ExpressKeys – formerly known as ExpressVPN Keys – is the simple and secure password manager from one of the best VPNs, ExpressVPN.

Like many of the best password managers, ExpressKeys enables you to generate and store secure, complex passwords, alongside logins, notes, and credit card information.

Previously, ExpressKeys was part of the ExpressVPN app, but it now has its own standalone app, making up part of ExpressVPN's new privacy suite. ExpressKeys access comes bundled with ExpressVPN Advanced and Pro, with plans starting from $3.59 per month.

Historically, you could continue using ExpressKeys even after your ExpressVPN subscription had expired, freely adding and generating passwords, at no extra cost. But ExpressVPN has recently changed this. While legacy ExpressVPN users can still access their stored information, nothing new can be added – rendering ExpressKeys somewhat useless unless you reactivate your subscription.

If you're one of these legacy users, you might want to export your passwords and switch to another passwords manager – here's how.

Setting up

You can export your ExpressKeys passwords using both its mobile app and desktop browser extension. ExpressKeys offers a smoother, more intuitive experience on mobile devices, and that's where I typically access my login details.

However, I found the export/import process was easier to achieve via desktop, and I'll explain why further down.

ExpressKeys allows you to store passwords, logins, secure notes, credit cards, and authenticators – all these details can be exported.

Before doing anything, make sure you're logged into your ExpressKeys app. You may be asked to enter your vault password – you'll also need this later, so make sure you have it to hand. If you don't, you'll need to contact ExpressVPN support.

Ensure you have all the details you want to export, and ideally, have an alternative password manager ready to import them into.

Although you can do both, I'd recommend exporting via desktop, especially if you're going to be importing your data into another password manager. The exporting process is actually more secure on mobile. But when importing, you're often prompted to do this via a web page, making desktop far easier.

Exporting via mobile

Opening your ExpressKeys app on mobile brings up your dashboard. Here you'll see an overview of all your stored information.

First, select the Account icon in the top right of the screen – it looks like a person. This will bring up your account information. Scroll down to Password Manager Settings and click Export your Data.

You'll be asked to enter your vault password, so make sure you have that handy. If you've lost it, you'll have to contact ExpressVPN support before proceeding.

After entering your vault password, you'll see a message telling you your data will be exported as an encrypted ZIP file.

You'll then be prompted to create a password for this file, and you'll need to enter it to access your data.

It's important to enter a secure password as, once unlocked, all your exported data will be visible. Once you've created and entered your password, you'll have the option to choose the export destination – I exported my data to Files on iPhone.

Once exported, you can navigate to your chosen destination, enter your password, and view your exported data.

From here, you can either leave the data as it is, or import it to another password manager. I'll talk you through how to import your data into another password manager later on.

Exporting via desktop

Although ExpressKeys is a mobile-first app, it has a browser extension too. If you don't already have this installed, head to the Chrome Store and install it. You'll have to enter your login details to access your vault.

Exporting via desktop is a similar process to mobile. Once logged in, you'll be greeted by a dashboard which lists all your login details.

To start exporting, click the Options tab in the top right, then click Settings. In Settings, scroll down to Data, and click Export data as CSV.

You'll be asked to enter your primary password – this should be the same as your vault password on mobile. Once entered, you'll be able to export your data by clicking Export Password Data.

Unlike mobile, you're not prompted to enter a password to protect this data, and it doesn't appear to be encrypted as standard. You should therefore be extra vigilant over where you're exporting the file and who might be able to access it – we wouldn't recommend exporting passwords on a shared or work computer.

After clicking export, and choosing your destination, you should receive a message saying your password data was exported successfully.

Like mobile, the file will contain all your details in full, meaning they can be read by anyone. So take extra care when opening it.

Importing to another password manager

If you've gone to the trouble of exporting your data from ExpressKeys, you'll likely want to import it to another password manager.

There are plenty of good options out there, but for this example we're looking at two password managers linked to two of the best VPNs – Proton Pass and NordPass, from the teams behind Proton VPN and NordVPN respectively.

I opened the mobile apps of both password managers, navigated to settings, and selected the option to import my data. However, I found that both prompted me to use a web page to import my data, and I couldn't easily import via mobile.

This was a slight pain and is the main reason I'd recommend exporting via desktop.

NordPass is included in NordVPN Plus plans and above, with prices starting at $3.59 per month. It's also available as a standalone plan. Proton Pass comes as part of the Proton Unlimited plan, which costs $9.99 per month and also includes Proton VPN. It's available as a standalone plan, and you can access a limited version for free.

With NordPass, once logged in, you'll see a range of options to add password data. Alongside creating details from scratch, you can import from a browser, password manager, or spreadsheet.

To import your CSV file, click Import from spreadsheet. You can then select the file and click import.

However, when importing my data, NordPass only imported my email and password, not my secure note or credit card information. The app supports both secure notes and credit cards, so I'm not sure why these didn't transfer over as well. In contrast, Proton Pass allowed me to import all three pieces of data.

After importing, my data was stored in both apps and ready to access.

Despite a few quirks, exporting your password data from ExpressKeys, and importing it to another password manager, is a relatively easy process. Exporting via mobile is more secure, but exporting via desktop makes importing more straightforward.

No matter which app you choose, we recommend signing up to an alternative password manager if you're a legacy ExpressKeys user – or resubscribing to ExpressVPN. Having secure complex passwords is crucial for protecting your accounts and data, and using a password manager allows you to generate and store your information with ease.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

Weak passwords open the door for hackers to gain access to your accounts. One of the biggest problems comes when staff members reuse their personal passwords for business accounts, but there are plenty of other ways that security can be breached. Thankfully there's an easy and straightforward way to put a stop to this.

It's called LastPass, and if you're thinking it's going to be expensive, guess again. LastPass is running a 30% off sale that makes their already budget-friendly business plans more affordable than ever. That includes Teams, Business, and Business Max, with the most affordable option costing just $2.97 per user per month.

LastPass helps smaller organizations modernize credential hygiene, reduce weak‑password risk, and introduce passwordless options in a way that’s approachable for non‑technical teams. It's built on zero‑knowledge encryption, automated password management, and intuitive controls, all supported by LastPass’s trusted reputation among SMBs. So, if you want to improve security at a reduced price, now's the time to strike.

Get password protection with 30% off

Why we love LastPass

LastPass is one of the best password managers. Features include the generation of long, complex strings for every site so you don't have to, audits of your current vault, and alerts when weak, old, or reused passwords are discovered.

LastPass is set up to help teams store and access their passwords with maximum ease and efficiency. Thanks to a team sharing feature, it's possible for team members to quickly and securely share login credentials.

For that extra peace of mind, LastPass utilizes zero-knowledge encryption, which means that only you and authorized users can access your vault of passwords and login credentials. It's so secure that even if someone asked LastPass to hand over your encrypted data, they couldn't because they don't have access to it.

This LastPass deal expires on March 23, so if you're interested, we recommend taking a look.

The best password managers are essential for providing not just individuals but also businesses with the necessary protection. Without adequate cover, the reality is that your business could be left vulnerable.

Thankfully, you don't have to break the bank with an offer that gives new LastPass users 30% off any plan. That includes Teams, Business, and Business Max, with the most affordable option costing just $2.97 per user per month.

LastPass generates long, complex strings for every site so you don't have to, audits your current vault and tells you which passwords are weak, old, or reused, and alerts you if your email address or data is found in a known breach. Get all this and more for a new low price with the offer expiring March 23.

Get password protection with 30% off

Why we love LastPass

When it comes to businesses, LastPass is one of the most popular password managers around. This is evidenced by the 100,000+ businesses that put their trust in it every single day to provide digital protection.

As well as cloud-based tools that enable users to store and access their passwords, LastPass offers a fantastic set of features for teams, including a sharing feature where team members can quickly and securely share login credentials.

For that extra peace of mind, LastPass utilizes zero-knowledge encryption, which means that only you and authorized users can access your vault of passwords and login credentials. It's so secure that even if someone asked LastPass to hand over your encrypted data, they couldn't because they don't have access to it.

This LastPass deal expires on March 23, so if you're interested, we don't recommend hanging around.

Keeping track of dozens of passwords is a hassle, which is why more and more people are relying on one of the best password managers to do the heavy lifting instead. However, your digital vault is only as secure as your ability to spot a scam. That’s the hard lesson LastPass users are facing after the popular password manager was hit with a convincing phishing scam after a recent holiday weekend in the U.S.

As reported by BleepingComputer, LastPass has issued a warning about a new phishing campaign in which cybercriminals are impersonating the company to encourage users to create a local backup of their vaults and all of the passwords stored inside them.

What’s so dangerous about backing up your passwords? Well, clicking on a button within the email takes unsuspecting users to a phishing site designed to steal their logins and potentially even the master passwords to their vaults.

Here’s everything you need to know about this new phishing scam, along with some tips and tricks to help keep your accounts and passwords safe, even if you don’t use a password manager.

From backup to account takeover

This new phishing campaign starts with a malicious email in your inbox that looks and reads like it comes from LastPass itself. However, that couldn’t be further from the truth as the hackers behind this campaign have gone to great lengths to impersonate the popular password manager.

In a blog post, LastPass explains that the campaign began on January 19 and that the phishing emails came from senders with addresses like “support@lastpass[.]server8” and “support@sr22vegas[.]com”. Besides these less-than-legitimate-looking email addresses, the following subject lines accompanied these malicious messages:

• LastPass Infrastructure Update: Secure Your Vault Now
• Your Data, Your Protection: Create a Backup Before Maintenance
• Don't Miss Out: Backup Your Vault Before Maintenance
• Important: LastPass Maintenance & Your Vault Security
• Protect Your Passwords: Backup Your Vault (24-Hour Window)

The scam emails themselves create a sense of urgency by explaining that, due to scheduled maintenance, a backup is recommended. If you’ve used a password manager before, you know how important it is to have your passwords backed up just in case you’re unable to access them, which helps make this campaign appear more legitimate. However, as the company explains in its blog post: “Please be advised that LastPass is NOT asking customers to back up their vaults in the next 24 hours.”

Still, a late-night email sent after a long holiday weekend is enough to convince some people to take action, and that’s just what the hackers who launched this attack are hoping. Towards the bottom of these emails, there’s a button that reads “Create Backup Now.”

Instead of actually creating a local backup of a LastPass user’s passwords, clicking it takes them to a hacker-created phishing site where their password manager credentials are waiting to be harvested. Fortunately, the phishing site — mail-lastpass[.]com — is now offline according to BleepingComputer.

How to keep your passwords and accounts safe

Although the very reason one decides to use a password manager in the first place is to keep their logins safe, you still need to be careful when using passwords. This is the reason many companies are now offering users the option to log in using a passkey instead.

Unlike with passwords, passkeys can’t be guessed or cracked, and they’re tied back to a device you already own, like your phone. That way, a hacker would need both the public and private keys for your password and your phone to gain access to your account. However, while the private key is stored securely on your device, the service you’re using your passkey with holds the public key. The two will never be together except when you log in using a trusted device, which makes them almost impossible to crack.

If you’re worried about putting all of your passwords in one basket with a password manager, I’d recommend using multiple services or even not using a password manager to store your most critical passwords, like the ones for your banking or financial accounts. Another important thing to remember is to keep your master password safe when using one. Don’t write it down on a Post-it note or save it in a document on your computer. Instead, this is the one password you’ll still need to have memorized to unlock access to the rest of your credentials.

In the campaign detailed above, keeping a level head and not letting your emotions get the best of you is the easiest way to stay safe. When you see an urgent warning in your inbox, it’s easy to let your guard down. However, instead of doing that, you should stop, take a moment and ask yourself if this seems real.

Does this particular company often communicate with you this way? From there, you need to inspect email addresses, URLs and everything else with a close eye. One good trick is to hover over links first before clicking on them and to be really careful, copy the link and then paste it into a document or somewhere else so that you can thoroughly inspect it before heading to that site.

Although the best antivirus software can help protect you against malware and other viruses, in this case, the best identity theft protection is a better investment. With one of these services, you can get your identity back if it’s stolen as well as recover any funds lost to fraud as a result of a hacker gaining access to your credentials and the online accounts they’re associated with.

As one of the biggest players in the password manager business, LastPass has been targeted before and this likely won’t be the last time. As such, it’s up to you to practice good cyber hygiene and always think before you click.

More from Tom's Guide

• Fake Chrome extension ‘breaks’ your computer before it hits you with malware — how to stay safe
• Even if you hate Liquid Glass, you shouldn't skip updating to iOS 26 for the sake of your iPhone
• Kaiser Permanente reaches $46 million settlement over data breach — how to file your claim

How do you keep track of your passwords? Unless you answered with: a password manager, then you may have a less than secure method for signing into your accounts. Hackers love lazy, reused, breached and just plain bad passwords because it makes their job – breaking into and taking over your accounts – so much easier.

It's no secret that the problem with passwords is: people. People are the ones creating this issue by using terrible passwords which is why so many companies are switching over to better systems (like passkeys).

Since the first way to fix any issue is to identify the problem, let's own up to it. If people are the problem, they can also be the solution.

How bad passwords create risk

This year one of the biggest news stories was the heist at the Lourve, which revealed a security system that was riddled with issues – including that it had 'Lourve' as its password. We'd like to say that's the worst we've ever heard but in a world where the most common passwords of 2024 were “123456” “111111” “ADMIN” and “qwerty”, that's actually far from surprising.

According to research from SpyCloud, more than 140 million people had their passwords exposed in 2024. That same report points out that more than 70% of people also reuse passwords, which means that those stolen passwords allow bad actors to access multiple accounts putting a lot more personal data at risk.

Solution: Password managers

We recommend using one of the best password managers, over and over again, because of how many benefits there are to doing so – and that's in addition to the convenience of not having to keep track of the 168 passwords you probably have. That's right, according to research from NordPass, 168 is the average number of passwords for most people.

The other good reasons for using a password manager is that doing so cuts down on the kind of lazy, bad password habits that make passwords so easy to crack. Namely, password reuse and short, easy to remember passwords.

A password manager creates strong and unique passwords with long strings of multiple upper and lower case characters as well as numbers and symbols that are unique to each account. It remembers them so there's seamless synced across all your devices, and because a password manager won't recognize a mimic or look-a-like site it can also protect against phishing.

Solution: Multi-factor authentication

If you don't use two-factor authentication, here’s a brief run-down: Two-factor, or multi-factor, authentication is a secondary method that involves verifying access into your accounts in a way that makes it more difficult for hackers to emulate.

This can be via a static passcode, an SMS message, a phone call or even a USB-based security key. Most online sites or apps are set up so that you can easily enable this extra layer of security. The only drawback is that it will require a few extra minutes to get done initially — and it means an extra step when logging in. However, there's a significant security benefit.

Two-factor authentication, 2FA, is extremely effective. In 2022, Google said that rolling out 2FA had shown a 50% decrease in account takeovers. And according to CISA (Cybersecurity and Infrastructure Agency) and research from Microsoft, multi-factor authentication shuts down 99% of automated hacking attempts.

Setting up 2FA isn't complicated: When you log in, using your username and password as usual, you enter in a code you receive on your smartphone via email or text message. Sometimes though, you’ll need to open an app to receive the code. When you return to log in, you enter in the code and then can access to your account.

This makes it very difficult for anyone else to get into your account, since they won’t be able to get both the password and code. A hacker getting access to your password – be it cracked, stolen or purchased – isn't so unusual, but when you receive the prompt that lets you know someone is requesting access to your account, you have time to switch your password, lock your account or run a scan with the best antivirus software.

Solution: Passkeys

Since their introduction just a few years ago, passkeys are now being widely adopted as the preferred — and more secure — method of accessing an account. Both Microsoft Authenticator and Dropbox Passwords announced they would close this year with Microsoft in particular switching users to a passkey login.

Passkeys are a passwordless login used in place of traditional passwords. This is preferred as a more secure options since each passkey is a unique digital key that can’t be reused. Passkeys are kept in an encrypted format on your device, instead of on a company's servers, making them safe in the event of a data breach too.

You don't have to remember a password, and you can use your own smartphone or laptop. Passkeys are built on the WebAuthentication or WebAuthn standard, which uses public-key cryptography to better secure your accounts. Passkeys also can’t be stolen in phishing attacks.

Cybercriminals and hackers often use phishing or social engineering as a way to gain access to someone’s username and password in order to steal their accounts. With passkeys, though, you have a private and public key and while the public key stays on a company’s servers, the private key remains on your device and can’t be easily stolen.

If you opt to set up a passkey, you will be asked to confirm your account log in, then an authenticator to use a secondary form of verification to access your password, like your face or fingerprints. That's the private key stored on your device. When it comes time to login, the site's server sends a request to the authenticator which asks for your "private key" like your face ID or fingerprint. When it matches, you're able to access your account, the process usually happens quite quickly after the initial setup.

Taking back control

By putting the advice above into good use, you can finally say goodbye to the security concerns and anxiety that comes from using insecure passwords. This will take some time and effort on your part, but trust me, it's worth it.

More from Tom's Guide

• I’m a security editor and this is how I create strong passwords that are also easy to remember
• The best password managers in 2025
• What are passkeys? Everything you need to know about the death of passwords

If you're a small or medium business that wants to increase their security around passwords and data, then you've come to the right place. With weak passwords being responsible for financial losses, downtime, lost revenue, reputation damage, and more, you're doing well to take it seriously.

Thankfully, right now, one of the most popular password managers, LastPass, is running a sale that gives new LastPass users up to 50% off LastPass products.

That means you could save up to $2.70 per user per month. That's a saving that will really stack up if you have a lot of employees.

We'd particularly recommend one of three subscriptions. These are called Teams, Business, and Business Max. Each plan offers an increasing number of features and control. Scroll down for more details on each.

Password and identity protection with up to 50% off

With over 100,000 businesses and millions of users, LastPass is trusted the world over. As a secure, cloud-based password and identity management solution, businesses and users are able to simplify their digital life and strengthen online security.

LastPass offers flexible plans for individuals, families and businesses of all sizes. Built on advanced encryption and modern security standards, it generates and stores strong passwords, autofills credentials across devices, monitors accounts for breaches, enables secure sharing, and more.

This deal expires on December 15, which means you should move quickly if this suits your requirements.

Password managers are essential for individuals, but they're also absolutely vital for small businesses. Without protection your business could be left vulnerable. And if you're looking for one of the best password managers, then we'd highly recommend LastPass.

Better still, right now LastPass has a sale on that gives new LastPass users up to 50% off LastPass products.

The maximum discount is available on both the premium package and the families plan, but there are also other discounts available for teams and businesses. More details on these below.

LastPass is known for offering an incredible level of convenience without compromising security. As a result, they are trusted by millions to keep their passwords safe, private, and secure.

Get password protection with up to 50% off

LastPass is trusted by over 100,000 businesses and millions of users, which makes it one of the most popular password managers around. With cloud-based tools, users are able to store and access their passwords without having to remember a single one of them.

LastPass also has a sharing feature where team members can share login credentials, making it simple and easy to run your online business operations. Everything is also built on advanced encryption and modern security standards for that extra piece of mind.

This LastPass deal expires on December 15, so if you're interested, we don't recommend hanging around.

On December 3, 2025, Russia blocked popular US gaming platform Roblox, accusing it of supplying extremist materials and promoting LGBTQ propaganda. The communications watchdog Roskomnadzor believes the platform spreads inappropriate content that could stunt the moral and spiritual development of children.

This is a common claim any time an online platform is blocked in Russia. Still, Russian Roblox fans aren’t ready to accept their fate just yet, sending many to seek the best VPNs that can unblock the platform.

Extremist materials

Russia frequently uses claims of "extremist propaganda" as a reason for outright bans, throttling, and temporary blocks on gaming and social media platforms. The country heavily throttled and blocked chat platforms like WhatsApp and Telegram earlier this year, and then rolled out Max. Max is Russia’s state-integrated solution to mainstream video and chat services.

A government push to use Max has officials making it a prerequisite for civil servants and students, even going as far as to threaten job loss or expulsion if the app isn’t installed.

Russia isn’t the first country to block the game, though – Iraq and Turkey have also placed a ban on Roblox, citing concerns that predators could use the game to lure and abuse children.

Children at risk

Protecting children online is important, but some argue that moderating children's activity within the Roblox universe may be more sensible than an outright ban. It is salient to note that Roblox is not solely a child's game.

The online platform hosts millions of user-generated games and social experiences for adults, such as virtual coffee shops and other meeting places. It even has its own game creation software (Roblox Studio), which allows users to create and publish games using virtual currency (Robux).

For the most part, it claims to do its due diligence in trying to keep children from accessing adult-themed content. The game implements safety measures based on user age that restrict access to certain tools and games.

The platform's website further details what is and isn’t accessible within a certain age range under Safety by Age. In the Safety section of Roblox’s website, there’s also information about other topics such as parental controls, transparency practices, and safety tools and policies.

It is also notable that Roblox does come under the remit of Australia's upcoming Online Safety Amendment – legislation that is intended to protect under-16s from inappropriate content on social media.

A spike in Roblox VPN searches

It is unsurprising that fans of the online gaming platform are looking to VPNs for help navigating around the block. In the last few hours, we have seen a considerable traffic increase to the Tom's Guide Roblox VPN page, with almost all traffic coming from Yandex users in Russia. As of yet, it is unclear whether using a VPN will allow access to Roblox in Russia.

Notably, the Russian government is considering an outright ban on VPN apps in app stores. This has not yet been implemented, but VPNs may well be under threat in the country.

At Tom's Guide, we stress to our readers to only use reputable, verified VPNs. Many free VPNs in both the Apple App Store and the Google Play Store are unsafe to use. Instead, we recommend VPNs that we have tested and reviewed, and have verified as safe. Examples include NordVPN, Surfshark, and ExpressVPN.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

On Wednesday, December 10, 2025, Australia will enforce its blockbuster social media ban – officially titled "Online Safety Amendment (Social Media Minimum Age) Act 2024."

This legislation aims to stop children under the age of 16 from accessing a wide range of social media applications, including Facebook, Instagram, TikTok, YouTube, and Reddit. The ban is the first of its kind to come into effect, although countries such as Denmark, Norway, and France are also considering similar measures.

