A password manager is an encrypted vault that stores your logins, fills them in for you, and generates a unique random password for every account. You remember one master password. The software remembers the rest, and it encrypts everything on your device before anything leaves it.
That last part separates a real password manager from a notes app with a PIN. If the vendor’s servers were breached tomorrow, the attackers would get ciphertext they cannot read without your master password.
What happens when you save a login
When you save a password, the app encrypts it locally with a key derived from your master password. Bitwarden documents this as AES-256-CBC with HMAC-SHA256, and 1Password pairs your account password with a 128-bit Secret Key generated on your device.
The encrypted blob then syncs to the vendor’s cloud so your phone and laptop stay in step. The vendor stores it but cannot decrypt it. This is the zero-knowledge model, and every product in the table below except Google’s default setup works this way.
Video: Computerphile
Autofill is the other half of the job. The browser extension or mobile keyboard reads the domain you are on and only offers credentials saved for that exact site, which quietly kills most phishing pages before you notice anything is wrong.
That domain check is the main reason a dedicated tool beats a browser’s built-in password store for anyone who handles work logins alongside personal ones.
Four criteria that separate a good one from a weak one
Ignore the marketing. Four things decide whether a password manager protects you or simply stores your data somewhere else.
Encryption model. You want end-to-end encryption on by default, not as an option buried in settings. Google Password Manager encrypts your data, but you only take the key away from Google if you switch on its optional on-device encryption.
Breach monitoring. The good ones check your saved passwords against known leak databases and tell you which accounts to fix. Bitwarden runs its Data Breach report through Have I Been Pwned, and Apple Passwords has a Detect Compromised Passwords toggle that does the same job.
Sharing. A family or a small team needs a way to hand over a streaming login or the router password without pasting it into a chat. Look for shared vaults or groups with control over individual items.
Passkey support. Passkeys are replacing passwords on major sites, and your manager should store and sync them next to your logins. All five products in the table now do. If you are unsure whether passkeys, passwords or MFA deserve your attention first, the passkeys vs passwords vs MFA breakdown settles it.
How Bitwarden, 1Password, Proton Pass, Apple and Google compare
Every cell below comes from the vendor’s own documentation, checked at the time of writing.
| Feature | Bitwarden | 1Password | Proton Pass | Apple Passwords | Google Password Manager |
|---|---|---|---|---|---|
| End-to-end encryption | AES-256-CBC with HMAC-SHA256, on by default | AES-256 plus 128-bit Secret Key, on by default | AES-256-GCM vaults, on by default | 256-bit AES via iCloud Keychain, on by default | Optional, via on-device encryption |
| Breach monitoring | Data Breach report (Have I Been Pwned) free; Exposed Passwords report on premium | Watchtower | Dark Web Monitoring, paid plans only | Detect Compromised Passwords | Compromised password alerts |
| Family sharing | Families plan, up to 6 users | Families plan, up to 5 members | Pass Family, up to 6 users | Shared password groups (iOS 17 or later) | Share with your Google family group only |
| Passkey support | Save and autofill, plus passkey login to the vault | Yes | Yes, all devices, free plan included | Yes | Yes |
| Open source | Yes | No | Yes | No | No |
Two rows deserve a closer look. Proton Pass gives passkeys to free users on every device, while its dark web monitoring is a paid feature. Bitwarden does the reverse: the breach report is free, but the Exposed Passwords report that scans every login needs premium.
Which type suits you
If you live entirely inside Apple or Google hardware, the built-in option is fine for personal use, provided you turn on breach detection and, for Google, on-device encryption.
The moment you mix an iPhone with a Windows laptop, or share logins with family, a cross-platform tool wins. Bitwarden and Proton Pass are open source, which matters if you want outside researchers able to inspect the code. 1Password is closed source but publishes its security design in detail.
For a ranked view with pricing, the best password manager for security roundup puts the same products head to head. This guide is about knowing what you are buying before you pick one.
Three questions people ask before switching
What happens if I forget my master password?
With end-to-end encryption the vendor cannot reset it, because it never had your key. Most products let you set up an emergency contact or recovery method in advance. Do it on day one, since nobody can do it for you afterwards.
Is a password manager safer than the notes app on my phone?
Yes. Notes are usually not end-to-end encrypted, and they do not check the website domain before filling. A phishing page that copies your bank gets nothing from a password manager, because the saved login is bound to the real domain.
Can I move from one password manager to another?
All five export to CSV or a vendor format and import from the others. Delete the export file straight after the import, because it is plain text.
