
About TOTP 2FA codes inside your manager
There are two camps: keep TOTP codes in your password manager for convenience, or keep them in a separate authenticator for extra separation of risk. Our stance:
- Individuals: storing TOTP in the manager is fine and reduces “where is my code?” friction. Ensure you have recovery methods (backup codes or a second device).
- Admins & high-risk roles: keep TOTP on a separate device or hardware key for critical accounts (email, domain registrar, financial).
Whichever you choose, confirm you can export TOTP later (QR codes/secret keys). Avoid lock-in.
Import & migrate without chaos
- Export from the old place (browser or manager) to an encrypted file if available. If CSV is the only option, keep it offline and delete after import.
- Map fields (URL, username, password, notes, TOTP secret). Most managers auto-detect common formats.
- Deduplicate: merge exact duplicates; keep the newest password. Tag entries you’ll rotate later.
- Test logins for banking, email, cloud storage first—your critical path.
- Shred the export (secure delete) once you verify the vault.
Families & small teams: tidy sharing that won’t backfire
- Collections/vaults per theme (Home, Finance, Travel, Streaming). Give kids read-only where appropriate.
- Onboarding checklist: install apps, enable autofill, add each person’s recovery method, share the Wi-Fi pass, and a “break glass” contact.
- Offboarding flow (teams): move credentials to a shared vault, rotate passwords, revoke departing access, and audit recent activity.
Emergency access & recovery
“What if I lose my phone?” or “What if I’m unavailable?” Solve it now:
- Emergency contact: designate a trusted person who can request access to a specific vault after a waiting period.
- Recovery kit: print master password hint, recovery codes, and security key instructions. Seal it in a safe.
- Secondary device: sign in and enable autofill on a backup phone/tablet. If one device dies, you still have access.
Security model basics (plain English)
- Zero-knowledge vault: your master password never leaves your devices; the provider stores only encrypted blobs.
- Device secrets: on iOS/Android, biometric unlock can decrypt a locally stored key; this is why Face ID/Touch ID feels instant.
- Security keys: physical keys (USB-C/NFC) prove you are you without a code that can be phished.
No manager is magic. Phishing still works if you type credentials into a fake site. Use domain matching and never follow login links from email—open the site directly.
Monthly 10-minute routine (copy this)
- Open your manager’s security report: fix weak/reused passwords and enable 2FA where missing.
- Rotate any shared passwords you gave to guests/contractors.
- Review vault members (family/team): remove anyone who no longer needs access.
- Export a backup (encrypted) to your external drive or secure cloud folder. Keep at least one offline copy.
When a service you use gets breached
- Don’t panic; change the password immediately through the site (not email links), then update it in your vault.
- Enable/refresh 2FA. If codes were exposed (rare), re-enroll TOTP or switch to a security key.
- If it’s your email provider, also check forwarding rules and recovery addresses for tampering.
FAQ
Q: Do I still need a password manager if I use passkeys?
A: Yes, for all the sites that haven’t switched yet and for storing secure notes, IDs, and payment data. Your manager also helps back up and sync passkeys.
Q: Is iCloud/Google/Microsoft’s built-in manager enough?
A: For single-ecosystem users, maybe. But dedicated managers usually offer better cross-platform support, sharing, auditing, and export options.
Q: Should I store my bank TOTP in the same manager?
A: If convenience is key, yes—with strong device security. For maximum separation, keep bank TOTPs on a separate authenticator or a hardware key.
Q: What about browser-saved passwords?
A: Export and move them into your manager, then disable the browser’s saver to avoid duplicates and confusion.