The bill was passed in November 2024, and states that tech companies that do not take "reasonable steps" to enforce the bill will face fines of up to AU$49.5m (US$32m). Controversially, however, each individual platform will decide how it verifies a user's age, rather than using a centralized system.

The Online Safety Amendment addresses the widely held belief that children's lives are negatively impacted by social media, and that it can impact socialization, self-image, and physical activity, and also make children vulnerable to predators.

However, privacy and internet freedom advocates claim that its implementation may do more harm than good, and that these platforms may become even more harmful for those children that manage to circumvent the ban with tech like VPNs.

What platforms are affected?

Almost all major social media platforms come under the remit of the bill, although gaming platforms and apps are currently unaffected.

This is currently the full list of apps affected:

• Facebook
• Instagram
• TikTok
• Snapchat
• X
• YouTube
• Reddit
• Twitch
• Kick
• Threads

Notable platforms that are unaffected include Discord, WhatsApp, Messenger, and YouTube Kids. Some social media platforms like LinkedIn and BlueSky have been omitted due to being either low risk, low usage in Australia, or being of less perceived interest to children.

However, as reported in the Guardian, this is a "dynamic list," and if the exodus from one app sees a considerable uptake of another, there is scope for that app to be banned as well.

How will the ban be enforced?

It's unclear exactly how the ban will be enforced, although independent government regulator eSafety states that the methods used need to "meet the regulatory requirements and respect privacy laws and digital rights."

The details are made even more woolly due to the fact that each platform is free to decide exactly how it verifies the age of its users. However, most apps have already sent notifications to most users suspected of being under 16. For these users, methods used to verify age will likely include facial scans, government IDs, and bank account information.

Interestingly, Meta is kicking things off early, and on December 4, users it estimates to be under 16 will be blocked. Appeals can be made, in the form of an age-verification check performed by dedicated age-verification software Yoti. However, as reported by ABC Australia, facial recognition checks are less effective at determining the age of people under 16, and are also less effective for people from an Indigenous or south-east Asian background.

Snap, owner of Snapchat, will use "behavioural signals based on account activity" to estimate ages of users, and will use ConnectID and K-ID to perform any check necessary. Both ConnectID and K-ID are private companies.

Other platforms have been less clear about the methods they intend to use, and we may have to wait until December 10 to get a clearer picture.

What does this mean for people over 16?

eSafety's guidelines state that it "does not expect a platform to make every account holder go through an age check process if it has other accurate data indicating the user is 16 or older.

"For example, if someone has had an account since Facebook started in Australia in 2006, Meta could reasonably assume they are older than 16 so no further check is needed."

However, if your account has been flagged but you're over 16, you will need to verify your age. As mentioned above, each platform will have a different method of doing this. Expect facial scans to be a common option, alongside uploading official identification documents like driving licences or passports.

What are the downsides?

Despite the fact that the Online Safety Amendment's intention is good – the protection of children online is paramount – privacy advocates have raised very similar concerns to those associated with the UK's Online Safety Act.

Primarily, this revolves around the mandatory sharing of personal details and documentation, alongside linking a real identity with your account, but also includes concerns over the potential rise of phishing scams.

If you're a user of all the affected apps, it's quite possible that you will be required to send your personal details to five or six different third-party companies to verify your age. If even one of these stores your information after verification and is hacked or compromised in the future, your personal data is at risk.

What's more, YouTube has claimed that these measures will make its platform less safe for teens. It stated that parents will "lose their ability to supervise their teen or tween's account," and that the "rushed regulation that misunderstands our platform and the way young Australians use it."

A rise in risky VPNs

VPNs are often seen as a quick and easy way to circumvent internet restrictions, and it's likely that VPN use will spike when the social media ban comes into force. However, eSafety states in its guidelines that social media platforms are "expected to try to stop under-16s from using VPNs to pretend to be outside Australia."

It's important to note that many fake VPNs exist, and a considerable amount of free VPNs on app stores have very poor privacy credentials. Most will do more harm than good. This is why we rigorously test VPNs, focusing on privacy, logging policies, and general performance. In a landscape where there are so many risky options, being informed is essential.

We rate NordVPN as the best VPN, closely followed by Surfshark and ExpressVPN. All three are safe to use, have been fully audited to prove they do not log your personal data, and have servers in dozens of countries around the world.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

December 1st is here and Cyber Monday deals are an excellent opportunity to save on some of the best password managers we've tested.

For example, right now Keeper is taking 60% off personal and family plans. After discount, a personal plan (1 user) costs $1.33/month, a family plan (5 users) costs $2.83/month, and a business starter plan (5 users) costs $7/month. That's one of the biggest percent-off discounts we've seen from Keeper this year.

Creating insecure passwords puts your private information at risk when shopping online. This is especially crucial during the holiday season. Fortunately, Keeper is one of the best password managers we've reviewed. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure.

Although Keeper has a free tier, we recommend the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

We also like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

Thanksgiving is just days away and Black Friday deals are starting to ramp up. If you're looking for a way to safeguard yourself from cyber attacks, one of the best password managers we've tested is on sale.

Currently, Keeper is taking 60% off personal and family plans. After discount, a personal plan (1 user) costs $1.33/month, a family plan (5 users) costs $2.83/month, and a business starter plan (5 users) costs $7/month. That's one of the biggest percent-off discounts we've seen from Keeper this year.

Creating insecure passwords puts your private information at risk when shopping online. This is especially crucial during the holiday season. Fortunately, Keeper is one of the best password managers we've reviewed. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure.

Although Keeper has a free tier, we recommend the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

We also like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

It's been almost a month since the brazen robbery at the Louvre where $101 million worth of jewelry was stolen in broad daylight. And while four suspects have since been arrested, the focus has now fallen on the weakness of the museum's security systems which had apparently gone unaddressed for long periods of time.

Multiple publications including Cybernews and Tom's Hardware cite the French publication Libération as a source, via machine translation, regarding the details of a 2017 security audit from the ANSSI (French National Agency for the Security of Information Systems). The audit stated that the threat of an attack with "potentially dramatic consequences could no longer be ignored."

Additionally, a museum curator was quoted as saying “What I can testify to is that the Louvre’s management was fully aware of the … not of the weakness, but of the need to have a fresh look at the security system of the entire museum.”

The longstanding weaknesses of the system include using an outdated version of operating systems on the museums computers, not having enough video surveillance coverage of the massive museum itself, and perhaps most often noted by news stories, having "LOUVRE" as the password to the video surveillance system.

The last example is perhaps least surprising given how bad most passwords are – which is exactly why many companies are moving away from them altogether.

According to CompariTech which released a report on Thursday, "123456" is the worst password of the year (for at least the second year in a row). More than 7.61 million accounts leaked on a data breach forum this year had “123456” as their password.

This year's list of most uses/worst passwords are all, well, terrible. In addition to "123456" the top ten include "admin," "password," and "1234." Passwords are already on their way out, as many companies from Google to Microsoft move to the more secure passkey technology, and this report proves that the adoption of a more secure method is essential as users will simply default to the easiest or laziest option instead of taking time to properly secure their accounts.

Here are three ways you can make your home more secure than the now infamous Louvre, starting with your password.

1. Don't use your name as your password

In 2014 the password to the museum’s video surveillance systems’s was the name of the museum itself – LOUVRE – the same audit showed that another system built by defense and cybersecurity company Thales, used THALES to access credentials. It's unclear whether or not these were default passwords that were left in place, or if they were purposefully chosen as the secure passwords for the organization.

However, either way, I think that in the year of our internet 2025 we should all be able to do better than our own names, our spouse's names, kids names or pets names as passwords. I can literally come up with three better passwords right now off the top of my head: PurpleMonkeyDishwasher. ArianaGrandestarsinWicked. Fridayisthelastdayintheweek.

All of those are phrases, contain more than twelve characters and aren't easily associated with anything that could be brute force guessed about my life. That makes them much harder to crack.

CTO at Dashlane, Frederic Rivain, was quoted by Cybernews suggesting that companies make better passwords by using one of the best password managers, by enabling multi-factor authentication or by switching to passkeys. And I recommend that advice for private individuals as well.

2. Update your operating system

Whether you manually update your computer's operating system regularly, or automate it, making sure that you're running the most up-to-date patches and updates against all the most recent malware, spyware, infostealers and ransomware.

According to reports, the Louvre's automated network was using computers equipped with Windows 2000. Support for Windows 2000 ended in 2010 which means that the museum's computers were not receiving any updates, patches or protections against any current malware. They systems were vulnerable to all manner of viruses or threats; according to the Libération, the museum was still running the outdating operating systems as late as 2021.

3. invest in well placed cameras

The Louvre is epically huge, at over 652,000 square feet, and according to a 2024 report 61% of it had no CCTV coverage. Covering that area is a daunting task, however, since it's unlikely that you have to deal with 37 hectares, it'll be a lot easier to get decent coverage with smart home security cameras if you start with the right areas.

First, cover your front entrance, then make sure that the most frequently used entrances have coverage. Sometimes that might be a back door, garage door or side door.

Next, make sure a camera is watching your garage and/or driveway – garages are common break in points both because they often contain expensive goodies like bicycles or tools and because they're harder to watch and hear as they’re often separate or removed from a home.

Last, put a camera up watching the backyard, deck or patio so you have a wide field of view over back entrances, as well as fences, gates, sheds, children playing or even wildlife passing through.

Make sure you’re avoiding low mounts on fences, which could get stolen, anything that faces a neighbors property and cameras pointed at a window (which will only reflect back).

How to make better passwords

If you must use a password, and insist upon not using one of the best password managers or a passkey, here are some tips to make sure you can create your own unique, strong passwords.

Make your password a phrase, and use at least twelve characters. The longer the password, the longer it will take to crack; CompariTech showed that nearly 66% of stolen passwords had less than twelve characters. Use a combination of upper and lowercase letters, numbers and characters.

Change your passwords frequently, especially for high profile accounts like banking, email or social media. If you're concerned about a password that may have been involved in a leak or breach, you can check it in the Cybernews Password Leak Check. Also, if you'd like to see how secure a password is, you can check it out beforehand in the Nordpass How Secure is My Password site.

More from Tom's Guide

• The best password managers in 2025
• I ditched my passwords for passkeys on these 3 popular services — and it took me less than 10 minutes
• The 3 best places to put a home security camera — and the 3 worst

Over 100 password managers and software solutions are being impersonated by a new malware campaign targeting macOS users to steal their personal information. As reported by Bleeping Computer, the popular password manager LastPass has already started warning users about this malicious software that is being spread through fake GitHub repositories.

Besides impersonating LastPass, this campaign is also pretending to be other password managers and software solutions including 1Password, Dropbox, Gemini, Audacity, Adobe After Effects, and SentinelOne, among more than 100 others. It's using these fake repositories to spread the Atomic macOS Stealer, also known as AMOS, which is an info-stealing malware often used in ClickFix style attacks. AMOS is a malware-as-a-service offering that can be bought by hackers and other cybercriminals for roughly $1,000/month on the dark web and typically targets the data stored on vulnerable computers.

The developers of this malware also recently added a backdoor component which gives them persistent and stealthy access to compromised systems. A large number of these deceptive GitHub repositories have been created from multiple accounts in order to optimize them to rank high in search results and to evade detection. LastPass has reported the fake repositories to GitHub but since it's easy to recreate new ones through automation from new accounts, even if they're taken down, new fraudulent ones could pop up just as quickly.

As ClickFix style attacks, the repositories feature a ‘download;' button that directs users to a secondary website where they are instructed to paste a command into the terminal to perform an installation of what seems to be legitimate software but is in actuality malware. The “ClickFix’ method takes advantage of a target not fully understanding what the commands are doing on their system; in this case the command is performing a curl request to a base64-encoded URL which then downloads an AMOS payload to the /tmp directory.

How to stay safe from ClickFix malware attacks

In order to stay safe from ClickFix style attacks, the most important thing you need to know is not to run commands on your system, especially when you don't understand them. Additionally, when looking for software online, its recommended to only trust official app stores like the Mac App Store or vendor websites while avoiding offshoots. If there isn’t a macOS version of a particular piece of software available on a company's official site, be extra wary when you find a third-party site or in this case, a GitHub page, suggesting there is one.

If you do come across a macOS port of a program you're interested in, you should ensure that it comes from a reputable source that has been vetted by the community first. Still, you are installing it at your own risk, so when in doubt, it's best to wait for an official port.

It also never hurts to have strong protections when online – one of the best antivirus software solutions can keep your Windows PCs protected while the best Mac antivirus software is specifically designed for your Apple computer. These paid solutions also provide you with plenty of extra useful features like web browsers that warn you about suspicious websites and downloads, ransomware rollback, a VPN, and more.

For those who are really worried about getting hacked or having their bank accounts drained by cybercriminals, you can't go wrong with the best identity theft protection services for even more protection. However, you'll need to sign up before a cyberattack or major security incident to take full advantage of the identity theft insurance and other protections these services offer.

ClickFix style attacks have been quite successful recently and until the general public learns to recognize and avoid them, hackers are going to keep using them in their malware campaigns. That's why it's up to you to practice good cyber hygiene and most importantly, to always be careful where you click and what you download.

More from Tom's Guide

• FBI warns hackers are impersonating crime reporting sites to steal your personal data — here’s how to tell
• Google will let you use passkeys automatically in Chrome - here's how you can switch
• Hackers are now using deepfakes in phishing scams to fool banking apps and steal your money - how to stay safe

Like many other services lately, Google is working on testing automated switching from passwords to passkeys in Chrome. Windows Report first spotted the flag hidden in the Canary build of Chrome which can automatically convert saved passwords into passkeys when a user is logged into a site or service.

The process doesn’t require any prompts or interaction from the user but will run automatically in the background once enabled. When you access a website and log in using a saved username and password, a passkey will automatically be created as long as the site in question supports it. This is supposed to happen invisibly, making the switchover easy for the user. Currently, the system in Chrome prompts users to adopt passkeys instead of passwords and requires confirmation after the prompt.

Passkeys are much safer than passwords because passwords can be easily guessed via either phishing or brute force attacks, are stored on third-party servers and are often reused or created in an insecure fashion in the first place. However, if you're not quite ready to switch to passkeys and plan to continue using passwords, make sure that you're using one of the best password managers to keep them as secure as possible.

How to turn on passkeys in Chrome

In order to turn on this new automatic passkey upgrade feature in Chrome, you first need to be running the experimental version of Google's browser, Chrome Canary. To do so, head to the Chrome Canary site and then download and install it on your computer.

It's worth noting that Canary is Google's most experimental and unstable version of Chrome, so you might run into some hiccups and other minor issues. However, it could be worth it if you want to test out the search giant's bleeding-edge features first.

With that out of the way, you then need to go to Chrome's Experiments page in your browser. This is done by typing "chrome://flags" into your address bar if you want to see all of the experimental features available in Chrome Canary. However, if you want to get right to the chase and start having Chrome convert your passwords to passkeys automatically, you can just enter "chrome://flags/#web-authentication-passkey-upgrade" instead.

Once you find this new experimental feature (either by searching for it or going directly to it with the URL above), you'll need to toggle it on. From there, restart Chrome Canary and then head to Google Password Manager to enable automatic passkey upgrades. And that's it, sites that support passkeys that you log into using Google Password Manager to autofill your credentials will now automatically convert your passwords to passkeys with Chrome's help.

If you don't want to go through the trouble of setting up Chrome Canary, then you'll just need to wait for this experimental feature to come to a stable version of Chrome. As big passkey enthusiasts ourselves, we'll be looking out for this change and will update this story once this useful new feature becomes more widely available.

More from Tom's Guide

• New hacker tool can inject AI-generated deepfakes right into your iPhone — everything you need to know
• Nearly 200,000 people hit in New York Blood Center data breach — names, IDs, SSNs and more exposed
• Google just fixed a major Chrome zero-day flaw — update your browser right now

I don't really spend much time mulling over the contents of our best password manager page, and the various options that are recommended. However it does not surprise me in the slightest that Google's password manager is not on that list.

It's not that it's particularly bad at its job, but it is an absolute pain to deal with most of the time. Thankfully it seems that the launch of the Pixel 10, and various Android 16 upgrades that coincide with it, may have fixed one of the most glaring issues.

Unfortunately I don't think it goes far enough, and Google should steal some of Apple Passwords' ideas instead.

The problem with Google password manager

The big issue with Google's password manager over the years is that it was buried in a maze of menus across various Google platforms. Especially on Android where you had to delve into various Google account settings to see what's there and to access the information on offer.

Admittedly, I can kind of understand what Google was going for with this system. The goal seems to be that Google wanted a password system that worked autonomously, using autofill to enter passwords for you whenever they're needed.

This later changed when Google let you add a password shortcut to your Android home screen. Though, this too required you to dive further into the settings to find that particular option. By this point I had more or less given up on the idea of Google Passwords by that point anyway. It may have been free, but it always felt like such a chore to actually use that I ended up paying for a competitor.

While I'm only paying somewhere around $1.50 a month for my current password manager (NordPass), the fact I'm paying for a premium password manager when a free one was available is, admittedly, pretty dumb. But that's the state of what Google's password manager was at the time.

Now, though, Google seems to have fixed this issue by turning the password manager into its own app (of sorts).

The fix so far

As spotted by 9to5Google, Google Password Manager now exists as its own thing on the Play Store, letting you download it to a bunch of Android phones — if not all of them. You literally just need to head over there on your phone and tap install, and Google Password Manager will exist in app form on your phone.

Of course, the only difference between this "app" and the old shortcut option is the process of acquiring them. They go to exactly the same place, and offer the same access to your Google-stored passwords. It's just that one comes from Google Play and the other one involves some serious menu navigation.

The added benefit of it being a Play app also means that Google could enforce a rule that requires Android phone makers to include the password manager out of the box. Much like it does with apps like Google Docs and Maps. That should make password managers a little more accessible on Android, since there's no actual effort required to get them. So long as users actually set up and save complex passwords instead of using the same password for every single account they own.

Of course the fact the Google Password Manager hasn't changed, despite now being an official Play Store app, is problematic in itself. Because we've already seen that other free password managers can offer a whole lot more than simply securing your login details.

Google needs to follow Apple's lead

I have been extremely impressed by the Apple Password Manager, which launched last year alongside iOS 18. Not because it solved the outstanding issue of accessing the iCloud Password Keychain more easily, or that it was freely available to all Apple device users. It was the fact that Apple turned it into more than just an ordinary password manager.

It's not just a place to store login details or passkeys. It's also home to ever-changing authenticator codes and Wi-Fi passwords, while also altering you if any of your details have been detected in data breaches. It is your single go-to place for all things security.

Google offers these things too. The latter is part of the existing Password Manager, and the Authenticator app has been a staple part of my phone for well over a decade. But the fact that Apple has merged all these things so they're available in a single location, and locked it behind biometric security by default, means it's a heck of a lot more convenient — and has that extra feeling of security.

Is putting everything together in a single spot a good idea? I have no idea, to be honest. There's also the fact Apple Passwords lacks the ability to store secure notes, documents and contacts — something all good password managers offer. But the fact that everything can be accessed in a single spot is very helpful, and it makes it all the more likely people will take advantage of that. Especially since it's free, and works across all your devices.

Matching what Apple does with Apple Passwords should be next on Google's list of priorities. Then it can focus on surpassing that, and gunning for the dedicated password managers. Because the sooner I can downgrade my Nord subscription to just the VPN, the happier I will be.

More from Tom's Guide

• Your Samsung Galaxy phone comes with a hidden Easy Mode — here's how to activate it
• I’ve now held the Pixel 10 Pro Fold and Galaxy Z Fold 7 — and there’s a clear winner
• Android finally steals the ability to undo texts from iMessage — and it's rolling out now

More from Tom's Guide

• Popular Chrome VPN extension caught secretly spying on users — uninstall it right now
• Over 2 billion Gmail users at risk following database hack — how to stay safe
• FBI issues warning to all smartphone users — this dangerous new scam could be at your door

A petition calling for the UK government to repeal the Online Safety Act has topped 450,000 signatures.

It's unlikely it will have a significant impact on the government's stance, but it shows the level of backlash ministers are facing over the law.

The goal of the legislation is an honorable one – to protect children and vulnerable internet users from consuming "explicit content" by introducing age verification checks.

But these checks require sharing sensitive personal data with third-party companies, and people are understandably cautious about doing this.

The best VPNs have seen a huge spike in demand in the UK as people search for ways to bypass age verification checks and, as well as the petition, heated debate has been taking place.

The government has said it won't repeal the Online Safety Act, but there are still a number of ways you can protect your privacy online – here are some examples.

Why do people want to protect their privacy?

Whether it's scams, hackers, malware, or data harvesting, there are countless ways our privacy and security can be exploited online.

Specifically addressing age verification checks, privacy advocates believe you shouldn't have to hand over information such as credit card details, photo ID, or selfies to sites like AgeGO or Yoti.

VPN provider IPVanish described privacy as a "fundamental right," and "not something to be traded for access."

There are serious security concerns, and many cybersecurity experts cited these as their reason for opposing age verification checks.

Centralized databases full of highly sensitive data will be created. They'd be a gold mine and prime target for hackers and should they be breached, the consequences would be catastrophic.

Obscura VPN founder Carl Dong called the law a "ticking time-bomb." He said "the question isn't if a site gets breached, but when."

This threat isn't exclusive to the Online Safety Act. Our data is valuable to big tech companies, governments, data brokers, and hackers.

Data breaches are regularly seen and the likes of Google, Meta, and Amazon profit off tracking us and our data.

But how do we start to reclaim control of this data and protect ourselves online?

The role of VPNs

Although not a silver bullet, VPNs are one of the most popular tools people use to protect their data.

When you connect to the internet through a VPN, your traffic travels through an encrypted tunnel and is protected from hackers and third-parties. Your IP address is also changed, with it being possible to appear as though you're visiting a site from another country.

Many VPNs have dedicated ad and tracker blockers, with malware protection features also common – although their effectiveness varies between VPN providers.

Scams are one of the main ways hackers can steal your data. Fake, malicious links, alongside scam texts, emails, or calls are popular methods of attack. They trick you into thinking links or sites are legitimate, but in fact they're specifically set up to steal your data.

