How to choose a reliable password manager

Why you need a password manager at all

The most common cause of account takeovers isn't a sophisticated hacker — it's the same old reused password. If the same password is set on your email, a social network, and an online store, a data breach at any one of those services automatically opens the door to all the others. A password manager solves this simply: it generates a unique, complex password for every site and stores them encrypted, so the only thing you need to remember is one master password.

The main criterion: zero-knowledge architecture

Before comparing interfaces and prices, it's worth understanding how data storage works inside the service. Reliable password managers use a zero-knowledge model: all encryption happens locally on your device before the data is sent to the company's server. The encryption key is derived from your master password and is never transmitted to or stored by the service provider — which means that even if the company's servers are breached, the stolen data remains a useless block of encrypted bytes.

For encrypting the vault itself, the industry standard is AES-256, and the key derived from the master password should go through a brute-force-resistant algorithm such as Argon2id or PBKDF2 with a high iteration count — exactly the algorithms recommended for storing secrets by OWASP's Password Storage Cheat Sheet. If a vendor doesn't disclose which algorithm it uses, that's a reason to be wary.

Five more practical criteria

• Independent audits. Look for pentest reports or open-source client code — self-serving claims of "we're secure" don't prove anything.
• Two-factor authentication for the manager itself — a separate code or security key protects the vault even if your master password gets spotted or intercepted.
• Cross-platform and offline access. Your passwords should open on both phone and computer even without internet access — otherwise you could end up locked out of your own accounts at exactly the wrong moment.
• Data export. The ability to export passwords in a standard format protects you from being locked into one vendor forever.
• A transparent incident history. Don't focus on the claim "we've never been breached" — look instead at how the company disclosed incidents when they did happen, and what it changed in its architecture afterward.

The master password — the whole system's weakest link

No matter how strong the encryption is, everything rests on one master password. Current NIST SP 800-63B guidance shifts the focus from complexity to length: organizations are advised against requiring mandatory character mixing and scheduled forced password changes — the emphasis instead is on sufficient length and checking passwords against lists of known-compromised combinations. For a master password, in practice, this means the following.

1. Compose a phrase of four or five random, semantically unrelated words — at fifteen characters or more, it's far harder to brute-force than a short password with symbols and digits tacked on.
2. Don't reuse this password anywhere else — not for a single other service.
3. Turn on sign-in via a code from a separate app, not password alone — more on this in our article on two-factor authentication.
4. Save the official recovery code offline — on paper in a safe, or in a different manager — not in email or your phone's notes app.
5. Change your master password not "just in case, once a quarter," but when you suspect it's been compromised: forced rotation without a reason usually leads to weaker, more predictable passwords.

A quick checklist before signing up

These points can be checked in a few minutes on a service's website before you create a vault there.

• There's a public description of the encryption model: zero-knowledge, AES-256, and the algorithm used to derive the key from the master password.
• There are independent audit reports, or the client apps' source code is open.
• 2FA or a passkey is supported for signing into the manager account itself.
• There are apps for all your devices and an offline mode.
• There's a clear way to export your data in a standard format.

What about signing into your password manager over public Wi-Fi

Accessing your password vault from a café, airport, or hotel is a separate concern. The vault's own encryption protects your data even on an unsafe network, but an additional layer of protection for the connection itself reduces the risk that other data traveling over the same network gets intercepted along the way — more on this in our article on protecting your data on public Wi-Fi. For instance, the HamikVPN app encrypts the internet connection on your phone and computer, which can be handy in exactly this kind of situation on unfamiliar networks.