Password manager guide: what to check before you buy
A password manager makes unique passwords practical, but it is one part of account security, not a complete solution.
What a password manager does
It stores encrypted credentials and can generate and fill unique passwords, so one reused password does not unlock every account.
That is the whole of it, and it is worth being precise about, because the thing a password manager fixes is a specific problem: the same password on forty sites, one of which will eventually be breached. It is not a general security product and it does not need to be one to be worth having.
Do these first — they are free
None of this needs a subscription, and doing it before you buy anything means you will know what a product is actually adding.
- Turn on two-factor authentication for your email account. Email is the recovery route for almost everything else you own, so it is the account that decides how bad a bad day gets. An authenticator app is stronger than a text message, because a text can be redirected to a new SIM.
- Change the passwords that are reused on accounts that matter. Email first, then anything holding money or an address — banking, the shops that keep your card. Reuse is the actual vulnerability; length matters more than punctuation.
- Use the password manager already built into your browser or phone. Chrome, Safari, Firefox and both mobile platforms include one, they cost nothing, and they generate and sync unique passwords. For many households that is genuinely sufficient, and it is the honest baseline a paid product has to improve on.
- Check your account-recovery details. An old phone number or a dead secondary address on your email account is a locked door with the key left in it. This takes two minutes and is the step people skip.
If you do only the first and the third, you have closed most of the gap. A paid manager is worth considering after that, for the reasons in the next section — not instead of it.
What to compare
- Unique-password generation and breach-resistant storage.
- Device and browser support for the systems you actually use.
- Passkey support where services offer it.
- Recovery model: understand what happens if the account password or device is lost.
- Family sharing and administration for households; business controls and offboarding for teams.
- Renewal pricing, cancellation terms and what the plan includes after any introductory period.
Limitations and methodology
A password manager does not remove phishing, malware, account-recovery abuse or every account-security risk. We compare support, recovery, passkeys, practical coverage, renewal terms and limitations from current provider documentation; we do not treat a feature list as proof of universal security.
Related
- Public Wi-Fi check — work out how exposed you actually are on the network you are on, which is a different question from password security and is often the one people mean.
- Do you actually need a VPN? — the other product sold as general online safety, and when it does and does not help.
- What your broadband provider can see — what is actually visible about your browsing, without the marketing.
- How we work things out — what we compare, and what we will not claim.
Affiliate disclosure: Circle Utility may earn a commission if you purchase through a labelled link. This does not affect the price you pay or our comparison methodology.