If you fall victim to a scam, most VPNs won't be able to help you. But threat protection features are effective at warning you a link may be suspicious.

The best rule of thumb to follow is never click on anything unless you're 100% sure it's genuine.

NordVPN's Threat Protection Pro has been rated as the best VPN malware protection and is a certified anti-phishing tool. Surfshark also has an award-winning antivirus software.

Leading VPN providers offer additional security features such as Double VPN (sometimes called multihop).

Connecting to one of these dedicated servers sees your VPN traffic routed through two secure servers rather than one, doubling your layers of encryption. You may find this added protection comes at the sacrifice of speed because of the extra distance your data has to travel.

We wouldn't recommend Double VPN for everyday browsing. But if your data is particularly sensitive or you're living under internet restrictions, it's a much needed feature.

NordVPN, Surfshark, Proton VPN, and Mullvad VPN are just some of the providers to offer this option.

Although not everyone needs a VPN, there will be one to suit you. The most secure VPNs are ideal for those valuing privacy and security. If you're on a budget, consider the best cheap VPNs or even the best free VPNs.

We also have guides on the fastest VPNs and the best streaming VPNs, if all you want to do is unblock Netflix.

Review your passwords

You don't need to be a cybersecurity expert or even subscribe to a VPN to begin protecting your data online.

Weak passwords are a major cause of data breaches, for both individuals and businesses. Last year, 123456 was the world's most popular password, and many can be cracked in seconds.

People often re-use passwords. If one is included in a breach, it's highly likely hackers will get into multiple accounts belonging to you.

Complex and lengthy passwords are the solution, and the best password managers make things easy by generating and storing secure passwords for you.

Password managers can be downloaded individually but NordVPN, ExpressVPN, and Proton VPN include them in some of their VPN plans.

Follow good internet practices

How we behave online goes a long way in protecting our data.

Be mindful of what you're signing up to and accepting. Always reject cookies where possible, and always try to verify the validity of the sites you visit, messages you receive, and links you click.

We know they're long and boring, but it's important to read privacy policies to understand what data is being collected, how it's stored, and if it's shared or sold.

This is seen to be an issue with age-check services, as not all of them make this clear. If people don't trust third-parties, they won't hand their data over.

Despite the sheer amount of data collection taking place, individuals can begin to take steps to stop it. So, while the Online Safety Act is unlikely to be repealed, people can turn their attention to practical ways of protecting their data.

We test and review VPN services in the context of legal recreational uses. For example:1. Accessing a service from another country (subject to the terms and conditions of that service).2. Protecting your online security and strengthening your online privacy when abroad.We do not support or condone the illegal or malicious use of VPN services. Consuming pirated content that is paid-for is neither endorsed nor approved by Future Publishing.

After just five years, it’s time to say goodbye to one of the best password managers as Dropbox Passwords is officially calling it quits.

Users of the password manager should start planning on transferring their passwords, usernames and sensitive data to other services as the company has announced the service will begin shuttering services starting on August 28, 2025 when users will no longer be able to add new passwords.

Both the mobile app and the browser extension will become read-only at this point, and the autofill function will also be deactivated on this date.

Beginning on September 11 the mobile app will stop working, though users will still have access to their information through the browser extension, and on October 28, the password manager service will be fully discontinued when both the mobile app and browser extension will have logins deleted.

The dark web monitoring tool will also be discontinued on this date. According to reporting from Android Authority, Dropbox will be permanently and securely purging all customer data from its servers.

Dropbox has stated that the decision to close the service was made so the company can focus on “enhancing other features in our core product,” and according to PCMag, they recommend migrating user data over to 1Password – even including a tool to assist users with the process.

Dropbox Password customers can also create a CSV file of all their passwords to import into any other password manager of their choice by clicking Preferences > Account > Export then selecting > Export to confirm that you want all of your data downloaded as a CSV file. The mobile app offers a similar process, simply use the settings icon, then select Export twice to confirm the download.

When you’ve found a new password manager, there should be an import option that allows for CSV files.

More from Tom's Guide

• Microsoft Authenticator is going to delete your passwords on Friday — what to do right now
• The top 3 cybersecurity risks posed by the Online Safety Act and age verification
• The best password managers in 2025

Microsoft Authenticator users who have not yet made plans to switch to a new method are running out of time: The app will stop storing, managing, saving and auto-filling passwords this Friday, August 1.

Microsoft has been sending out messages for weeks indicating its plan to move to a passkey method; as of June, users were no longer able to add passwords, and as of July, the autofill function was shuttered. Starting in August, users will be unable to access their saved passwords unless they have ported them over to Microsoft Edge.

However, as CNET reports, the passkey method is widely accepted as the next step toward a much more secure option — passwords can be easily guessed via either phishing or brute force, are stored on servers and are often reused or created in an insecure fashion in the first place.

Alternatively, passkeys like a fingerprint or facial recognition, are only available on a personal device and don’t need to be remembered. Users don’t have to use a password manager to keep track of dozens of unique, strong passwords for each account.

The Microsoft Authenticator app has been providing secure sign-ins for mobile accounts that require multi-factor authentication, such as push notifications, password-less logins, time-based one-time passwords or biometric-based confirmation. It let users sign into Microsoft accounts using a PIN, facial recognition (such as Windows Hello) or other biometric data like fingerprints.

Microsoft's support page explains that saved passwords (not generated password history) are securely synced to your Microsoft account, so users can continue to access them and use the autofill functionality with Edge.

What to do to switch to a passkey

More from Tom's Guide

• Microsoft Authenticator will shut off the password autofill feature in July — here’s how to save them
• Millions hit in quishing attacks as malicious QR codes surge — how to stay safe
• The best password managers in 2025

I have a confession to make: I used to reuse passwords.

It’s the number one security sin, but this was over a decade ago and I didn't know about the best password managers yet. This was a huge mistake. And with news that researchers just uncovered a database of 16 billion records, including passwords and other sensitive data, this could be a problem for you, too.

Details are scarce — we don't know where the data came from or who is behind it — but the most important thing is try and look past the feelings of anxiety, and take practical steps to improve your security, and I should know; I've been hacked before.

In 2013, Adobe was hacked and the attackers got a list of 153 million usernames and passwords. These passwords weren’t encrypted which allowed people to read them — they were stored in plaintext — so once the list was out, attackers had all they needed to target unfortunate Adobe users like me.

It was a stressful time and given that your email account houses some of your most sensitive information, once they had access to that account, they could reset your passwords to lock you out of other websites and services too. But I kicked them out and learned pretty quickly how to protect myself from then on.

More than a decade later, there are still attackers trying to get into my account, but there’s an important difference — they can’t now. So, now feels like the perfect moment to share how I learnt from my mistakes and how you can easily improve your security to stop the same thing happening to you.

How to protect your accounts: in short

1. Don't reuse passwords
2. Enable Two-Factor Authentication
3. Delete unused accounts
4. Sign up to Have I Been Pwned
5. Start fresh

1. Don’t reuse passwords

Okay, you’ve probably already guessed this one from earlier in the story, but one of the major issues I had when the Adobe hack happened was I was using the same password on multiple sites. So it was pretty easy for the attackers to use credential stuffing and break into my other accounts too.

Like others, the reason I did this is because there are a lot of passwords to remember! I obviously didn’t want to get locked out of an account, and password reset forms aren’t always that reliable, so I decided that the best course of action was a simple, easy to remember password I could use on all sites.

I thought it was secure as it has numbers, capital letters and symbols. It wasn’t quite as risky as using “password” or “passw0rd,” but it wasn’t far off.

The best way to avoid this issue is to use a password manager like 1Password or Proton Pass (my preferred option). These store all your credentials in one place securely and can generate long, complex passwords for you to use, but never need to remember.

Most have apps for your browser, computer and smartphone too, so you always have access to your passwords.

• Data breaches used to be big news because they rarely happened. But with this new leak, which could be new or repackaged from older hacks, and with more automated or AI-based tools at the hacker's disposal, it's getting even quicker and easier for them to try these details on all of your accounts.

2. Enable Two-Factor Authentication

One of the reasons attackers can get into some accounts so easily is that once they have your username and password, they can just sign in as if they’re you. But what if you had a unique token to show that you are really you, and without it, someone can’t access your account?

That’s the idea behind two-factor authentication (2FA). If you haven’t used this on your personal accounts, you may have done at work. It comes in various forms, but the most common are six-digit codes generated by an app or sent to your phone by SMS.

Requiring one of these codes along with your login details shows that not only do you know the username and password, but you have a known physical item with you that helps to verify it’s really you trying to log in.

This is one of the most effective ways to cut attackers off from your accounts, even if your passwords gets leaked. After I set this up for my Microsoft account (using the free Authy app on my smartphone), hackers kept trying to get into my account, but they never can. It’s an easy way to shore up your defences.

I only know this, though, because Microsoft has a really useful Account Activity page which shows when and where sign in attempts come from and whether they were successful.

If you want even more security for your online accounts, you may also want to consider using a physical security key instead.

3. Delete unused accounts

There’s not really a lot to say on this one: if you don’t use an account anymore, delete it. It’s good to have a cleanup from time to time, and getting rid of old or dormant accounts means less clutter and fewer opportunities for your data to go awry.

Not every site gives you an easy “Delete account” button, but if you head to the company’s privacy policy (usually linked in the footer at the bottom of a website), you can find a privacy contact and send an email to request they delete your data.

Plus, in the years since I was hacked, authorities around the world have strengthened privacy regulations, so in many places, there’s now a legal obligation for the business to comply with your request. This is why you can do things like delete your Google account so easily these days.

4. Get notifications from Have I Been Pwned

Yes, Have I Been Pwned is a strange name for a security website (pwn is hacker slag for gaining unauthorized access), but it is easy one of the best free security resources for protecting your accounts. Troy Hunt, the man behind the site, collates data from hacks and can send you alerts when your account is involved.

This is how I would later find out my details were leaked in the MyFitnessPal, NetGalley, LinkedIn and Last.fm breaches, alongside many, many more — usually random sites I had no memory of even signing up to (and had probably stored my details for at least a decade without my realizing).

It’s easy to use and gives you a very early heads up when you need to change passwords on a hacked account. Hacked data can be messy and difficult to verify, so if you want to check if a specific password has been compromised, there’s a searchable Pwned Passwords database too.

As things stand right now, Have I Been Pwned hasn't loaded this database into its system (the researchers said the data was only exposed briefly, so it's not publicly accessible, and HIBP does thorough verification checks before adding any breach).

• You can perform a manual check of your email address on Have I Been Pwned, but I recommend using the Notify Me service to get an email notification as soon as a hack includes your details.

5. Consider a clean start

By the time hackers were knocking at my virtual door, I’d used my Hotmail email account for almost 15 years. It had built up a long history, and now it was a target, I decided it was time for a fresh start. That’s when I switched from Outlook to Gmail, and more recently, to Proton Mail (which we rate as the best email service for security).

It was a lot of work — I won’t lie to you about that. Going through every account that I had, changing the email address, creating a new password, and setting up 2FA was a big time suck. But it was worth it. My current address has only been involved in one leak (thanks, Twitter), and so there’s less of my data floating around.

Plus, starting from scratch meant that I could make more deliberate security choices. I became more mindful which services I chose to sign up to, where I put my details and how I protected the account. I rarely use my actual phone number unless I have to, and I make sure I opt out of marketing lists.

These aren’t fool-proof techniques that’ll keep your account secure forever; your data is at the mercy of whichever company controls the account. But it does mean I’ve had fewer security issues, I don’t need to worry that someone will get into my account (as they can’t) and I barely get any spam emails now too.

• While it's always a good idea to get rid of unused email subscriptions, risks that way lie too. Some email unsubscribe links direct you to a malicious page to either steal data or download malware. Instead, click the "Unsubscribe from newsletter" buttons that your email provider puts at the top of the email.

More from Tom's Guide

• New AT&T data leak links previously exposed info to Social Security numbers, birth dates
• Meta called out for tracking Android users across the web without their consent — what you need to know
• Microsoft Authenticator will shut off the password autofill feature in July — here’s how to save them

Microsoft users who have been taking advantage of the Authenticator app and its password autofill feature have this month to save their passwords and find a new solution for managing them.

As reported by Bleeping Computer, the app has begun issuing a full-screen banner notification to alert users that the password autofill feature will be deprecated next month. The warning also recommends that users transfer their saved passwords to Microsoft Edge to continue using the autofill feature.

What does the Microsoft Authenticator app do?

The Microsoft Authenticator app has been providing secure sign-ins for mobile accounts that require multi-factor authentication, such as push notifications, password-less logins, time-based one-time passwords or biometric-based confirmation.

However, it is now being shuttered and users are being encouraged to either switch their passwords over to Microsoft’s browser or export their saved passwords before the end of the month.

Microsoft is making the switch a bit easier by including a button at the bottom of the notification window that says “Turn on Edge,” which can be clicked (in iOS) to bring users to the AutoFill & Passwords setting menu, where Edge can be enabled as a password autofill provider.

The notification also links to a Microsoft support page that provides additional information and a timeline of how the deprecation will proceed.

Starting this month, June 2025, users will no longer be able to save any new passwords in Authenticator. During the next month, July 2025, users will no longer be able to use autofill with Authenticator. Then, from August 2025 onward, saved passwords will no longer be accessible in Authenticator.

The linked Microsoft support page explains that saved passwords (not generated password history) are securely synced to your Microsoft account, so users can continue to access them and use the autofill functionality with Edge. To use generated passwords, users can save them from the Generator history by accessing them from the password tab in their saved passwords.

Suppose you don’t wish to use Microsoft Edge. In that case, you can go into the Microsoft Authenticator settings and export the passwords into a CSV file, so they can be imported into a different program.

More from Tom's Guide

• It’s time to stop believing these lies about antivirus software
• More than 184 million passwords exposed in massive data breach — Apple, Google, Microsoft and more
• This new Defendnot trojan can get Windows to disable its own antivirus software

Hacking has been used as a tool for good and evil since machines existed. At its simplest, it refers to using something in a way that wasn’t intended, but it’s generally (and unfairly) regarded by the mainstream public as something perpetually nefarious. So, let’s take a look at the modern history of hacking and see how it’s led to the protections we need today.

The hacks, the myths, the legends

The movies illustrate good-guy ‘white hat’ hackers, bad-guy ‘black hat’ hackers and in-between, ‘grey hat’ hackers, as well. There’s Matthew Broderick in War Games cheekily hacking into his school’s computer system to change his girlfriend’s grades, and Mark Zuckerberg’s pre-Facebook ‘Face Mash’ exploits in The Social Network, as memorable examples. But, it’s another real-life character that bridges cheeky shenanigans and a criminal mindset.

In the 1970s, Apple co-founder Steve Wozniak joined the ‘phreaker’ community which figured-out how to get free, long-distance phone calls by playing the right tones to a payphone. His Blue Box made this simple and Steve Jobs says that without it, there’d be no Apple.

Other notable hacking communities grew from video games: speedrunners use tweaks and exploits to complete games in record times, and early PC gamers overclocked CPUs and graphics cards for upgraded performance. In 2009, a University of Toronto research team hacked graphics cards, using its processors to train a neural network for the first time.

Things are getting serious

Other hackers make a nuisance of themselves for laughs and Wozniak is, worth mentioning. At a time where it was common to manipulate ‘bunny ears’ TV antennae to achieve a clear picture, he’d use a secret TV broadcaster box to produce static that would only vanish when someone held the antennae in increasingly absurd positions. Fast-forward to 2011 and LulzSec hacked into notable Fortune 500 companies and governments. They didn’t steal money but left taunting messages that made global headlines. It was their actions that motivated many big businesses to finally take cybersecurity seriously.

Before that, nuisance virus outbreaks like 2001’s Nimda would quickly infect computers and networks. It didn’t steal anything, just stopped them functioning. This led to an increased adoption of antivirus software such as Norton AntiVirus, which had seen its popularity grow rapidly ever since it was first launched way back in the early 1990s, as concerned users took steps to help block threats.

Fast forward to today and the black-hat hackers are incredibly well organised. Some are using AI to automatically scour the internet for compromised systems, while others are selling off-the-shelf hacking tools to wannabe cybercriminals. They even provide helpdesk support!

Hacking in the modern world

Nowadays it’s common for state actors to hack into organisations to steal IP or disrupt their national infrastructure, while criminal gangs use ransomware to permanently encrypt files unless a ransom is paid. It’s big business too: one ransomware attack recently scored a $75m payout. Major organisations counter with policies like multi-factor authentication and zero trust strategies (where passwords alone are not enough) plus, AI-based behavioural protection that automatically flags and locks-down anomalous behaviour.

Of course, the same major organisations still regularly suffer major breaches, and it’s largely down to the cybercriminals targeting the weakest link in the chain – the users – with all kinds of fake emails, text messages and scams. It escalated during Covid and it’s not slowing down.

One hacker recently showed celebrity Joe Rogan a USB drive that actually functioned as a keyboard. These devices would be left around car parks so that when a curious employee inserted one into their work computer, it instantly typed a series of commands that gave hackers full access.

Protection has evolved

So, with such concerted efforts from criminals and AI to attack you, it’s never been more important to use technology to help watch your back and defend yourself.

It was back in the 1990s that commercially available virus scanners really took off, and there are still some big names from that era protecting their customers today.

Over the years people using their computers and other devices have become acutely aware of the need to add an additional layer of protection, and today’s security suites do just that.

A good security suite should offer a wide gamut of protection and be simple to use. Hackers have been at it for decades and they’re not going away any time soon. Let history be your teacher, and always be prepared for the unexpected!

Apple Passwords is the standalone password management app for Apple Account users, an upgrade from the existing iCloud Keychain password feature. Passwords looks and feels more like other premium password managers on the market, though its primary use case is saving and filling usernames and passwords for website accounts across your Apple devices. This makes it a solid choice for users in the Apple ecosystem, especially those who are either new to password management or who want an app that’s integrated into the operating system.

Passwords is free and built in for those running newer versions of Apple’s OSes (iOS 18, iPadOS 18, macOS Sequoia, and visionOS 2 and up) and syncs as long as you are logged into your Apple Account. Both of these facts further lower the barrier to entry for getting started with password management using Apple Passwords.

While it doesn’t cost anything, downloads automatically upon upgrade, and is easy to learn, Apple Passwords can’t fully compete with most third-party password managers, which offer much greater functionality and multi-platform compatibility. Here’s how it stacks up against the best password managers you can get today.

Apple Passwords: Costs and what's covered

Apple Passwords is a free app for anyone running the operating systems that support it: iOS 18, iPadOS 18, macOS Sequoia, and visionOS 2 (and up). Windows users can access their passwords in Google Chrome or Microsoft Edge via iCloud for Windows. There are no features that require a paid subscription or premium upgrade.

Passwords does basic password management: saving, storing, and filling logins, passkeys, one-time verification codes, and Wi-Fi networks. The app also includes security monitoring, which lets you know if your credentials have been detected in a data breach, and password health reports for weak or easily guessed credentials. At the time of writing, Passwords lacks some features commonly offered by other password managers, such as the ability to save and fill credit cards and identities or store text or files. That said, because Passwords is connected to an Apple Account, there are a few standouts wrapped in, like account recovery options and the ability to add a legacy contact who can access your data (including your passwords) after your death.

I tested Passwords using a 2020 MacBook Air running macOS 15.0.1 Sequoia and an iPhone 15 Pro running iOS 18.0.1 as well as in both Chrome and Safari.

Apple Passwords: Setup

The Passwords app is automatically downloaded when you upgrade to the versions of Apple’s software that support it and will sync across your devices if you’re logged into your Apple Account and have Passwords turned on in your iCloud settings—to do this, go to Settings > [Your name] > iCloud > Passwords and make sure Sync this [device] is toggled on.

When you open the app for the first time on your desktop, you’ll see a series of prompts that guide you through importing passwords, installing a browser extension, and allowing notifications. (If you need to return to the setup process at any point, go to Help > Welcome to Passwords.)

If you have logins already saved in iCloud Keychain, those will auto-populate in the Passwords app. Alternatively, you can import en masse or add individual logins. At the time of writing, Apple Passwords allows imports only via CSV, so if you’re currently using another password manager, you’ll need to download your data in that format in order to add it to Passwords. No other file types or direct imports are currently supported.

Setup on mobile looks very similar. Simply launch the Passwords app and go through the prompts for enabling autofill and notifications. Both apps are unlocked via your enabled biometrics (Face ID or Touch ID) by default but can also be accessed on desktop using your system password. Changes to my vault synced quickly across my devices.

PC users who have iCloud for Windows can also access and manage their passwords in the iCloud Passwords app and browser extensions for Chrome or Edge. To set this up, open iCloud for Windows, click the arrow next to Passwords and Keychain, and turn on Passwords & Keychain. Follow the onscreen prompts to install the appropriate browser extension.

Apple Passwords: Desktop

The Passwords app on desktop has a simple interface with three vertical panes. The far left has icons for website logins (“all”), passkeys, verification codes, Wi-Fi networks, security recommendations, and deleted items. Click on a category to open up the full list of saved items in the middle pane, and click on an individual item to open its details in the right pane.

You can add new usernames/passwords using the plus sign in the “All” tab or new MFA codes using the plus sign in the “Codes” tab. The only information you can include in an item is the username, password, and text notes. Passwords does not have different record types like credit cards, identities, or other types of forms.

In the Wi-Fi tab, you can view all of the networks you have accessed and saved. There are options to share network credentials via Messages, Notes, or other apps and to forget networks. Note that sharing logins is only possible via AirDrop or if you set up a group and add trusted contacts. That said, password sharing is unlimited.

To add a group, tap the plus sign next to Shared Groups on the left pane. You’ll assign a name to the group and add members from your contacts. To receive an invite, contacts must have a device running at least macOS 14, iOS 17, or iPadOS 17.

The security pane shows items that have passwords detected in data breaches as those that are weak or can be easily guessed. There’s an option to change the password, which links you directly to the website to update your credentials—this is a feature offered by a few other password managers (such as 1Password) but not all.

It’s also worth noting that, deleted items remain available for 30 days before being permanently deleted.

Passwords autofill integrates seamlessly with Safari—saved credentials will pop up to select when you tap a form field.

To use form filling with Chrome, you have to add and log into the iCloud Passwords extension, which autofills via iCloud Keychain. You can also add a mini version of Passwords to your Mac menu via Passwords Settings > Show Passwords in Menu Bar.

Apple Passwords: Mobile

The mobile version of Passwords looks and functions just like the macOS app, which makes navigation simple. The main page has the six category icons as well as the option to create groups for securely sharing data with trusted contacts. There’s a search bar at the top and a plus sign in the bottom right corner for adding new passwords. You can also set up new verification codes by tapping the icon followed by the plus sign.

To autofill saved logins from Passwords on apps and mobile browsers, make sure it is enabled in your device settings (Settings > General > Autofill & Passwords) if you didn’t do so the first time you opened the app. Apple allows you to have autofill turned on for both Passwords and another third-party password manager at the same time, and you can select which vault you’d like to access when filling credentials. Generating and saving new passwords and auto-filling existing ones worked well in testing on my iPhone, as did passkey usage.

Passwords on iOS has the same security alerts, MFA support, and sharing options found on the desktop app. One other handy point of consistency is the ability to update compromised passwords directly from the Passwords app.

Apple Passwords: Security

Apple Passwords and Keychain are encrypted end-to-end, meaning your data is only accessible on your device when you are logged into your Apple Account, using AES-256-GCM. Your Apple Account is protected behind two-factor authentication, which requires a verification code each time you sign in on a new device or on the web. (Go to Settings > [Your name] > Sign-In & Security on your device to ensure 2FA is enabled for your account.) If you lose access to your Apple Account, you’ll need to go through one of several recovery options in order to regain it.

Biometric unlock for your Passwords vault is available via Face ID, Touch ID, and Optic ID if enabled on your device.

Apple Passwords: Passkeys

Apple Passwords supports creating and saving passkeys, which are stored in iCloud Keychain and sync across any device where you are signed in with your Apple Account. When you use a passkey, you can opt to log in with biometrics, a QR code from a camera-enabled device, or an external security key like YubiKey. Authentication worked smoothly in Safari, Chrome, and apps on both my devices.

Apple Passwords: Verdict

Apple’s Passwords app is a solid upgrade to iCloud Keychain password management. Its user interface is similar to other premium password managers—allowing you to better view, organize, and update your data—and the convenience of a free, built-in app is hard to beat.

That said, Passwords is relatively simple in terms of functionality: while it lets users create, save, and autofill logins with ease, it doesn’t have any particularly unique features. It also has limited crossover with Windows and no integration with Android or Linux, so it’s really for users who exist primarily in the Apple ecosystem (on newer OS versions) and those who want basic password management that runs primarily in the background. If you already use a fully featured, third-party password manager, Passwords probably won’t completely replace it.

Just when you thought all of the fallout from the LastPass hack back in 2022 was over, hackers have now used stolen data from that incident to launch a series of attacks on users of the popular password manager.

In case you’re in need of a refresher, back in 2022, LastPass fell victim to multiple hacks in which its source code, API tokens, MFA seeds and keys were stolen from customers. With all of this valuable data in hand, hackers then launched a series of attacks in which they went after users’ crypto. Up until this point, LastPass was considered one of the best password managers and came highly recommended.

Then in October of 2023, $4.7 million in cryptocurrency was stolen and then in February of this year, an additional $6.4 million in digital currencies was drained from the accounts of LastPass users.

Now though, as reported by The Block, hackers with LastPass data have stolen yet another $5.36 million from over 40 different crypto wallet addresses of its users. This was discovered by the blockchain expert ZachXBT who claimed in a Telegram post that these new attacks are just the latest fallout from the one that took place two years ago.

In his post, ZachXBT explains that after this $5.36 million in crypto was stolen, the hackers then swapped these funds for Ethereum and proceeded to transfer them to various instant exchanges while converting them into Bitcoin.

Unfortunately with cryptocurrency, there’s really nothing at all victims can do to restore these stolen funds. This is why it’s recommended that you use a hardware wallet to store your crypto instead of a digital one or worse, keeping your crypto on an exchange where you don’t control the private keys.

In a statement to Tom's Guide, LastPass' CTO and CSO Christofer Hoff provided further insight on these crypto thefts, saying:

“A year has passed since initial claims surfaced alleging a link between certain cryptocurrency thefts and the 2022 LastPass security incidents. In that time, LastPass has investigated these claims and to date is not aware of any conclusive evidence that directly connects these crypto thefts to LastPass. Because we take any claims regarding the security of LastPass and our customers seriously, we continue to invite any security researchers who believe they may have evidence to contact the LastPass Threat Intelligence team at securitydisclosure@lastpass.com.”

How to stay safe after a major security incident

Once you find out a service you use has been hacked, you need to take action immediately if you want to avoid getting caught up in the fallout yourself. This means changing your passwords and potentially placing a credit freeze or fraud alert on your financial accounts if they could be at risk.

In the case of a password manager like LastPass though, you want to change your master password which lets you access all of the other passwords and data you have stored with the service. Your master password is protected by strong end-to-end encryption and other safeguards, but you can never be too careful.

ZachXBT also pointed out in his post that the reason so many crypto accounts were attacked using stolen LastPass data is due to the fact that some users might have relied on the service to store their seed phrases or keys. If you’re unfamiliar with crypto, these are what are used to regain access to your account — and your money — when you forget your password.

Seed phrases and keys can be tricky though since storing them online in something like one of the best cloud storage services might seem like a good idea as doing so is convenient. In reality though, this is a terrible idea and one of the best places to store your seed phrase is offline in a safe or even in a safety deposit box. That way, if your other accounts get hacked, it won’t be accessible. Another thing to keep in mind is that under no circumstance whatsoever should you ever share your seed phrase with anyone, especially online.

So let’s say you switched to Dashlane, NordPass or another password manager after 2022’s LastPass breach. Even then, if you have compromised passwords and especially if you reuse them, your accounts could still be at risk. This is why you want to break the password reuse cycle and instead, use a strong and unique password for each of your online accounts. If you have trouble coming up with passwords on your own, a password generator can help make secure ones for you and most password managers include this feature though, there are also free password generators available online.

The cybercriminals behind 2022’s LastPass hack have milked that attack for all its worth but the fact that we’re still seeing that stolen data used in new attacks today might mean that they’re not quite done yet. Only time will tell but by practicing good cyber hygiene and online habits, you should be able to stay safe. If worse comes to worst though, it might also be worth investing in one of the best identity theft protection services as they can help you recover stolen funds (and your identity) more quickly after a crisis.

More from Tom's Guide

• Over 900,000 Americans just had their personal and health info exposed in medical data breach
• What are passkeys? Everything you need to know about the death of passwords
• I’m a security expert — here’s my top 3 tips for protecting your accounts on World Password Day

How secure is your password? For many, the answer will be not very. Research from NordPass, developed by the team behind one of the best VPNs, NordVPN, has revealed the top 200 most common passwords for the last year, across 44 countries. This is the sixth edition of the research, with this year's instalment being the first to reveal both personal and corporate password data.

Globally, "123456" is the most common, with over 3 million uses. Add "789" onto the end of that and you get the second most common password, used by 1.6 million people. Almost half of the world's most common passwords this year are made of the easiest keyboard combinations of numbers and letters, with "qwerty", and its many variations, occupying top 20 spots.

Countries in common?

The US stands alone as "secret" tops the list here, a password not found amongst American's top choices last year. The word "password" can now be considered one of the most common and enduring passwords – year after year it ranks near the top of every country's list. In the US, it is the third most-used password, and it's number one in the UK and Australia.

The study found that 78% of the world's most common passwords can be cracked in less than a second. Compared to last year (70%), the situation is getting worse. Experts have repeatedly urged internet users to make their passwords stronger but many have seemingly misunderstood the assignment.

The popularity of "qwerty" has been challenged by the similarly weak "qwerty123", now the most common password in Canada, Lithuania, the Netherlands, Finland, and Norway. In the US, this password made a huge jump this year, breaking into the top five.

Is this just a personal problem?

This year's edition of the research also examined corporate password usage. You may, or may not, be surprised to know that 40% of the most common passwords used among individuals and business representatives are the same.

There are some interesting differences however. Default passwords such as "newmember" or "admin" are more commonly used for business accounts. Passwords presumably created for new users, and meant for changing, such as "newpass" or "temppass", often get leaked because people are not big fans of changing their passwords.

"No matter if I wear a suit and tie at work or I'm scrolling through social media in my pyjamas, I am still the same person. This means that regardless of the setting I am in, my password choices are influenced by the same criteria – usually convenience, personal experiences, or cultural surroundings", says Karolis Arbaciauskas, head of business product at NordPass.

"Businesses ignoring these considerations and leaving password management in their employees' hands risk both their company's and client's security online."

Password overload

According to previous research by NordPass, a single internet user has an average of 168 passwords for personal use and 87 passwords for work use. Managing this load is simply too complicated for most and experts say it's only natural for people to create weak passwords and reuse them.

However, weak passwords created by company employees serve hackers because with brute-force, dictionary, or similar large-scale attacks, they can gain easy access to the company's IT systems. Another common scenario sees hackers break into the company using leaked personal credentials of an employee just because they used the same passwords for both personal and work accounts.

Improving your passwords

If you are worried about the strength of your password, there's no need to panic. You can very quickly improve your personal security in a few steps.

The first, and easiest step, is simply to create longer, more complex passwords. Passwords should be as long as possible, at least 20 characters long, and be a random combination of letters, numbers, and special characters. A longer password can do wonders and is a simple change. Alternatively, you can use a passphrase, which is a long string of random words.

A second easy step is never reusing passwords. Each of your accounts should have a unique password because if one account gets stolen, hackers can use the same credentials for other accounts.

These are quick and easy steps you take to instantly boost your account security. If you want to go further and have some money to spare, there are a number of password solutions available. One of these is using a password manager. Password managers allow you to easily and securely store all your passwords in one place. Autofill features mean you never have to remember passwords and many of the best password managers will generate, and remember, secure, complex passwords for you.

You can also set up 2-factor authentication (2FA), which adds an additional layer of security to your account. If your password is compromised, 2FA prevents hackers accessing your account. 2FA alerts often come to your phone and you have to approve the login before your account can be accessed.

NordVPN's plus plan includes its password manager NordPass, as well as Threat Protection Pro, Nord's cybersecurity monitoring tool, which scans for data leaks and protects against malware and phishing threats. One of the best beginner VPNs, ExpressVPN, includes its ExpressVPN Keys in its plan. The team behind one of the most secure VPNs, Proton VPN, also offers a password manager. Proton Pass is focused on privacy, and is included in the Proton Unlimited plan.

Switching to passkeys is another option. Passkeys are considered the most promising alternative to replace passwords for good. Most modern online service providers, including Google, Microsoft, and Apple, offer passkey support.

Businesses can adopt password policies in their organisations, setting up 2FA and rules for employees to protect their information. Human error is still a huge cause of cybercrime, so following these steps, and changing your password behaviour can go a long way in protecting yourself online.

Proton Pass, the password management tool from the developers behind digital security services Proton VPN and Proton Mail, is a solid platform that does all of the basics with some unique premium features. In addition to everything you expect from your password manager, Proton Pass offers dark web monitoring, hide-my-email aliases, offline access, and passkey support for mobile apps and browser extensions.

Proton Pass’s paid plans cost more than similar password managers like 1Password, NordPass, and Keeper unless you buy an annual subscription—at the time of writing, this discounts the price below most competitors to just under $24 for an individual and $48 for a family of up to six. Proton Pass also offers an excellent free tier that syncs unlimited credentials across unlimited devices with access to password health reports and up to 10 email aliases.

Navigating Proton can be somewhat confusing at first, and not all features are available across all platforms at this time. However, the company releases updates frequently, so it is catching up with other more established password managers. My Proton Pass review will help you decide if this is the best password manager for you or if you’d be better off going with another service instead.

Proton Pass review: Costs and what's covered

Proton has two paid tiers and a free version of its password manager. Pass Plus is $59.98 per year for an individual user, and Pass Family, which launched in October 2024, costs $83.88 for up to six user accounts. Proton does offer deals on its annual plans though.

Proton Pass is also included with a subscription to Proton Unlimited ($119.88 with an annual plan discount), which comprises the company’s full premium product suite: Proton Pass, Proton Mail, Proton Calendar, and Proton Drive. Proton Duo and Proton Family are essentially Proton Unlimited for up to two users and six users, respectively.

At full price, or when paid month-to-month, Proton Pass is more expensive than most other paid password managers, which charge around $35 per year for a single user. Dashlane is the most comparable in its cost—also $60 per year, though with no discount for annual billing—and feature set, but Dashlane’s premium bundle includes unlimited VPN service.

That said, Proton Pass’s free tier is solid, and Pass Plus and Pass Family are also a great value when paid annually. Proton also offers a 30-day refund policy.

Proton Free includes the essentials of password management: unlimited logins across unlimited devices, password auto filling, passkey support, and basic password health alerts. Free users also get 10 hide-my-email aliases for creating new online accounts. This tier does not come with credit card storage or secure item sharing, features that require a paid subscription to access.

If you upgrade to Pass Plus, you get more granular vault organization and sharing options, unlimited credit cards and hide-my-email aliases, integrated two-factor authentication, the ability to view changes to and previous versions of stored items, and dark web monitoring via Pass Monitor. Your subscription also includes Proton Sentinel, which provides security alerts such as suspicious login attempts.

Pass Family is six Pass Plus accounts bundled together. Each user has their own login and private vaults but can also join shared vaults, and up to two accounts can be designated as admins. With an annual subscription, Pass Family is a good deal with all of the premium features included. For comparison, though, the six-person family plan at Bitwarden is just $40.

Proton Pass supports Windows 10 and up, macOS 13 and up, and most major Linux distributions. Chrome OS is supported via the Android app. Browser extensions are available for Chrome, Firefox, Safari, Brave, and Edge, and there are mobile apps for iOS (16.0 or later) and Android (8.1 and up).

I tested Proton Pass using a 2020 MacBook Air running macOS 12.7.6 Monterey, an iPhone 15 Pro running iOS 17.6.1 and Google Chrome.

Proton Pass review: Setup

Setting up and navigating Proton Pass can be a bit confusing at first, as the password manager is just one of the apps available when you sign up for Proton. You’ll need to create a universal Proton account, which can be used to access any of the tools in the Proton suite, with your email (or a new encrypted Proton address) and a strong password and then enter the verification code and choose a display name. You can then select which Proton app you want to go to—in this case, Proton Pass.

Note that the main Proton dashboard, where most of your global account settings are stored, can be accessed via account.proton.me. It looks like it’s specific to Proton Pass, but you need to use the app switcher to actually go to your vault or any of the other Proton services. This global dashboard is where you can download Proton Pass desktop apps and extensions (though the macOS version wasn’t listed, so I had to go to the support page to find it).

The Proton Pass web app and vault, meanwhile, is located at pass.proton.me. From here, you can adjust Proton Pass-specific settings, such as adding a secondary password if you want another layer of protection for your vault. You’ll also be prompted to install and log into the appropriate browser extension if you haven’t already.

Proton Pass allows you to add individual logins, credit cards, identities, email aliases, and secure notes to your vault, as well as import from a number of other password managers and browsers or CSV upload. Imports are available on the web and desktop apps as well as browser extensions. The browser extension, mobile app, and web app synced almost immediately as I added logins to my desktop vault.

To use Proton Pass on mobile, you’ll log in using your Proton credentials and extra password, if you created one. You can also set up an extra password in the mobile app, though account settings are somewhat buried. Go to the Profile tab, tap the arrow next to your username, and tap the three vertical dots to select Manage account. There is also a separate app settings menu on the main Profile tab. To enable biometrics or a PIN code, tap Unlock with and select the option you want.

Proton Pass review: Desktop

Proton Pass is available on desktop via a web-based vault, a browser extension, and a standalone app. The interface looks nearly identical across all three so you can navigate easily from one to another. The desktop app is nice to have, but you can use nearly all of Proton Pass’s functionality in your browser with the extension and access to your web vault.

The desktop and web apps have a left-justified menu to switch between vaults, which you can use to organize stored items, and your trash folder—items remain here until permanently deleted. You can also sort vault items and pin those that are frequently used so they are always visible underneath the search bar at the top of the vault.

To view or edit an individual vault item, select it from the list to open it. Proton Pass shows each item’s history, including when it was created, updated, and autofilled. In addition to importing data (under Settings > Import) from other password managers, you can manually add items or generate passwords using the plus button in the top-right corner. You can also generate secure links to share credentials, which can be set to expire after a certain time period or number of views.

Further down the menu are your secure link list, Pass Monitor, vault lock, and various Proton Pass settings. Remember that global Proton settings can only be changed from your account dashboard, which will open in a new browser window.

Pass Monitor shows you weak and reused passwords—also visible in each item listing—and items that have inactive 2FA. Unlike some other password managers, Proton Pass does not link directly to websites to update credentials. If you have Pass Plus or Pass Family, you can also set up dark web monitoring for your email address to receive alerts if any associated personal information is found in a data breach.

The browser extension looks very similar to the desktop and web interface, with the main menu accessible by clicking the Proton icon in the upper-left corner. While most features are available within the extension, a few—like Pass Monitor—will redirect you to the web app.

Like most other password managers, enabling the browser extension allows auto-filling from your vault. Click the Proton icon in form fields to select and fill saved credentials, credit cards, and identities (or pause autofill for that domain). If you log in using a username and password that isn’t saved in your vault, you’ll see a pop-up menu prompting you to add it.

Proton Pass will generate and auto-suggest passwords for new accounts, and you can adjust the settings from the pop-up to meet specific website strength requirements. Proton offers hide-my-email aliases for both free and paid users, which can be set up from the browser extension when creating a new account. The browser extension also has full sharing functionality: tap the share button on an individual item to generate a secure link, and select Secure links from the home menu to view the full list.

Proton allows you to keep apps unlocked or enable auto-lock with access via PIN code, password, or biometrics (enabled under Settings > Security) on desktop. The web app can be opened via password or PIN code, while browser extensions accept only PIN codes when locked.

Finally, Proton Pass offers an offline mode for paid subscribers, which allows you to store and access your vault items locally. This can be enabled or disabled in your web or desktop app settings by entering your Proton password.

Proton Pass review: Mobile apps

The Proton Pass mobile app looks similar to the desktop versions but is navigated differently. The main tab shows all vault items by default—including pinned items—and can be sorted alphabetically or by recent or frequent use using the three vertical dots in the top-right corner.

The bottom toolbar has tabs for creating new vault items and accessing Pass Monitor and your profile, where you’ll find settings (including biometric unlock) and your securely shared links. As we noted in the setup process, settings are spread across multiple screens and menus, so it may take some exploration to find what you need.

To use autofill on apps and mobile browsers, select Proton Pass as your primary password manager in your phone’s settings. Autofill worked smoothly in testing, as did creating and saving a new login (with and without a hide-my-email alias) and generating a password directly from a browser window. There is passkey support and an integrated 2FA authenticator, and secure link sharing is also available on mobile.

Proton Pass review: Security

Proton Pass uses strong AES-256 encryption and is zero-knowledge, meaning your data are accessible only to you when you enter your password. The platform’s code is open source for anyone to review for security holes, and Proton was independently audited by a third-party security firm in 2023.

Proton has multi-factor authentication for your global account with time-based one-time passwords (TOTPs) via authenticator apps as well as U2F or FIDO2 hardware keys, such as YubiKey. You’ll also need to download and securely store recovery codes so you can access your account even if you lose your MFA device.

Proton also offers numerous options for both account and data recovery, which you can set up on your global dashboard. You can reset your password via email, phone number, a recovery phrase, or an encrypted backup keychain in your browser’s web storage. You can also set up a recovery phrase, file, or a trusted device to regain access to your email and other encrypted files in Proton. If you don’t enable account recovery, you may not be able to access your account if you lose your password.

Proton Pass supports biometric vault logins via Face ID and Touch ID on iOS and macOS as well as Windows Hello, but at the time of writing, biometric unlock is not available on Android devices.

Proton Pass review: Passkeys

Proton Pass supports passkey creation on Android 14 and later, iOS 17 and later, and browser extensions with the ability to store, share, and export across all platforms. If you create a new login for a site on which a passkey is available—or with an existing credential via a website or app’s settings—Proton Pass will prompt you to save it in your vault. Next time you log in using Proton Pass, you’ll see a pop-up with the option to fill your passkey instead of your password.

Unlike traditional usernames and passwords, passkeys rely on the authentication (usually via biometrics) of a public key with a private one stored in your password manager. They are more secure because the private keys are not kept anywhere that is accessible or at risk in a data breach. In testing, creating and filling passkeys worked well on both desktop browsers and mobile browsers and apps.

Proton Pass review: Verdict

Though newer on the password management scene, Proton Pass offers features like comprehensive security monitoring and passkey support that put it on par with already established tools like 1Password, Keeper, and NordPass — plus extras like hide-my-email aliases and integrated 2FA authentication. It may be especially worth considering if you already use other Proton apps (or plan to in the future): Similar to Nord, your global Proton account allows you to integrate VPN service and encrypted email and storage under one login.

Proton Pass is a great value if you purchase an annual subscription—under $24 at the time of this review—and you can try all of the basics before you buy on Proton’s free tier. The free plan is a solid Bitwarden competitor, with no limits on the number of passwords or devices like those imposed by Dashlane, LastPass, and even NordPass.

Note that Proton is still developing its password manager, so not all features have been rolled out across all platforms, and while the interface is simple and consistent, navigating it can feel clunky at times.

Google’s Password Manager just got a crucial update that could help it take on the new Apple Passwords app that launched with iOS 18 and the best password managers — the ability to sync passkeys across devices and platforms.

Previously Passkeys were restricted to Google’s Android Password Manager, meaning you could only access them on your phone. Desktops, Chromebooks and even the Chrome app on iPhones were completely cut off from those passkeys unless you went through a convoluted process of scanning a special QR code. 

Let's be honest, that's the exact opposite of convenient — which is one of the key benefits of using passkeys in the first place. Thankfully, this update changes this, and allows passkeys to sync across Google Password Manager on all devices. Windows, Mac, Linux and Android for the time being, with ChromeOS currently going through beta testing. 

iOS support is supposedly in the works too, though Google has only said that it will be “coming soon” with no clear timeline.

But cross-platform syncing isn’t all that’s changing. Google’s adding a new six-digit PIN to passkeys, which you’ll need to enter when you start using a passkey on a brand new device. So even if hackers have managed to gain access to your Google account, they won’t be able to use those passkeys to access other online accounts. So long as you don’t use obvious PINs like 123456 or leave it lying around for anyone to find.

Google’s really been pushing passkeys in recent months, even making them the default sign-in option to try and push users away from passwords. With good reason, too. Passkeys are more secure than simple or passwords you’ve reused over multiple accounts. 

The fact that passkeys are “passwordless” means they’re also more convenient, since you don’t have to remember different credentials, nor can they be stolen in phishing attacks. Though it relies on actually being able to access them across platforms, something Google Password Manager wasn’t very good at. Fortunately, though, that seems to have changed. 

More from Tom's Guide

• Dangerous new Android malware drains your bank accounts and completely wipes your device — how to stay safe
• New malware locks Google Chrome in kiosk mode until you enter your password — how to stay safe
• FBI issues warning over scammers impersonating banks to steal your debit cards

A good password manager makes organizing your log-ins efficient and easy to track. If you're not sure where to start, we've found an epic deal on one of our favorite password managers. 

Currently, Keeper is taking 50% off all Unlimited plans. Additionally, you can save 30% off all Business plans. That's one of the biggest percent-off discounts we've seen from Keeper so far. After discount, you can get a Keeper Unlimited 1-year plan for $17.52 (was $35.04) or a 1-year business plan for $84 (was $120). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

We named Keeper one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything found in the free plan, plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

Spring is upon us and while password managers probably aren't the first thing on your mind, one of our favorite services is offering a killer spring sale. 

Currently, Keeper is taking 50% off all Unlimited plans. That's one of the biggest percent-off discounts we've seen from Keeper so far. After discount, you can get a Keeper Unlimited 1-year plan for $17.52 (was $35.04). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

If you're not familiar with Keeper, we named it one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything found in the free plan, plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

1Password has risen to the top of the premium password management ranks over the years with its solid user experience, full feature list, and competitive pricing. At just $35.88 annually for an individual plan, 1Password provides everything you need in a secure password manager, from core functions like autofill across unlimited devices to premium security monitoring and passkey support. 

1Password doesn’t offer a free tier like its competitors, but most of those no-cost plans come with fewer features and/or restrictions that make them difficult to use (the exceptions being Bitwarden and NordPass). Plus, 1Password has unique features like Travel Mode that lets you temporarily hide logins from prying eyes at international borders as well as the ability to restore recently deleted records. 

Finally, 1Password offers cross-platform support for its apps and extensions, making it a solid choice for Apple, Windows and Linux users alike. Our 1Password review will help you decide if this is the best password manager for you or if you’d be better off looking elsewhere.

1Password review: Costs and what's covered

1Password costs $35.88 per year for a single user and $59.88 per year for a family of up to five, and you can add additional users to the family for $1 per person per month. Unlike some of its competitors, 1Password has no free version, but it does offer a 14-day trial to new users. 

With a 1Password individual plan, you get unlimited password syncing across an unlimited number of devices, two-factor authentication, 1GB of document storage, 30-day storage of recently deleted passwords, premium support and security monitoring and alerts. The family plan includes sharing functions and account recovery for connected users who are locked out of their vaults. 

On desktop, 1Password supports macOS 10.15 Catalina or later, 64-bit versions of Windows 10 or Windows 11, Chrome OS and several Linux distributions including Ubuntu, Debian, Mint, Fedora, Red Hat Enterprise, openSUSE, Arch and CentOS. There's even a command-line interface for Windows, Mac, Linux and the Unix derivatives FreeBSD and OpenBSD.

Browser extensions are available for Chrome, Firefox and Edge on Windows, Mac and Linux, plus Brave on Windows and Mac and Safari on Mac. Opera, Vivaldi and other Chromium-based browsers can use the Chrome app. The iOS mobile app requires iOS 15.5 or later, while the Android app supports Android 9.0 and later. Finally, you can always access your vault on the web. 

I tested 1Password 8 on a 2020 MacBook Air running macOS 12.7.1 Monterey, an iPhone 15 Pro running iOS 17.1.1 and Google Chrome. 

1Password review: Setup

[1Password Create Account]

To get started with 1Password, you first need to create an account at 1Password.com. You'll have to verify your email address and create a strong master password for accessing your vault. 

During the setup process, 1Password will also generate your Emergency Kit. This is a PDF containing your vault address, email address, Secret Key (more on that below) and a place to write down your master password.

Your Emergency Kit ensures you (or someone you trust) always has the necessary information to access your 1Password account, so you should print it out and securely store at least one copy. If you need to access the Emergency Kit later, you can find it in your account profile or settings, depending on which device you're using.

Note that you can change your master password or regenerate your Secret Key—you’ll just want to be sure you update your Emergency Kit to reflect this new information. When I initially set up my account, my master password contained symbols not found on a mobile keyboard, making it impossible to type my password in to unlock the app. 

Next, download the desktop and mobile apps. You can use 1Password solely via the web vault and a browser extension, but the desktop app has biometric unlocking so you won't have to enter your master password every time you want to access your vault.

The app setup process is a little bit different depending on your device and operating system, but you'll find all app options and steps in your web vault by clicking your profile icon in the upper-right corner and clicking Get the Apps. Pairing devices is especially easy if you scan your setup (QR) code, which you'll find in your web vault or your Emergency Kit.

Once you've entered your master password on the desktop or mobile app, you can enable supported biometrics like Face ID, Touch ID, Windows Hello or face, fingerprint, or iris unlock (as well as auto-unlock using Apple Watch). On mobile, go to Settings > Security and select your biometric option. On Windows, settings are found under 1Password > Settings > Security and on macOS under 1Password > Settings > Security. You can also select how often you want the app to require your password to re-up biometric access.

Finally, grab the relevant 1Password browser extensions for quick access to your vault as well as autofill, saving and updating logins, password generation and more features in your browser.

Importing passwords works on either the web vault or the desktop app (found by tapping your name icon in the web vault or File > Import on desktop). 1Password supports imports from a handful of other password managers as well as CSV files. There are more specific import options on the web than on the desktop.

1Password review: Desktop

1Password's interface has some minor differences between the web vault and the desktop app, but the basic navigation is similar enough. There's a left-justified menu bar for toggling between different collapsible sections of your vault. On the web, this includes favorited items, record categories and tags, as well as your archive, which holds onto removed records until you permanently delete them. 

The desktop app has a category drop-down instead of listing them on the menu bar. 

When you click on a record, you can view, copy or open-and-fill the credentials. There's an edit button either in the top or bottom toolbar. To add a record, tap the plus button. 1Password has a long list of pre-built templates, including ones for passports, medical records, rewards programs and outdoor licenses such as for hunting and fishing.

The menu bar is also where you'll find Watchtower, 1Password's set of security-monitoring tools. This includes lists of your weak and reused passwords; unsecured websites (logins that are connected to http:// pages that don't use encryption); compromised or breached websites; and logins in your vault that have two-factor authentication or passkeys available that aren’t yet enabled.

You can set up 2FA for these accounts right from your 1Password vault when in the desktop app. Interestingly, I got different data about my reused and weak passwords between my web and desktop vaults.

1Password offers the option to create multiple vaults in your individual account so you can organize or share records around specific purposes or projects. For example, you could create a vault with estate-planning documents to share with a partner or spouse, or a vault specific to your social-media accounts. You always have the option to view all your vaults at once or to toggle between them.

1Password also has Psst!, a secure data-sharing service that lets you send someone who isn't a 1Password subscriber a temporary link to view data saved in your 1Password account.

So, for example, if you wanted to send your Netflix password to your brother-in-law, you could send him a link that expires after 1 day and displays the password. Links can expire after as little as one view, or last up to 30 days.

You can also create a vault specifically for trips abroad and enable a unique 1Password feature: Travel Mode. This tool hides the vaults you wouldn't want customs and border control agents to see while still allowing you to access vaults you deem safe.

The Travel Mode option can be toggled on in the web vault at 1Password.com under Profile > Manage my Private vault and toggled off once you return home.

The 1Password browser extensions have most of the features you could need: You can view your entire vault, search for records, generate and autofill passwords (just tap the plus icon) and add, view and edit items. For seamless functionality, including biometric unlock, 1Password extensions require you to run the most up-to-date version of your browser — an important security measure but one that requires frequent restarts on Chrome.

To use autofill, tap the 1Password icon in any form field and select the login you want to use. 1Password will also automatically suggest generated passwords when creating new accounts with a button to save the credential to your vault.

There's also 1Password Quick Access for Mac, Windows, and Linux, which is part of the desktop app and can be accessed via the icon in your main taskbar. This replaces the 1Password mini in previous versions and allows you to find, view, and autofill items without leaving your current app window. In order to enable the full functionality, you may need to adjust your systems’ accessibility features.

As part of a deal with webmail provider Fastmail, 1Password also offers "masked" email addresses that let you generate random Fastmail addresses when signing up for a new online service. The catch is that you have to pay for a Fastmail account, which starts at $3 per month or $36 per year (though you do get a 30-day free trial). 1Password also supports Privacy Cards, merchant-specific, single-use virtual payment cards for shopping online. You have to create and link your Privacy account, but there’s a free plan for up to 12 cards per month.

Finally, 1Password has a long list of keyboard shortcuts for its apps and extensions for faster access to features and functions.

1Password review: Mobile apps

1Password's mobile apps have been updated to include more features, including full Watchtower reports, to better reflect the desktop experience. Plus, they’re more intuitive to navigate than in previous iterations.

The main toolbar lets you toggle between your home screen — which you can customize to show tiles for your favorite or most recently or frequently used logins — as well as categories, search, and Watchtower. You can manually add records from any screen using the plus icon, and you can sort your item list by title as well as date modified, created or used.

Under Settings, now found by tapping your profile icon, you'll find options for security features like biometrics and passcodes, auto-lock timers and Watchtower functions.

You can toggle on autofill in Settings, but as with most other password-manager apps, you’ll also have to enable autofill in your phone settings. You can select 1Password as the default if you have multiple password managers plus your phone’s keychain.

Once enabled, 1Password will fill and save logins in browsers and apps from your keyboard. When login info is required, 1Password will either suggest a login (upon unlock) or launch for you to select one. It will also give you the option to create and fill a new username and password. On iOS, 1Password also has a Safari extension, though the autofill function seems smoother.

One feature I miss on the 1Password app is a password generator. This function pops up when you create or edit an existing record, but there’s no standalone tool as offered by competitor apps from Dashlane and NordPass.

1Password review: Security

Like most of its major competitors, 1Password uses AES-256 encryption to secure your data on your devices and on its servers. Only you can unlock your vault locally using your master password.

1Password adds an extra layer of security with your 34-character Secret Key, which is created and stored locally on your device and prevents hackers from accessing your data outside of your computer, tablet or phone. You do not need to remember or enter your Secret Key to get into your password vault, but you can (and should) save it in your Emergency Kit. 

1Password is also SOC 2 Type 2 certified by the Association of International Certified Professional Accountants (AICPA) to securely manage consumer data and ensure privacy. 

Two-factor authentication on 1Password is available using an authenticator app such as Authy, Microsoft Authenticator and Okta Verify or with a U2F hardware key like YubiKey or Google Titan. 

Finally, 1Password supports a handful of biometrics for unlocking your vault, including Face ID on iOS, Touch ID on iOS and macOS, Windows Hello, Linux biometrics and fingerprint, face and iris unlock on Android. You can also log into your macOS desktop app using an Apple Watch.

1Password review: Passkeys

1Password currently supports creating, saving, and signing in with passkeys through the 1Password desktop app on Mac and Windows as well as across mobile devices running iOS 17. You can view, manage and share saved passkeys on Android. Watchtower will also identify existing accounts that can be secured with a passkey and link you to create one through the desktop and mobile apps. 

Unlike passwords, which can be compromised fairly easily through data breaches, passkeys aren’t stored anywhere for malevolent actors to access. Instead, there is a credential stored on your device that nobody can access. This is called a private key.

When you need to log into a site or application, the site will use a public key to request that you authenticate this private key, typically using biometric authentication like FaceID. Once authenticated, you are able to log into the site or application just like if you had a password.

As of November 2023, the ability to unlock 1Password with a passkey — rather than managing your master password and Secret Key — is available only as a private beta for iOS users. 

1Password review: Bottom line 

1Password is a top-notch password manager that is secure, easy and intuitive to use, and priced competitively. It functions consistently across web, desktop and mobile with all the features you’d expect—including more advanced passkey support than its competitors—as well as standouts like comprehensive security monitoring with Watchtower and a Travel Mode. 

Unlike with Keeper, you don’t need to pay for add-ons to get these features, and 1Password users aren’t charged a premium for access to VPN services a la Dashlane. Your $35 per year gets you everything 1Password has to offer. 

1Password doesn’t offer any type of free plan, so if you’re looking for no-cost options, Bitwarden or NordPass may be worth considering. But we can highly recommend 1Password among paid premium options. 

LastPass has long been one of our favorite password managers thanks to its simple interface, premium features, and affordable pricing, and it’s still a solid choice at just $36 per year for individuals and $48 per year for families. 

However, other password managers have caught up with and even surpassed LastPass, which now lacks some functionality of similarly priced platforms, including passkey support—and no longer has as many unique features or an unrestricted free option comparable to Bitwarden. The LastPass interface also appears outdated alongside the likes of competitors Keeper and 1Password. Plus, LastPass has suffered a handful of security issues in recent years, which is not something you hope for in a tool meant to protect your passwords. 

Our LastPass review will help you decide if this is the best password manager for your needs or if you’d be better off choosing something else.

LastPass review: Costs and what's covered

LastPass has three plans: Free, Premium (individual) and Family. At $36 per year for an individual, the premium personal tier is in line with other similarly featured password managers, while the $48-per-year family plan (up to six users) is cheaper than those of many competitors. 

For many years, LastPass' free tier was a steal, with most of the basic features you'd want in a password manager, including unlimited syncing across all your devices. However, the company in early 2021 limited syncing to a single device type: Users on the free plan can access their vaults on mobile or on desktop, but not on both. 

Other premium, paid password managers with free tiers have similar limitations, such as the number of devices or number of passwords (or both), so LastPass does still have a leg up. But with Bitwarden offering unlimited free syncing, LastPass may no longer be the top free choice. 

That said, LastPass Free users still get to have an unlimited number of passwords, one-to-one sharing, secure notes, limited multi-factor authentication, security tools like password hygiene and dark-web monitoring and the LastPass Authenticator app.

An upgrade to LastPass Premium ($36 annually) unlocks unlimited device syncing, one-to-many sharing, advanced MFA, 1GB of file storage, emergency access, 1-to-1 support and a host of security-monitoring features. LastPass does offer a 30-day free trial so you can test out the premium features. 

The LastPass Family plan ($48 annually) has all the same features as Premium with unlimited shared folders for up to six users. 

To run the LastPass browser extensions, you must have Windows 8.1 and later or one of the most recent two versions of macOS, Linux or Chrome OS. There are browser extensions for Chrome, Firefox, Safari, Edge and Opera, desktop apps for Windows and macOS, and mobile apps for iOS (14.0 or later) and Android (9 or later). 

I reviewed LastPass on a 2020 MacBook Air running macOS 12.7.1 Monterey, an iPhone 15 Pro running iOS 17.1.1 and Google Chrome. 

LastPass review: Setup

To set up LastPass, start by creating an account on LastPass.com with your email address and a strong (and memorable) master password. 

You can also enter a password hint, although this step may be unnecessary and perhaps risky since there's also an account recovery option.

Next, you'll be prompted to install the browser extension, though you can access your web vault without doing so. There are basic extensions for major browsers, as well as universal installers for Windows and Linux, which will add full-featured "binary component" extensions to all of your browsers at once. Mac users can grab this via the "full version" Chrome extension.

These "binary" extensions, which will share your login state across browsers and automatically log you in, among other things, may be helpful if you use multiple browsers on your machine though.

Once you're logged into your web vault, you can add individual items or import them from other password managers by uploading an exported file or basic CSV. The import tool can be found under Advanced Options at the bottom of the menu bar.

LastPass has a wide range of built-in item types for passwords and payments as well as health-insurance plans, Wi-Fi credentials and instant-messenger accounts, plus completely customizable templates.

On mobile, download the LastPass app and log in with your email address and master password. On iOS, you'll be asked to enable Face ID right away (or Face Unlock on a Google Pixel) for easier access to your app, or you can turn on biometrics later (Settings > Security) if they're supported on your device.

There are also desktop apps available for both Mac and Windows. You can get the former from LastPass' download page, while the latter is available in the Microsoft store. Both are basically app versions of the web vault.

If you’re on the free plan, LastPass allows you to switch between desktop and mobile three times before locking you into a device type.

I found LastPass' help articles less straightforward and more difficult to navigate than competitors' support sites. If you're new to password management, this may be frustrating.

LastPass review: Desktop

The main way to use LastPass on the desktop is as a web vault and browser-extension combination. The online vault has a left-justified collapsible menu bar with a Home button for viewing all items and shared records, as well as tabs for passwords, notes, addresses, payment cards and bank accounts. LastPass will display items as tiles or in a list, which can be sorted alphabetically or by recent use. 

As noted above, though, you can create a range of different item types as well as customized templates. To create a new record, tap the plus sign in the lower-right corner. If you hover over the icon, you'll also see an option to create a new folder.

Further down the main menu bar are options to view your security dashboard, emergency access, account settings and advanced options (import, export, account history, deleted items and one-time passwords).

The security dashboard shows you a password-health report as well as dark-web monitoring of email addresses found in your LastPass account. Once you activate web monitoring, LastPass sets you up to receive an email alert if any of your information is found in a data breach. This service is always scanning in the background and does not need to be requested manually.

The sharing and emergency-access screens show you whom you've granted access to your individual records as well as your entire vault. Emergency access can be activated immediately or up to 30 days after a trusted contact has requested it without a response from you.

The account settings are the clunkiest part of an otherwise straightforward (if somewhat outdated) interface. This is where you can update security preferences, enable multi-factor authentication and view connected mobile devices.

The browser extension has most of the functionality of the web vault. You can view, edit and launch all of your items, add new records, generate and fill passwords, enable auto-login and see recently used credentials.

To autofill in your browser, tap the LastPass icon in the form field and select the correct login. When you need to create a password, LastPass will pop up its password generator in the form field and then ask if you want to add the credential to LastPass.

LastPass review: Mobile apps

Like the web interface, the LastPass mobile app is simple (but less dated). The navigation at the bottom of the screen is for your main vault, your security tools and your account settings. Under the vault tab, you can view all items or tap to open specific record categories.

You can also search for individual items or tap Add in the upper-right corner to create a new record using any of the same item types available on desktop. Plus, you can add attachments like photos, files and even audio recordings to a record.

In the security section, you'll find the password generator, emergency access settings, your password-strength report and the option to switch vaults (if you have multiple identities set up).

Note that while there is an option to tap and view your security dashboard, the mobile app does not actually create that report and instead tells you to go to your web vault to view it.

Finally, the settings tab is where you'll adjust security and login options, such as enabling biometrics, auto logout and account recovery. There is a "Remember Master Password" setting, which when toggled on would autofill and log you into your vault, though even LastPass notes that this is not recommended.

To enable autofill, go to your phone settings and select LastPass as your password manager. LastPass popped up automatically when I tapped the Passwords option above my keyboard in my browser so I could select the correct credentials.

You can also launch sites directly from individual records or by tapping on an item in your main vault, and LastPass will ask if you want to autofill with stored credentials. However, LastPass had a difficult time detecting and filling credit-card fields in multiple mobile browsers.

LastPass review: Security

LastPass operates using AES-256 encryption, which protects your data locally on your device and on the company's servers (and in between). LastPass does not have access to your master password or your vault content. 

LastPass is also SOC 2 Type 2 compliant according to the Association of International Certified Professional Accountants (AICPA), which means it can be trusted to securely handle consumer data, and the company undergoes regular security audits. 

All LastPass plans include two-factor authentication options for vault access. Free users can enable MFA with apps like LastPass Authenticator, Google Authenticator, Microsoft Authenticator, Duo and more. Premium subscribers can also use hardware keys like YubiKey as well as fingerprint and smart-card readers.

Finally, LastPass offers account recovery if your master password is lost. The best option is to use a one-time password on a device you've previously used with LastPass. These are generated automatically and stored locally on any device on which you've logged into the extension or web vault and are used as part of the email verification to recover your account.

Alternatively, you can recover your account via SMS or using a password hint previously set up, but neither of these processes are very secure. On mobile, you can toggle the option to use biometrics for account recovery, though anyone with a biometric profile on your device will be able to access your vault.

Note that LastPass suffered a major hack in 2022. While the company reported that no user passwords or data were compromised, the breach was one in a string of security issues for the platform.

LastPass review: Passkeys

As of November 2023, LastPass does not support creating, storing and editing passkeys in user vaults — making it the last of the major password managers to launch this feature. However, the company states that this functionality is coming soon. 

LastPass review: Bottom line 

LastPass is still worthy of consideration with its affordable price point (especially its $48-per-year family plan) and feature set consistent with other premium password managers.

However, unlike its competitors, LastPass has not evolved much visually or functionally since our last review: it has nixed some of its standout features over the years, and it now falls behind most of its competitors, including similarly priced 1Password and Keeper, on passkey support. Thanks to device restrictions, its free tier cannot keep up with the no-cost plan offered by Bitwarden and even the free plan available from NordPass is slightly less limited. 

Dashlane is perhaps the most premium of the password managers on the market, and its price point — $59.88 per year — reflects both its comprehensive features, including full passkey support, and its user experience. If you have a need for extras like a VPN service, Dashlane’s fee may be worth considering. 

However, competitors like 1Password and Keeper offer similar features for much less (around $35 per year), so it may be hard to justify the high cost of a Dashlane Premium subscription. Plus, the platform’s standout automatic password changer has been dropped since our last review. Finally, Dashlane’s heavy restrictions on its free plan have rendered it all but useless, and the company no longer offers a standard free trial, so you have to subscribe to try it out. 

Our Dashlane review will help you decide if this is the best password manager for you or if you’d be better off with something else instead.

Dashlane review: Costs and what's covered

Dashlane has two paid tiers: Premium at $59.88 per year for a single user and Friends & Family, which costs $89.88 per year for up to 10 users. While Dashlane no longer sells its mid-range Essentials tier at a price point similar to competitors (around $35), subscribers already on this plan can continue to renew it. 

There's also a free Dashlane plan, but its functionality is extremely limited — you can store just 25 passwords on a single device (reduced from 50 in November 2023). While you do get some security-monitoring capabilities and passkey functionality, free users no longer receive live customer support, and the fact that Bitwarden is fully featured makes Dashlane's no-cost offering far less appealing. 

Plus, Dashlane no longer offers a 30-day free trial for all users, so the only way to access Premium features at no cost is to refer a friend, which gets you each a six-month subscription.   

With Dashlane Premium, you get unlimited password storage and sharing, unlimited device syncing, secure notes with 1GB of secure storage, dark-web monitoring and a VPN provided by Hotspot Shield — which is where the premium price tag comes from. (To be fair, $25 per year for one of the best VPN services is a steal, since a standalone subscription is $96 annually.) The Family plan is basically Premium with up to 10 accounts.    

For most users, Dashlane no longer has a desktop app — instead, it operates primarily via a web app and browser extensions on Windows, Mac, Linux and Chrome OS as long as both the extension and browser are up to date (within the last two major versions). Extensions are available for Chrome, Firefox and Edge as well as other Chromium-based browsers like Opera and Brave. 

Note that Mac users on Safari will need both the macOS app and Safari extension, which is a component of the desktop app (all other browsers on macOS use the web app). The Safari extension requires macOS 13.0 or later. On mobile, Dashlane supports iOS 16 or later, watchOS 6.2 or later and Android 8.0 or later.

For Dashlane testing, I used a 2020 MacBook Air running macOS 12.7.1 Monterey, an iPhone 15 Pro running iOS 17.1.1 and Google Chrome. 

Dashlane review: Setup

To set up a Dashlane account, you'll need to install the browser extension. Click the Create an Account button, which will open a new window and prompt you to enter your email address followed by a master password. Make sure you make the master password memorable or write it down someplace safe. You can also set up account recovery — highly recommended — via biometrics on mobile or generate a recovery key in the web app’s security settings upon login. 

Once your account has been created, you'll enter your vault, which includes a guided “Get Started” onboarding process for adding bulk or individual passwords and connecting mobile apps. Scan the QR code to open the appropriate app store on your device, or navigate directly there and download Dashlane's mobile app. 

Dashlane supports CSV uploads but does not have separate steps for importing from other password-management tools. Note that all of this happens inside the Dashlane browser extension, through which you can access the fully featured web interface by selecting Open the web app.

To enable biometric unlock, open the My account menu in the web app, go to Settings > Security settings, and toggle Local unlock on. You’ll need to enter your master password and follow the prompts to add your selected unlock method. This is the same menu where you’ll find 2FA and account recovery setup. 

The first time you log in on a mobile device, you'll also have to enter a verification code sent to your email address to authorize your device before you can enter your master password. You can go ahead and enable biometrics upon login or do so later in Settings > Security. The app has a similar guided onboarding process for adding passwords and enabling autofill, which you have to complete before your full vault loads in the Home section. 

If you create your account on mobile, you’ll be asked if you want to connect to Dashlane on your computer. 

Dashlane review: Desktop

Dashlane on desktop is just Dashlane via web vault and browser extension, as there is no standalone app. The vault has a collapsible, left-justified menu bar for toggling between item categories and security tools as well as a search bar. Tap Logins to view vault records, and click on individual records to open, view and edit the details. Dashlane will notify you within a record if your password is weak or compromised and direct you to change your credentials by sending you to the external website (Dashlane will prompt you to save your updated password).

There are also granular autofill settings for individual records, such as auto-login, and you can share the record or launch the website from this view. Alternatively, you can click the three horizontal dots next to the item to quickly launch the website, copy your credentials or add it to a collection.

To add a new item, click the Add new button at the top of the vault window. You can share an item from this view as well, or within the Sharing Center. Other sections in the main navigation bar include notes, payment methods, personal info (addresses and emails, for example) and IDs (which currently include ID cards, Social Security numbers, driver's licenses, passports and tax numbers).

Note that you must add a record within the correct category — the Add item button in Passwords does not have the template for a passport, for example.

Further down are the security tools, including Password Health for weak, reused and compromised passwords and Dark Web Monitoring, which scans the dark web for up to five email addresses that may have been leaked in data breaches. You have to verify added email addresses to activate monitoring. If any leaks are detected, Dashlane will guide you to click through to change your account credentials. Dashlane previously ran a beta of an automatic password changer, but this standout feature was dropped.

The browser extension pop-up from your browser toolbar has most of the basic functions you'll use regularly. You can view your entire vault, search for individual items, open and edit records and generate new passwords. Most other functions will redirect you to the web app. The extension’s autofill tab allows you to pause or turn off autofill on the website you’re currently on as well as globally.

To autofill credentials, click the Dashlane icon in the form field and select the item you want to fill in. If the icon is green, Dashlane has something to fill in. If it's grayed out, you'll have to enter the item manually. When creating a new account, Dashlane will automatically suggest a generated password and ask if you want to save the account to your vault.

In testing, the extension and web app worked together seamlessly—however, they did crash when I attempted to bulk delete logins from my vault. While this is not a process you’re likely to do regularly, it is frustrating to have to reload. Note that unlike some competitors, Dashlane does not temporarily store recently deleted logins, so if you remove them, they’re gone permanently.

Dashlane does have a limited emergency access feature that requires you to export your data as a protected file and share the password with a trusted contact. Note that you’ll need to re-download your vault each time you update a record.

Dashlane review: Mobile apps

The mobile app is clean and easy to navigate and has all of Dashlane's functionality, including full-featured dark web monitoring. 

The main navigation bar has a Home button that pulls up all items in your vault or selects specific categories with an option to search or add a record. Under Tools, you’ll find your security tools (Password Health and dark web monitoring), shared records, and 2FA authenticator as well as your VPN service. There’s also a tab for your password generator.

The final section is your Settings, where you can customize some basic security preferences like biometrics and connect additional devices using a QR code.

To enable autofill, set Dashlane as your default password manager in your phone settings. Dashlane will auto-suggest credentials or open within your browser to suggest login options. This worked smoothly in my apps as well. You can also create and save new credentials into Dashlane directly from the login interface.

Dashlane review: Security

Dashlane uses AES-256 encryption to secure your data, and your information is unlocked on your local device only when you enter your master password and any enabled two-factor authentication methods. That means that Dashlane employees never have access to your vaults, and hackers cannot see your data even if they manage to access Dashlane's servers. 

Two-factor authentication is available for all Dashlane accounts, free or paid, though free users should be careful to enable or disable 2FA with the single device they're using for Dashlane, as doing so on a secondary device will re-encrypt your account and you'll lose your data. Free users should also securely save 2FA codes, as they will no longer be able to receive recovery codes from live customer support.  

2FA works by default with a master password and verification code sent to your contact email, but it can also be set up via web or mobile and the Dashlane Authenticator app for iOS or Android (or apps like Authy, Google Authenticator and FreeOTP). Dashlane does not support U2F hardware like YubiKey for 2FA, though you can use a security key in place of your master password to unlock the web app. 

Dashlane supports Windows Hello and Touch ID on macOS. Fingerprint unlock is available on most Android devices, and there's support for Touch ID and Face ID on iOS. You can also enable PIN unlocking on your mobile devices. 

Dashlane review: Passkeys

Dashlane currently supports saving, storing, and editing passkeys across its web and mobile apps for websites that have this functionality. On the web and iOS 17, you must be logged into Dashlane before creating a passkey. Android 14 users must have Dashlane selected as an identity provider under Settings > Password and Identity. (As of November 2023, you can create passkeys for apps but not websites on Android devices.) 

Passkeys are stored alongside regular logins in your vault but can be distinguished by the accompanying passkey icon. 

Dashlane is currently working on passkey login functionality for its own apps. 

Dashlane review: Bottom line 

Dashlane offers an exceptional user experience and full-featured password management, but it comes at an ultra-premium price. The primary added value with its $60 fee appears to be VPN services from Hotspot Shield—if you don’t need this, you’ll get similar offerings from 1Password, Keeper and LastPass at just over half the price. 

These days it feels like the more you shop online, the more log-ins and passwords you have to remember. Fortunately, one of our favorite password managers is taking half-off its annual plans. 

Currently, Keeper is taking 50% off all Unlimited and Family plans. That's one of the biggest percent-off discounts we've seen from Keeper so far. After discount, you can get a Keeper Unlimited 1-year plan for $17.49 (was $34.99) or a Keeper Family plan (five users) for $37.49 (was $74.99). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

We named Keeper one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything found in the free plan, plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

Bitwarden is a top contender for password management because it offers a lot of value at a low price. The platform is highly secure and open source, and it has the best free tier of any password manager on the market. 

Users can get unlimited syncing of unlimited passwords and basic functions like autofill and secure note-storage and sharing at no cost, while premium features like security monitoring and emergency access costs just $10 a year — much less than the $35 annual fee for competitors with similar functionality. Plus, all other free plans out there limit the number or type of device for vault syncing, and Dashlane allows you to store just 25 passwords total. 

Bitwarden isn’t as seamless as some other password managers when it comes to autofilling logins and forms, but it offers all the essential features, including some passkey support, for less than the likes of 1Password, Keeper, and NordPass. Our Bitwarden review will help you decide if this is the best password manager for you or if you’d be better off paying a bit more for something more intuitive.

Bitwarden review: Costs and what's covered

Bitwarden offers three pricing tiers for consumer accounts: Free, Premium ($10 per year) and Family ($40 per year).

The free tier comes with most of the basic features you'd want in a password manager, making it a good option if you're just looking for safe storage. The Premium plan is a bargain when compared to similar tiers offered by other password managers, which often run about $35 per year. 

Users on Bitwarden's Free plan get unlimited password and secure-note storage across as many devices as they want. There's also a password generator and an innovative feature called Bitwarden Send for sharing sensitive text-based information.

Bitwarden will auto-fill usernames and passwords through its browser extensions on the desktop and with the Bitwarden mobile apps on iOS and Android. Form filling for identities and payment info is included with this tier, but only via browser extensions on desktop.  

If you upgrade to a Premium account, $10 per year gets you all of the above features, plus file sharing via Bitwarden Send, the Bitwarden Authenticator app for verifying your identity on accounts that use 2FA or time-based one-time passwords (TOTPs) and an emergency access feature that lets you grant vault access to another user in case of, well, an emergency. 

This premium tier also comes with 1 GB of secure storage, priority support, advanced 2FA options such as YubiKey and "health reports" — basically, security audits (manually generated) that show you if your passwords are weak, recycled or have been exposed in a data breach. 

If you know how to set up a server, then Bitwarden also offers self-hosting (versus cloud hosting) options with all plans for anyone who wants complete control over their data using their own server.

The Bitwarden server can be anything from a leased cloud instance to a Raspberry Pi sitting on a shelf in your living room. Bitwarden has server specifications and instructions here, and there's a good third-party walkthrough here.

Finally, Bitwarden's $40-per-year Family plan is basically Premium for up to six users with unlimited sharing between accounts. 

As we've noted, Bitwarden Free is a solid option for basic password management — maybe the best one out there. LastPass, one of our other top freemium picks, now limits syncing on its free plan to only computers or to only mobile devices, a significant gap that Bitwarden fills. 

LastPass does include some of Bitwarden's Premium features, such as the ability to use an in-house authenticator app, in its free tier, but at $36 per year, its premium option costs nearly four times what you'll pay for a similar Bitwarden plan.

The premium and family plans offered by other password managers will also set you back a lot more than $10 (or $40 for families) annually, which may be attractive only if you really need bonus features like a built-in VPN. 

The Bitwarden desktop application supports Windows 10 and 11; macOS 10.14 and later; and most major distributions of Linux. The Windows and Mac versions can be downloaded directly from the Bitwarden website or via the Windows and Mac app stores.

There's also a "portable" Windows version you can install on a USB flash drive. If you want to get really elite, there's a command-line version that works on Windows, Mac and Linux alike.

There are Bitwarden desktop browser extensions for Chrome, Safari, Firefox, Opera, Brave, Microsoft Edge, Vivaldi and the Firefox-based Tor browser as well as a beta for DuckDuckGo for macOS 11.4 or later. Mobile apps are available for both iOS (11.0 or later) and Android (5.0 and up). You can also access your vault via any web browser at vault.bitwarden.com. 

I reviewed Bitwarden on a 2020 MacBook Air running macOS 12.7.1 Monterey, an iPhone 15 Pro running iOS 17.1.1 and Google Chrome. 

Bitwarden review: Setup

[Bitwarden Account Create]

To get started, you'll need to create an account on Bitwarden's website using your email address and name. You'll also choose your master password and an optional password hint. There is no account recovery for individual or family users if you forget your master password, so the hint may be helpful. Either way, make your master key something both secure and memorable. 

Bitwarden doesn't do much hand-holding through the setup process, although its help pages are actually pretty useful. Once you have your account set up, you'll be logged into your web vault to start importing and organizing your passwords.

To import data from LastPass, 1Password, Firefox, Chrome or another one of many supported file formats, select Tools > Import Data in the web app (File > Import Data on desktop) and fill out the dropdown fields. If Bitwarden doesn't officially support the service you currently use, you can create and upload a CSV file. Note that data uploads are not possible on mobile.

Next, download the relevant desktop and mobile apps as well as browser extensions. It took almost no time for me to install these and get logged in, and my items synced automatically. Extension features like autofill and password generation functioned immediately, with no additional setup needed.

Bitwarden review: Desktop

Bitwarden would be easy to use with only the browser extension and web app, as the desktop app doesn't add any functionality and is only slightly sleeker.

In fact, some features, such as emergency access (under Account settings) and vault health reports (under Reports), are available only in your web vault.

The browser extension looks a lot like a mobile app, with tabs for your main vault, Bitwarden Send, a password generator and your settings.

There are a few ways to use the automatic form filling feature. There’s no Bitwarden icon that populates in the form field — if the website you're on has a saved login, the Bitwarden extension icon in your browser toolbar will have a number on it. Tap the icon to open the extension and select the password you want to auto-fill. You can also set up autofill on page load, which will fill the username and password fields but not automatically log you in.

To auto-fill credit cards or identities (addresses, for example) when checking out or filling out forms, toggle the Bitwarden extension icon and choose Tab. All available cards and identities should be visible to select. Alternatively, you can right-click (CTRL + click on Mac) on the form field and select from a list of autofill options on the drop-down.

Bitwarden also has a few standard keyboard shortcuts to auto-fill the last-used login, though this was not enabled by default on my Chrome profile (you can set up shortcuts in your extension settings). I found it easiest to open the extension right away and select from there.

Bitwarden's password generator is a little bit clunky compared to those of other password managers — instead of auto generating in the form field, you have to manually go into the Bitwarden extension to create and copy/paste a password. When you create a new login on a website, Bitwarden should ask if you want to save it to your vault.

Sharing texts and files with Bitwarden Send is quick and easy using the browser extension. You can also view and edit the item or copy login information directly from the extension.

If you opt to download the desktop app as well, you'll find a left-justified menu bar where you can select your specific login types to view all the usernames and passwords in that category.

You can also organize or view by folder — use the plus sign to create a new folder — or view your favorites or trash. Search the selected category using the search bar at the top and add a new record using the plus icon at the bottom.

If you toggle Send at the bottom instead, you can create file or text links to content on your computer, which you can then copy or share to send. You can select a date on which access to your send will expire, or on which your send will be permanently deleted, as well as a maximum access count.

File sharing is available only with a Premium account, though you can send text links on the Free tier. Send recipients do not need to use Bitwarden to open the sent links or files.

Unlike the browser extension (and the mobile app, as described below), the Bitwarden desktop app does not have a separate tab for the password generator. Instead, you'll find it under View in the main application toolbar.

Bitwarden review: Mobile apps

Like the desktop app and browser extension, the Bitwarden mobile app is basic. The interface and functionality are almost exactly the same, so the experience will be similar no matter which device you're on. 

The default screen is your vault home, organized by item types and folders. There's a plus sign in the upper right corner to create items and a search icon to search your entire vault. If you tap on Login or another item type or folder, you'll see the full list of items in that category. 

Tap on the three horizontal dots to view, edit or copy the account information. You can also launch the website or app directly from Bitwarden.

Password auto-fill is easy to enable in your phone settings — but unless you want to type in your master password each time you need to connect to Bitwarden, go to Settings > Unlock with Face ID or Unlock with PIN Code in the app. Once enabled, this feature works smoothly. However, you cannot auto-fill cards or identities on mobile.

The Bitwarden app has a built-in password generator, which allows you to set the parameters for the password and copy it to paste directly into the app or website.

You can also use Bitwarden Send in the app just as on the desktop: Create links to text or content on your device, which you can copy or share using any share options on your phone. Toggle the Send icon on the bottom toolbar and select the plus sign in the upper right corner.

Bitwarden review: Security

Like most password managers, Bitwarden uses AES-256 encryption to protect the data stored in your password vault. Your information is only unencrypted, and only locally on your device, once you've logged into your vault with your master key. 

Bitwarden is also SOC 2 Type 2 and SOC 3 compliant, meaning the organization has met standards set by the Association of International Certified Professional Accountants (AICPA) for handling consumer data. Bitwarden undergoes a security audit every two years, but it's also open-source, so the code is available for anyone to review for flaws.

All Bitwarden users get several 2FA options for accessing their vaults. Free-tier members can set up a two-factor authentication login process using email verification or an authenticator app like Authy or Google Authenticator.

The Premium tier also supports Duo Security, YubiKey and FIDO U2F-compliant USB security keys. As mentioned earlier, Premium subscribers can also use Bitwarden's own authenticator app instead of a third-party one.

Once you've logged in with your master password and any enabled two-step method, you can unlock your vault using a PIN or a biometric method. Bitwarden supports fingerprint and face unlock on Android, both Touch ID and Face ID on iOS, biometrics on Windows 10 via Windows Hello and Touch ID on macOS.

Bitwarden review: Passkeys

Passkeys, or private keys, are stored locally on your device, meaning no one can access them. A site or application that supports passkeys will use a public key to request that you authenticate this private key, typically using biometrics, to log you in. Unlike passwords, passkeys are not susceptible to hacks or data breaches, making them more secure. 

Bitwarden currently supports passkey storage for all subscribers, though passkeys can only be saved and used via the browser extension. Passkeys are not editable, and they are viewable but not usable on mobile and other Bitwarden clients. Bitwarden expects to add passkey support for logging into its own applications in the future. 

Bitwarden review: Bottom line

We highly recommend Bitwarden for highly secure password management, especially its free tier, which is the only no-cost plan to still offer unlimited syncing across device types alongside the basic features you’d need in a password manager. 

Bitwarden’s $10-per-year premium plan is the most budget-friendly of the bunch — comparable plans start around $35 annually — and comes with extras like security audits, advanced 2FA and additional storage. Bitwarden is not the most intuitive to use, especially its autofill function, but it does the basics and does them really well. 

NordPass is a solid password management option with all of the tools you’d expect, though it also has a simple, intuitive design. NordPass has caught up to competitors in some ways: it launched a web vault and standalone browser extension as well as biometric login support across platforms, and it removed device limits for its premium tier. NordPass also offers passkey support across its desktop and mobile apps, web vault, and a handful of browser extensions. 

At $45 per year, NordPass does cost more than similar password managers like 1Password, Keeper and LastPass (all around $35 annually), though the price has actually dropped since our last review, and frequent promotions can cut the fee significantly. NordPass does have a free tier which includes most of its features, the primary limitation being that you can only be logged in on one device at a time.

While NordPass’s setup process is a bit roundabout, the user experience is consistent across platforms. Our NordPass review will help you decide if this is the best password manager for you or if you’d be better off with another one instead.

NordPass review: Costs and what's covered

NordPass has two paid tiers and a free plan. NordPass Premium costs $44.85 per year, while NordPass Family (for up to six Premium users) comes to $89.85 per year. As noted above, this is a tad pricier than most premium password managers, which charge about $35 per year. However, NordPass offers frequent sales as well as a discount on two-year plans. 

The exception is Dashlane, which charges $60 for a premium account. But Dashlane Premium bundles in dark-web monitoring and unlimited VPN service, whereas NordPass doesn't seem to offer any discount for NordVPN.

NordPass Free comes with the most basic functions of a password manager, including unlimited password storage; autofill for passwords, forms, identities and payments; passkey support; secure notes; and multifactor authentication. The biggest limitation with the free tier is that you can stay logged in only on one device at a time. 

So while you can use NordPass Free on a phone, tablet and computer — and your vaults will sync automatically — logging into your account on one device will log you out on all the others. While this may be slightly inconvenient, it's still more flexible than free plans that limit you to one or two devices in total, or to a certain number of passwords. 

With an upgrade to NordPass Premium, you get sharing capabilities and basic security monitoring for old, weak or reused passwords as well as for those exposed in data breaches. NordPass previously limited premium users to six devices at a time but now allows unlimited simultaneous logins. 

NordPass Premium also includes 3 GB of secure online storage, passkey sharing, and Emergency Access capabilities. NordPass even has a 30-day free trial of the Premium tier that you can claim in the app, and there is a 30-day refund policy.

The Family plan simply bundles six Premium accounts. It's a decent value at $89.85 annually for households with older children or college students or even a group of friends, since the vaults are not linked together. But again, LastPass for Families costs just over half as much.

NordPass supports Windows 10 and up for both 32-bit and 64-bit systems, macOS 11 and up and any Linux distribution that supports snap 64 bit. There is no desktop app for Chrome OS, but you can always access the Web Vault. Browser extensions are available for Chrome, Firefox, Safari, Brave, Opera and Edge, and there are mobile apps for iOS (15.0 or later) and Android (9.0 and up). 

I reviewed NordPass using a 2020 MacBook Air running macOS 12.7.1 Monterey, an iPhone 15 Pro running iOS 17.1.1 and Google Chrome. 

NordPass review: Setup

To get started with NordPass, you have to download the desktop application (or the mobile app), after which you'll be prompted with a pop-up to create an account. This will take you back to the website to create a Nord account, which is a centralized login for all of Nord's services (VPN and secure document storage, for example).

It's a bit clunky and unfortunately requires you to have two separate passwords. Once you have a Nord account, you can go back to the NordPass app and log in.

From there, you'll create a master password for NordPass. Make sure to save this somewhere secure. You should also go ahead and generate a recovery code (Settings > Reset Recovery Code), which you'll need to access your vault if you forget your master password.

NordPass does not have a detailed onboarding process, but you can tap the Get Started tab in the left-hand menu to view basic setup options, such as adding or importing passwords and enabling a browser extension.

To add an item to your vault, you can import from a handful of other browsers and password managers or upload a CSV. You can also add individual logins, passkeys, payment methods or identities.

On mobile, you'll again need to log into your main Nord account to be redirected to entering your NordPass master password in the app. You can opt to use an emailed verification code instead of your Nord account credentials. Once you're logged in, though, you can go to Profile > Settings and enable biometrics (if not already prompted to do so) if you want to skip entering your master password each time you access the app.

Both the browser extension and mobile app synced automatically from my desktop vault. Remember that with a free NordPass account, logging in on mobile will log you out of the desktop app and vice versa.

NordPass review: Desktop

On the desktop, NordPass is available as a standalone app, a browser extension and a web-based vault. The interface is consistent across the desktop, browser extension and mobile environments, making it easy to find what you’re looking for no matter where you access your vault. 

In August 2023, NordPass released a fully featured browser extension that works without the desktop app — many functions will open in a tab that mirrors the Web Vault. If you install the desktop-paired extension, it will redirect you to the desktop app for those functions, such as manually adding logins, sharing items, changing your settings, and viewing your password health and data-breach reports. Note that only one extension can be enabled at a time. 

The Web Vault, as NordPass calls it, lacks the ability to autofill and autosave passwords and other items, so you'll want to have the desktop app or the full-feature browser extension installed on at least one of your machines.

The desktop app has a left-justified menu where you can select and view specific login types as well as notes and shared items. You can organize your data into folders or view your trash, which saves items until you permanently delete them. 

You can edit, copy or organize an item from the main vault list (tap the three dots next to the item name) or by clicking on and opening the individual item. You can add an item manually from any screen in your vault using the button at the top-right corner. Open your settings, including biometric unlock, multi-factor authentication, and autofill/autosave, using the gear icon at the top of the menu.

At the bottom of the menu are your Tools, including your password generator and security reports, the latter of which is a Premium-only feature. Password Health shows you old, weak and compromised passwords and links you out to the websites needed to change them, while the Data Breach Scanner tells you if anything in your vault, including credit cards, has been leaked online. You can also see password strength within each item's listing.

NordPass has a premium feature called Emergency Access for trusted contacts, which lets you designate certain other NordPass users, such as friends or family members, viewing access to your NordPass account if you fail to respond to an access request for seven days. (Other password managers let you adjust the waiting period.)

The browser extension defaults to a screen showing all of your logins, though you can open the hamburger menu to select a specific category or folder.

To autofill your login or payment info, you must have the browser extension enabled. The NordPass icon will appear in the form field on any website for which you have a saved credential (or if it detects a payment or identity field). Simply tap the icon and select the correct login. There are no keyboard shortcuts for the extension.

When creating a new account, NordPass will automatically open the password generator and an autosave pop-up menu for adding your credentials to your vault, a process that worked smoothly (albeit eagerly, with the pop-up appearing a few times even after closing out). You can tap the Show Options dropdown to change the password strength requirements. NordPass will also prompt you to update an existing password upon login if Password Health detects your password is weak or has been reused.

To share an item, toggle the three dots next to the login and select Share. You can enter the email address of the recipient and select permission levels. View and manage this in the Shared Items tab on the main menu.

Finally, one handy feature of the extension and desktop app, especially if you share your machine, is autolock. Go to Settings > Security to select how long you want the app to remain open before requiring your master password (as little as five minutes to as long as one month).

NordPass review: Mobile apps

On mobile, NordPass looks similar to the browser extension, though it has full functionality for adding credentials, sharing items and accessing settings and security-monitoring tools. 

You'll find all the same menu options under the Browse tab and your main vault screen on the Home screen. Tools houses your security-monitoring options, and Profile directs you to your settings (including biometrics and MFA setup).

To use autofill on mobile, you'll have to enable NordPass as your primary password manager in your phone settings. If you have a saved login for a website or app, a NordPass menu will pop up and allow you to select the correct credential.

When creating a new account on a website, you'll have to go back to the NordPass app to generate a password, copy it and paste it in the app or on the website. You'll also have to manually create a login in the app, as it will not autosave from a mobile browser. That said, I did appreciate how easy it was to access NordPass’s password generator on mobile.

NordPass review: Security

NordPass uses XChaCha20 encryption, which secures your password vault with 256-bit keys. Like most password managers, NordPass is zero-knowledge, so only you can see your data on your local device when you enter your master password. Your vault is never accessible to NordPass employees or hackers via the company's servers. The platform underwent its first security audit in early 2020. 

Multi-factor authentication is available for both free and paid NordPass accounts with one-time password generators, including Google Authenticator, Microsoft Authenticator, Authy and Duo. You can also set up MFA to work with any U2F hardware key, such as YubiKey. 

Supported biometric login options on NordPass include FaceID and Touch ID on iOS and macOS devices, Windows Hello and biometric unlock on Android.

NordPass does offer account recovery with a code you can generate in your settings, but you must do this prior to losing your master password, or you'll be locked out of your vault (since you need your password to create the code initially). NordPass support can reset your account, but all of your saved items will be deleted in the process. 

NordPass review: Passkeys

NordPass supports passkey creation, storage, and synching on all desktop and mobile applications, Firefox and Chrome browser extensions, and the web vault. When you sign up for a new account for which a passkey is an option, you’ll be prompted to create one and save it in your vault. If you have an existing login for a site that supports passkeys, you can change your password to a passkey in your account settings. Unlike 1Password, NordPass does not identify existing accounts in your vault for which passkeys are available. 

Passkeys provide higher security than passwords because they aren’t stored in a way that can be accessed or compromised in a data breach. If you have a passkey enabled with your login, the site will use a public key to request that you authenticate this private key, typically using biometrics. 

All NordPass users, including those on free plans, have passkey support. NordPass is expecting to introduce passkey sign-in for its services at some point in the future. 

NordPass review: Bottom line 

NordPass offers a solid user experience (other than the initial setup process) and is closer in terms of features and price with the likes of 1Password, Keeper and LastPass than in our previous review. However, it still costs slightly more with no significant leg up in form or function, and it doesn’t include extras like its NordVPN service, as Dashlane does. 

The NordPass free tier is more flexible and full-featured than those offered by Dashlane, Keeper and LastPass, which have stricter device sync limits. But users looking for a low- or no-cost password manager may want to consider Bitwarden, which offers unlimited syncing for free users and charges just $10 per year for its premium plan. 

Keeper's password manager comes with strong security features and a simple, consistent user experience no matter which platform or device you're using, making it a solid choice among better-known competitors such as 1Password, LastPass and the higher-priced Dashlane.  

While Keeper's free tier won't be useful for most people because it's limited to just one mobile device, its premium individual plan (Keeper Unlimited) is competitively priced at $35 per year. Keeper also lets you buy individual add-on features such as online storage and dark-web monitoring.  

One long-standing downside to Keeper had been a lack of built-in templates for various document types — it offered only basic identity forms. However, 20 new templates were rolled out just before this review was published, bringing Keeper in line with others of the best password managers.  

Read on for the rest of our Keeper review.

Keeper: Costs and what's covered

Keeper offers two pricing tiers for personal premium plans, and two for families. Keeper Unlimited costs $34.99 per year for an individual, while the basic Keeper Family plan costs $74.99 per year. (For the moment, Tom's Guide readers can get 40% off either plan.)

For the Plus Bundle — which adds dark-web monitoring to the basic features — you'll pay a total of $58.47 annually for an individual and $103.48 for a family.  

Keeper does have a very basic free version, which limits you to password, identity and payment-method storage, as well as a password generator and two-factor authentication (2FA), on a single mobile device. 

However, since Bitwarden and Myki offer completely free unlimited syncing, and other competitors have more flexible no-cost tiers, this free Keeper plan has little value.   

If you pay $34.99 for a year of Keeper Unlimited, however, you get unlimited password, identity and payment method storage across an unlimited number of devices. 

This tier also comes with secure storage for up to five files, file-sharing capabilities, emergency access and phone support. Keeper offers a 30-day free trial for its premium tier so you can test out its features before committing.  

The Keeper Family plan ($74.99 per year) is similar to Keeper Unlimited but allows up to five separate password vaults and 10GB of secure file storage.  

Keeper also has a combined plan, called the Plus Bundle, which simply adds its BreachWatch dark-web monitoring service plus more storage to the unlimited and family tiers for a total of $58.47 and $103.48 per year, respectively. 

You can also purchase BreachWatch ($19.99 per year), expanded storage (starting at $9.99 per year) and priority support ($99 per year) as separate add-ons to your selected plan.  

Keeper supports Windows 7, 8 and 10; the most recent two versions of macOS; and some common distributions of Linux, including Fedora, Red Hat, CentOS, Debian, Ubuntu and Mint. 

There are browser extensions (known as KeeperFill) for Chrome, Safari, Firefox, Opera, Internet Explorer, and Microsoft Edge. Mobile apps are available for both iOS (11.4 or later) and Android (6.0 and up). You can also access your vault through the Keeper website.  

For this review, I tested Keeper on a 2020 MacBook Air running macOS 10.15.7 Catalina and an iPhone XR. I used Google Chrome for browser testing. 

Keeper: Setup 

To get started with Keeper, you'll need to create an account with your email address and a strong master password. Keeper will also prompt you to set up a security question for account recovery — we'll go into more detail on this below.  

Note that if you skip the security-question step, you'll continue to see prompts for it when you open your vault on any device. You can always reset the question in your account settings. 

Once you're logged in, Keeper has step-by-step onboarding pop-ups to guide you through the setup process, including for creating or importing logins, installing the browser extensions and enabling two-factor authentication. You can skip any of these steps and come back to them later. 

To populate your vault, you can either create individual records or go to Settings > Import to choose from a long list of supported browsers and password managers, or to upload a CSV file. Each option has in-app instructions for exporting from the original platform. 

You'll also want to install the browser extension, called KeeperFill, which allows you to autofill logins and payment methods online and quickly create and save new logins. 

Next, download the desktop and mobile apps for your platform(s). You can use Keeper without the desktop app, which looks and functions very similarly to the web vault. 

However, the desktop version allows biometric logins and comes with KeeperFill for Apps (on macOS and Windows), which pops out a desktop version of the extension that you can keep open and move around your screen for easier (and constant) access to your vault. 

Keeper requires an extra layer of verification, such as an emailed code or a push notification, when you log into the mobile app for the first time on a new device before you're allowed to attempt a master password. 

Once you approve the device, you can log into your vault, which syncs automatically from the web or desktop. You can then enable biometrics, such as Face ID, in your app settings for faster access. 

If you're newer to password management, you'll likely appreciate Keeper's onboarding process and online-support articles, which are detailed and easy to follow. 

Keeper: Desktop

You can use Keeper as a web-vault and browser-extension combo, or you can add the desktop app. The interface and functionality are very similar between the web vault and desktop app: There's a collapsible left-justified menu bar where you can toggle between your main vault, identities and payments, security monitoring tools and deleted items. The vault will display your items in a list or as a visually appealing grid with website logos.  

Manually creating a new record is simple. The default record type has fields for a title, username, password and web address. The dice icon next to the password field autofills using Keeper's password generator. You can also add custom fields, files and two-factor authentication codes to individual records.  

At the time that we were testing Keeper for this review, the password manager had no templates or record types for identity documents, such as passports and driver's licenses, and the only way to create them was to use custom fields. 

But in January 2022, Keeper added more than a dozen new templates for payment cards, bank accounts, passports and other common record types. Each template can be further customized with additional fields.

Back in your main vault, hover your mouse cursor over a record to launch the website in your browser. Click the record to view the details or tap the three dots in the upper-right corner to edit, share, favorite, duplicate or delete the record or view its history.

Sharing an item is easy. Simply enter the email address of another Keeper user and select the permission level. You can see anyone you've shared a record with here too. 

Tap the drop-down arrow next to your email address in the upper-right corner to pull up your account information (including emergency access settings) or your vault settings, which is where you'll find import/export, customization tools and security options.

Emergency Access gives up to five people you designate, who must have Keeper accounts, access to your vault after a specified period of inactivity on your part, ranging from immediately to up to 3 months. 

Vault settings, meanwhile, allow you to enable biometric access such as Touch ID and Windows Hello (desktop app only), as well as two-factor authentication and a self-destruct function that deletes locally stored files after five failed password attempts. 

The Security Audit tool shows you your weak and reused passwords and gives you color-coded strength scores. You can launch websites directly from individual records to change passwords. 

BreachWatch scans for credentials that may have been compromised in data breaches. Again, you can open the record and launch the website from within this report.

Another reason to consider the desktop app is access to offline mode, which makes an encrypted copy of your vault available on your local device, secured behind your master password or biometrics. This feature is also available on mobile and is helpful for app autofilling if you're without Wi-Fi. You can toggle this on and off on the bottom toolbar in the app. 

The KeeperFill browser extension does all the key things like auto-filling, credential-saving and password generation. The auto-submit option is a nice feature: Keeper will autofill and then actually submit matched credentials to log you in.

You can search your vault for specific items, though you can't view a complete list in the extension (tapping Vault will redirect you to the web vault). It's easy to select from multiple accounts that exist on a single website and to create a new record with a generated password. Keeper will detect updated credentials and ask if you want to save them in your existing records. 

To access the extension, you can tap the Keeper icon in the form field. This sometimes didn't appear for me, so other options include a keyboard shortcut (command+shift+k on macOS or alt+k on Windows) or a right-click on the credential field. The former opens the main extension, the latter a pop-up menu where you can select an action. 

Keeper: Mobile apps 

The Keeper mobile app is fully functional and more streamlined than previous versions. The bottom toolbar lets you navigate between your main vault list, BreachWatch, app settings and your account information. 

The plus button lets you quickly create new records, folders and payment methods or upload a file. You cannot mass-import passwords on the mobile app — Keeper will redirect you to the web.  

Toggle open the More menu in the upper-left corner to view navigation options similar to what's available on the desktop app and web vault. This is where you'll find the Security Audit and your identity/payments list, as well as your favorites, shared items, files, trash and two-factor codes. 

When you create a record on mobile, you have the added option to scan in a photo or document, which Keeper will translate to plain text and attach to the Notes section. 

To enable Keeper's autofill function, available on both iOS and Android, go to your phone settings and select Keeper as your default. Tapping the Password (iOS) or Sign into Keeper (Android) button above your keyboard when entering credentials will open KeeperFill, and you can select, search or create a new record and tap Fill. 

Keeper may also detect and offer an existing login from your keyboard options. In my testing, this only worked in apps, not in the mobile browser. Also note that Keeper didn't always detect email-address fields as stored credentials, which meant I had to know or look up which email address I'd used in order to move on to the password screen. 

One helpful customization: You can launch a website from individual records in Keeper and set the default mobile browser you prefer each website to open in. 

Keeper: Security

Like many password managers, Keeper uses AES-256 encryption to secure data on its servers as well as your devices. Your information is unencrypted locally on your device only when you enter your master password, so neither Keeper employees nor hackers can access it.  

Keeper is also SOC 2 Type 2 compliant, which means it's trusted by the Association of International Certified Professional Accountants (AICPA) to manage consumer data. The platform is also subject to regular security audits.  

Both free and paid Keeper users can set up two-factor authentication to access their password vaults. Keeper supports time-based one-time passwords (TOTP) sent via SMS (not recommended if you can help it) as well as apps like Microsoft Authenticator and Google Authenticator and hardware security keys like YubiKey and Google Titan. An Apple Watch or Android Wear device can also be used for 2FA via the KeeperDNA app.  

After you enter your master password and any enabled 2FA method, you can unlock your Keeper vault using biometrics: Face ID on iOS, Touch ID on iOS and macOS, fingerprint and face unlock on Android and Windows Hello. 

Keeper does offer an account recovery option if you lose your master password. It's enabled by default on new accounts, and it requires you to set up a security question when you create your account.

You get to create the security question instead of being limited to pre-filled options, but keep in mind that using a question that someone else knows the answer to is a security risk. If you answer the question correctly, you'll get a verification code sent to your email address, which will then prompt you to reset your master password. 

Keeper password manager review: Bottom line

If you're willing to pay for a password manager, Keeper deserves serious consideration. The design is simple, consistent and easy to navigate across all major platforms and devices, and Keeper matches most of the features of similarly priced competitors.  

We're also fans of Keeper's security measures and its mix-and-match add-on options like extra storage and dark-web monitoring. Now that more identity-form templates have been rolled out, Keeper is one of the top premium password managers on the market.   

If you're looking for a free option, though, Keeper isn't it. Its one-device limit (mobile only) is surpassed by more flexible no-cost plans from LastPass and NordPass as well as by Bitwarden's free tier. 

We're just days away from the official Presidents' Day date, but that's not stopping retailers from offering epic Presidents' Day sales right now. One of the best deals today comes from Keeper, which makes one of the best password managers we've tested.

Currently, Keeper is taking 60% off all plans via our exclusive Keeper Security promo code. (It's the first code on the page). That's the biggest percent-off discount we've seen from Keeper, which usually offers 50% off discounts. After coupon, you can get a Keeper Unlimited 1-year plan for $14 (was $34.99) or a Keeper Family plan (five users) for $30 (was $74.99). 

If you have multiple passwords, you'll be glad to know that Keeper is one of the best password managers we've reviewed. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

We also like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

Even though you may have downloaded them from an official app store, fake apps can lead to all sorts of problems, from fraudulent charges to malware being downloaded onto your smartphone. But what if the fake app in question is impersonating one of the best password managers?

In a blog post on its site, LastPass is warning users that a fake app is impersonating the popular password manager on the Apple App Store. The app in question tries to copy LastPass’ official app down to a T by using the company’s branding and mimicking its user interface.

However, if you look close enough, you’ll notice that the fake app is called “LassPass” and not “LastPass”. Unfortunately though, due to the way in which our brains are wired to read, unsuspecting LastPass users may have accidentally downloaded this fake app. The reason being is that its name plays on typoglycemia, or the phenomenon where when a word has the correct first and last letter but the letters in between them are wrong, we still read it correctly.

Fortunately, this fake “LassPass” app has now been removed from the App Store but if you did download it and try to log into your account, you could be in trouble. Here’s everything you need to know along with some steps on how to avoid falling for fake apps in the first place.

The worst kind of fake app

Other fake apps can’t do nearly the amount of damage that one impersonating a password manager can. This is because a password manager is used to store all of your credentials across a wide variety of sites and online services.

At the moment though, we don’t know whether or not this fake “LassPass” app — developed by Parvati Patel with a privacy policy hosted at blunee[.]com — was able to steal the login credentials or master passwords of LastPass users. If it was though, this could have serious implications for any LastPass user that accidentally downloaded it.

With your master password in hand, the creators of the app could access your LastPass password vault and from there, gain access to all of the credentials you’ve stored within it. From here, they could lock you out of your social media accounts and worse, drain your bank accounts.

If you did happen to download this fake LastPass app, then you’re going to need to change all of your passwords ASAP. If you still have access to the password manager, you’re in luck as it includes the ability to automatically change many of your passwords. If you don’t though, you’re going to have to do this manually which can be a tedious and time-consuming process. Still though, it beats losing access to all of your online accounts.

How to spot fake apps on the App Store

Despite Apple and Google’s best efforts, fake apps impersonating popular brands do manage to slip through the cracks from time to time. This is why, even if you’re looking for new apps on an official app store, you still need to be able to spot a fake.

In this case, a simple examination of the app’s name would have done the trick since LastPass was spelled incorrectly. However, sometimes hackers, cybercriminals and scammers use foreign alphabets to make their fake apps — and websites — appear more legitimate. When this happens, you want to scroll all the way down on an app’s listing page and look for developer info on the Google Play Store or the seller info on the App Store.

The actual LastPass app is developed and distributed by LogMeIn, Inc while the fake one had Parvati Patel listed as its creator. This is a major red flag and a sign that you should avoid an app entirely. Normally, apps have the name of the company that developed them listed on the app store which is why the name of an individual developer stands out like a sore thumb.

If you’re worried about fake apps on any official app store, you can always go to a company’s official website and then head to their app store listing from there. Just be careful on Google Search though as scammers like to impersonate big brands by buying ads on the search engine. For this reason, you should always scroll down past the sponsored results until you find the real ones. Most businesses have a direct link to their apps on their sites and if you’re concerned you might not be able to spot a fake, this is the best course of action to take when installing new apps.

Another thing you want to look out for are ratings. While the actual LastPass app has over 52 thousand ratings, the fake LassPass app only had one, five-star rating. At the same time, you also want to check any user reviews as people are quick to point out when they’ve been scammed by a fake or malicious app.

The fake LastPass app has now been removed from the App Store, but Tom’s Guide has reached out to Apple to learn more about how this happened in the first place. We’ll update this story if and when we hear back from the iPhone maker.

More from Tom's Guide

• This iOS 17.3 feature keeps vital data locked when your iPhone is stolen 
• This is the one reason iPhone still beats Android on security
• Own an Apple device? 7 crucial security measures you need to take right now

December is here and if you want to keep your online accounts safe this holiday season, a good password manager is a must. Right now one of the best password managers we've tested is 25% off 

Currently, LastPass is taking 25% off all Premium and Family plans via coupon code "LP-TOMSGUIDE25". That's one of the biggest percent-off discounts we've seen from LastPass so far in 2023. For more ways to save, make sure to read our guide to the best LastPass coupon codes.

In our LastPass password manager review, we said its simple and consistent interface, strong feature set, and inexpensive Family plan contribute to this password manager's value. 

Although there's a free version, an upgrade to LastPass Premium unlocks unlimited device syncing, one-to-many sharing, advanced MFA, 1GB of file storage, emergency access, 1-to-1 support and a host of security-monitoring features. LastPass does offer a 30-day free trial so you can test out the premium features. 

The LastPass Family plan ($48 annually) has all the same features as Premium with unlimited shared folders for up to six users. To run the LastPass browser extensions, you must have Windows 8.1 and later or one of the most recent two versions of macOS, Linux or Chrome OS. There are browser extensions for Chrome, Firefox, Safari, Edge and Opera, desktop apps for Windows and macOS, and mobile apps for iOS (13.0 or later) and Android (5 or later). 

Make sure to use coupon "LP-TOMSGUIDE25" to take 25% off Premium and Family plans for a limited time. 

Thanksgiving is days away and while there plenty of Black Friday deals happening now, here's one deal that could save you from trouble if plan on doing a lot of online shopping. 

Currently, Keeper is taking 50% off all Unlimited and Family plans. That's the biggest percent-off discount we've seen from Keeper so far in 2023. After discount, you can get a Keeper Unlimited 1-year plan for $17.49 (was $34.99) or a Keeper Family plan (five users) for $37.49 (was $74.99). Additionally, Keeper Business is discounted to $1.87/per user per month (was $3.75/per user per month). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

In our Keeper password manager review, we called it one of the best password managers you can buy. We found the service to be dependable, inexpensive, and very secure. It can especially come in handy if you're opening new accounts at online retailers for your holiday shopping. 

Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

We’re big fans of password managers, which store all your passwords in one place and help you to stay safe online. We’ve tested dozens, but none can match 1Password for its security, ease of use, and pricing.

Not that the folks at 1Password are resting on their laurels, though. Indeed, they’ve just added a shiny new game-changing feature. Passkey support – currently in public beta – is rolling out now across the major browsers: Chrome, Edge, Brave, Firefox, and Safari.

Signing in just got a whole lot faster

New to passkeys? These unique digital ‘keys’ are fast replacing traditional passwords. Each passkey is unique, can’t be reused, and consists of two parts. The private half is stored in an encrypted format on your device, protecting you from phishing attacks and data breaches.

And since you need both halves of a passkey for authentication, nobody can access your online accounts without physical access to your devices – and a way to unlock them (which is all but impossible when you mix in today’s biometric technology).

Using a passkey is a piece of cake. There’s nothing to memorize and nothing to type out. Simply navigate to a website that supports passkeys, head to the sign-in page or button, and let 1Password work its magic (here’s a handy list of passkey-friendly sites).

It’s also worth mentioning that Watchtower, 1Password's security-monitoring tool that flags reused passwords and breached websites, will let you know when a website you’ve saved adds passkey support.

Passkeys: the future of authentication

One of the most frustrating things about some other password managers? They lack support across platforms, resulting in your passkeys being locked into their ecosystem. 1Password has no such limitations and doesn’t lock you into their ecosystem, making it so you can use your passkeys on whatever device/major browser you already use.

Worried that you could end up juggling hundreds of passkeys? Don’t – 1Password remembers where you’ve chosen to use passkeys and serves up the correct credentials each and every time, whatever the website or login method. Neat.

You can even share your passkeys with a family member or trusted co-worker; simply add the passkey to a shared vault or provide access to an individual passkey.

Get the passwordless experience you deserve

Right, ready to kiss passwords goodbye? Simply sign up for 1Password (if you’ve not already), open a compatible website, and create or update your account with a passkey, rather than a password.

That’s it – you’re done! In our humble opinion, staying ten steps ahead of today’s hackers and cybercriminals has never been easier.

Want to keep up to date the latest passkey developments news? Don’t forget to sign up to 1Password's (excellent) passwordless newsletter.

The middle of the month is here and Memorial Day sales are showing up everywhere. While password managers aren't the first thing you think of when you think of summer sales, one of our favorite password managers is now on sale. 

Currently, Keeper is taking 50% off all Unlimited and Family plans. That's the biggest percent-off discount we've seen from Keeper so far in 2023. (It's 10% greater than last month's deal). After discount, you can get a Keeper Unlimited 1-year plan for $17.49 (was $34.99) or a Keeper Family plan (five users) for $37.49 (was $74.99). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

In our Keeper password manager review, we called it one of the best password managers you can buy. We found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

May has just started and the first Memorial Day sales of the month are still a few days out, but that's not stopping Keeper from offering an epic sale on its top-rated password manager. 

Currently, Keeper is taking 50% off all Unlimited and Family plans. That's the biggest percent-off discount we've seen from Keeper so far in 2023. (It's 10% greater than last month's deal). After discount, you can get a Keeper Unlimited 1-year plan for $17.49 (was $34.99) or a Keeper Family plan (five users) for $37.49 (was $74.99). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

If you're not familiar with Keeper, we called it one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

With its Password Manager, Bitdefender extends its already-extensive array of security products by licensing SaferPass’s Personal Password Manager and integrating it into the company’s Central online portal. Easy to install and use, Bitdefender Password Manager is compatible with all major platforms except Linux. It is backed by some serious encryption to protect your privacy and Bitdefender Password Manager can safely put your passwords in all the right places while allowing quick importing of your login credentials from a variety of popular formats. The best part is that if you forget your master password, Bitdefender can recover your entire account.

On the downside, Bitdefender Password Manager shows the potential foibles of a first-generation product by lacking some items we like to see in a password manager, like the ability to work with Passkey password-free authentication. There’s also no free version, although Password Manager has a 30-day trial. 

At $30 a year ($20 for the first year), it is among the least expensive password managers around and is included in Bitdefender’s top two security suites, making it an even better buy. Can this newcomer beat our favorites like the class-leading 1Password and DashLane? Our Bitdefender Password Manager review will help you decide if this is the best password manager for you.

Bitdefender Password Manager: Costs and what’s covered

With other password managers selling in the $40 per year range, Bitdefender’s Password Manager is a bargain at $20 for the first year (or $3 a month). It costs $30 a year after that. There’s no family plan, but the app bolsters Bitdefender’s class-leading top two security suites, Ultimate Security ($180 for 10 users) and Premium Security ($160 for 10 users). You essentially get the password manager for next to nothing. 

On the downside, unlike BitWarden and Dashlane, there’s no free version of Password Manager. New customers can get a 30 day trial while current Bitdefender users get 90 days of free use. 

The service provides unlimited use of Bitdefender Password Manager, including synchronization across as many devices as you like. It works with Windows, Mac, Android and iOS as well as popular browsers, like Edge (version 72 or newer), Chrome (Version 80 or newer), Firefox (Version 65 or newer) and Safari (Version 12 or newer). However, the password manager lacks compatibility with obscure ones like Brave and Vivaldi. It should work with most Chromebooks, but it’s not officially compatible. The weak link in the password chain is that Bitdefender Password Manager doesn’t work with Linux.

Under the surface, the Password Manager uses a layered security approach with several heavy-duty encryption algorithms to hide the actual data. They range from HTTPS and AES-256 to BCRYPT and WSS. All of the activities can be set up to require two-factor authentication and biometric log-in. 

To get a good idea of its potential, I used the Bitdefender Password Manager on several systems, including a Windows 10 ThinkPad T470, a Samsung Note 20 phone and an iPad Pro; I connected with the Chrome, Edge and Firefox browsers.

In addition to my usual online haunts, I used the service with a variety of sites, including Twitter, Facebook, the Washington Post and MSI’s portal 

Unlike some other password managers, Bitdefender’s Password Manager does not come with cloud storage, such as 1Password’s 1GB of encrypted space for keeping photos, videos and all kinds of files safe and secure. By contrast, Bitdefender Password Manager’s Secure Notes is meant for small amounts of sensitive data that might need hiding. 

Bitdefender Password Manager: Web Interface

Bitdefender’s web interface is similar to its mobile apps, making it easy to use across PC, Mac, Android, iPhone and iPad. Bitdefender has done an excellent job of integrating the SaferPass service into the company’s Central portal scheme that includes malware protection, identity monitoring, VPN, parental controls and now password management. The Central Dashboard has a shortcut to the Password Manager’s details with links for adding browser extensions.  

To add my credentials for Facebook access with my ThinkPad T470, I opened the Chrome extension and clicked Add account.

After I included some basic information, the password manager was ready to go. I continued with my other favorites by importing passwords in a .CSV file. At that point, all of my log-in details were also available on my phone and tablet for quick, secure logins.

By going to the Password Manager’s extension’s interface, I could see and edit my login accounts, generate a super-secure password, see the open sessions and view the Security Report. It correctly auto-filled online forms accurately and can securely store credit card data. On the other hand, the interface lacks templates for securely stashing things like a driver’s license and passport, features that other password managers provide.

Like 1Password, Bitdefender Password Manager warns of password breaches, weak passwords and duplicates as well as scan for leaked passwords. It all shows up in the Security Report.

Unlike 1Password, there’s no Travel Mode. This means that you can’t stash specific passwords and files for when you hit the road. The Password Manager served me well over two weeks of intensive daily use, although it failed me once when Bitdefender’s server infrastructure was unavailable, and so were my passwords.

Chalk it up to growing pains for the new service and everything was back online in a few minutes. The product’s offline version can provide passwords in the event of an internet outage.

Bitdefender Password Manager: Mobile apps

Bitdefender Password Manager offers apps for Android, iOS, iPadOS but not Chromebooks as the company doesn’t officially support this platform. However, it worked on my HP X2 Chromebook tablet.

Bitdefender Password Manager mirrors SaferPass’s interface with icons along the top for Accounts (the password credentials), Generate Password (for on-the-spot use), SecureMe (for starting secure sessions and remotely logging out) and the Security Report. 

The three-line hamburger icon in the upper left leads to the app’s inner workings. In addition to entering an Identity and adding Secure Notes, there’s a place for storing credit card data. The Settings section is for importing and exporting password data as well as for changing auto-fill options for online forms.

There’s also a link to Bitdefender’s Support pages as well as a search bar. A box at the bottom is for getting in touch with Bitdefender’s 24/7 support staff.

Bitdefender Password Manager: Setup

Since most of Bitdefender Password Manager’s work is done online, it is a snap to install. The first step is to create a Bitdefender Central account with an email address and password. Happily, it would not accept a simple (and weak) password. I signed up for a year’s worth of service and got an email confirmation. 

Using my ThinkPad T470, I activated the app, logged-in and the Password Manager category of Bitdefender’s Central Dashboard showed that everything was active.

I loaded the browser extensions, entered my master password and agreed to the terms and license.

The app showed me my recovery key with an option to print it. It’s a good way to have a backup of the service’s log-in info but is second best compared to 1Password’s more inclusive Emergency Kit and use of QR codes.

Setting the password manager up on my Note 20 phone was even easier. I logged in to the Mobile Security app and tapped to install the Password Manager’s browser extensions on my phone. I entered the master password to unlock the vault, followed by creating a PIN and adding my fingerprint to make things even easier.

Nearly done, I now imported my database of passwords. Happily, right after I set up Password Manager, a help area on the right on the Central main screen explained how to import passwords. I used the .CSV format but the program accepts a wide variety of file types, including .XML, .TXT and .FSK formats as well as direct imports from two dozen popular password managers, including 1Password, Bitwarden, Dashlane and Watchguard.

Start to finish, it took me 5 minutes to get it all together and start using Password Manager on a variety of platforms and browsers.

Bitdefender Password Manager: Passkeys

For its first iteration, Bitdefender’s Password Manager does not support FIDO’s open authentication Passkey standard. Its public key, private-key Passkey system has the power to replace passwords for logging into websites, programs and even smart devices. 

To Bitdefender’s thinking, the lack of widespread use didn’t justify including it now. That said, the company’s engineers are working on adding it to the feature mix in an update. Bitdefender is not alone here with many password managers promising Passkey support in the near future.

Bitdefender Password Manager: Security

As is the case with other Bitdefender apps, the Password Manager requires a secure HTTPS connection over the Internet to connect; this entails the use of 128-bit AES encryption. All its records are stored locally and online using the more secure AES-256 algorithm, while other portions use SH512 and PCR cryptographic techniques to secure data.

There’re more layers of security to protect your privacy, starting with the mobile apps blocking screenshots. Bitdefender also promises to never send your master password over the internet and Password Manager can be secured with two-factor authentication. On the other hand, Password Manager is not SOC 2 certified by the AICPA for having adequate privacy provisions.

In addition to using a PIN or the master password, my face and fingerprints were enough to open Bitdefender’s Password Manager. It works with everything from Apple’s Face ID and Touch ID to Microsoft’s Windows Hello biometric authentication schemes.

We all forget things and Bitdefender’s Password Manager can keep you from losing access to your login credentials due to a memory lapse or lost master password. In addition to the expected recovery key for gaining access to a locked out account, the company can revive your passwords without the recovery key by talking to their technical support staff. You will need to prove that you actually are you, though.

The Password Manager goes the extra mile for security by alerting you of weak or compromised passwords in the app; company engineers are working on email notifications as well.

Bitdefender Password Manager: Bottom line

Rather than build a password manager from scratch, Bitdefender chose to work with SaferPass. It may not be perfect, but Bitdefender’s Password Manager is an excellent start with a service that covers the log-in bases well. It not only mixes with other parts of the company’s security suites but is a fast starter with the ability to import log-in details from other password managers or via generic database files. As easy as it is to use, Password Manager protects your privacy with several layers of heavy-duty security, 2FA authentication and has two ways to recover your account if you forget or lose the master password.  

Good for home and away logins, Password Manager works with the major platforms and browsers, although it ignores Linux systems. It lacks a free – though limited – version to use, something that Dashlane provides; there is a one-month Password Manager trial. At $20 a year ($30 after the first year), it is a bargain on its own but is nearly free as part of Bitdefender’s Premium Security and Ultimate Security suites for $160 and $180 to cover 10 users at home with complete protection. 

Overall, Bitdefender Password Manager is a good way to protect your online persona day-in and day-out. While it has its shortcomings, Bitdefender Password Manager is an effective way to secure a stress-free online life and a good value. 

We're still weeks out from the first Memorial Day sales of 2023, but if you're looking for a solid deal — one of the best password managers we've reviewed is offering an epic discount. 

For a limited time, Keeper is taking 50% off all Unlimited and Family plans. That's the biggest percent-off discount we've seen from Keeper so far in 2023. (It's 10% greater than last month's deal). After discount, you can get a Keeper Unlimited 1-year plan for $17.49 (was $34.99) or a Keeper Family plan (five users) for $37.49 (was $74.99). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

If you're not familiar with Keeper, we called it one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

One of our favorite password managers is jumping on the spring sales bandwagon with an epic deal for anyone who shops online or juggles multiple passwords. 

For a limited time, Keeper is taking 50% off all Unlimited and Family plans. That's the biggest percent-off discount we've seen from Keeper so far in 2023. (It's 10% greater than last month's deal). After discount, you can get a Keeper Unlimited 1-year plan for $17.49 (was $34.99) or a Keeper Family plan (five users) for $37.49 (was $74.99). For more ways to save, make sure to read our guide to the best Keeper Security promo codes.

If you're not familiar with Keeper, we called it one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

March isn't a big month for retail holidays. However, that's not stopping one of our favorite password managers from offering a killer deal on its top plans.

For a limited time, Keeper is taking 40% off all Unlimited and Family plans. That's the biggest percent-off discount we've seen from Keeper so far in 2023. After discount, you can get a Keeper Unlimited 1-year plan for $20.98 (was $34.99) or a Keeper Family (five users) plan for $44.98 (was $74.99). (For more ways to save, make sure to read our guide to the best Keeper Security promo codes).

If you're not familiar with Keeper, we called it one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

 Passwords are our first line of defence when it comes to our devices, accounts and important documents. If something isn’t password protected, anyone can get their hands on what’s inside.

Just having a simple password isn’t enough, however. If it’s easily guessable, or can be quickly cracked by malicious hackers, then that’s almost as bad as having no password at all.

With more of us than ever working from home, the amount of sensitive devices and documents we have in our houses is increasing. Even if you don’t work from home, you likely have several laptops, tablets and smartphones, alongside personal email, social media and online banking accounts, and that means using strong passwords to protect them all has never been more important.

Ideally, every account and every device you use should have a different password - as if one password gets cracked, at least that means only one device or account is at risk. Each password should also be impossible to guess and extremely difficult to crack.

This means you may be faced with the daunting prospect of tens, if not hundreds, of complex, difficult to remember passwords.

The good news is that password manager tools can help you generate complex passwords and keep them all safe and secure so you can access them on any device, without having to memorise them. Even better news is that you don’t have to spend huge amounts of money on them - for example, Bitdefender Premium Security comes with the powerful Bitdefender Password Manager

Here’s how Bitdefender Password Manager can help keep you completely secure when working from home.

 1. Simplify your online accounts 

Bitdefender Password Manager can collect all of your passwords in one secure location. It works across multiple devices and platforms, including Windows, macOS, Android and iOS, and all major web browsers are supported as well.

You can easily browse through your accounts, and Bitdefender Password Manager can automatically fill in your username and password when logging into websites.

2. Shop safely and securely

Not only can Bitdefender Password Manager auto fill your username and passwords, but it can also do the same for your payment details. 

They’ll be stored and encrypted securely, and you can quickly enter them in whenever you find an online bargain.

3. Check the strength of your current passwords 

Bitdefender Password Manager has a built-in password strength check tool that can analyse how strong your passwords are. The stronger a password is, the harder it is to guess or crack.

If any of your passwords need to be made more complex, Bitdefender Password Manager will tell you straight away, so you can plug up any potential security holes quickly and easily.

4. Generate complex passwords with ease

If you need to come up with a complex password for either existing accounts, or new ones, then Bitdefender Password Manager can help generate secure, complex and unique passwords with a single click.

This means you no longer need to use the same password for multiple accounts, and every password Bitdefender Password Manager generates is completely secure. They are all instantly saved as well, so Bitdefender Password Manager will do all the hard work for you.

5. Easy account recovery

Entrusting all of your passwords, login details and payment methods to a single service can seem risky - especially if you’re using the service to store important work information as well, but with Bitdefender Password Manager, you can be completely confident that your information is safe and secure.

It saves all of your data using the strongest data security protocols such as AES-256-CCM, SHA512, BCRYPT, HTTPS, and WSS, and it’s all encrypted and decrypted locally, so no other third party can get access to it - and only you will get access via a Master Password.

If you forget the Master Password, don’t panic about losing access to all of your passwords, as you can recover your account using a Master Key.

Find out more about how to keep yourself protected with Bitdefender's cybersecurity blog.

Presidents' Day is a week away. While there are plenty of deals on TVs, smartphones, and home appliances, we've spotted a killer deal on our favorite password manager.

Currently, Keeper is taking 30% off all Unlimited and Family plans. That's the biggest percent-off discount we've seen from Keeper and one of the best Presidents' Day sales available this week. After discount, you can get a Keeper Unlimited 1-year plan for $24.49 (was $34.99) or a Keeper Family (five users) plan for $52.49 (was $74.99). (For more ways to save, make sure to read our guide to the best Keeper Security promo codes).

If you're not familiar with Keeper, we called it one of the best password managers you can buy. In our Keeper password manager review we found the service to be dependable, inexpensive, and very secure. Although Keeper has a free tier, we recommend upgrading to the paid plan as it offers everything in the free plan plus syncing across unlimited devices on all platforms, secure record-sharing, priority 24/7 support, and emergency access for family members in case you are ever incapacitated.

Keeper relies on AES 256-bit encryption to secure data on its servers and on your devices. Your data is only ever unencrypted on your device after you enter your master password. That means if Keeper's servers were to ever be hacked, your data would remain secure.

In terms of features, we like Keeper's Security Audit which gives you an overall security score based on all your passwords and color-codes each one red, yellow or green. The Keeper mobile app also does an excellent job of bringing over most of the functionality from the desktop and web interfaces to your mobile.

Bitwarden and LastPass are two of the best password managers available today. They are also comparable when it comes to their features and the platforms/browsers they support.

However, the recent LastPass hack may be the reason you’re looking for an alternative in the first place. If so, Bitwarden is an open source password manager that even allows you to host your own server instead of using the company’s cloud servers. This can help prevent your passwords from ending up in the hands of hackers but it also gives you a bit more flexibility and customization.

So which password manager should you get and should you use a password manager in the first place? This Bitwarden vs. LastPass face-off is here to help you decide between these two top password managers.

Bitwarden vs. LastPass: Specs

Bitwarden vs. LastPass: Price

Bitwarden and LastPass both offer a free tier for users who want to test out their password managers. However, Bitwarden’s free plan has fewer limitations than what’s on offer from LastPass. With Bitwarden’s free plan, there are limits on 2FA (email and authentication app only) and file sharing with the ability to share vault items with only one other user. With LastPass’s free plan, file sharing is the same but you’re also limited to one device category, so you’ll have to decide whether you want to use its password manager on desktop or mobile, as you can’t use it with both.

When it comes to the paid plans offered by both services, Bitwarden is significantly cheaper for both individuals and families. Its paid plan for a single user costs just $10 per year while its family plan costs $40 per year and can be used by up to six users. Meanwhile, LastPass’ single user plan costs $36 per year while its family plan costs $48 per year for up to six users as well.

Winner: Bitwarden

Bitwarden vs. LastPass: Platform compatibility

Both Bitwarden and LastPass support a wide variety of platforms including Windows, Mac, iOS, Android and Linux. However, LastPass can also be used with Chrome OS by installing the Android app or the Google Chrome browser extension while Bitwarden can only be used with the extension.

As for browser extensions or add-ons, Bitwarden takes the lead here with support for more browsers. While LastPass offers extensions for Chrome, Edge, Firefox, Safari and Opera, Bitwarden supports these browsers as well as Edge, Vivaldi and even Tor.

Winner: Bitwarden

Bitwarden vs. LastPass: Software

While both of these popular password managers offer full functionality through their websites and browser extensions, you can also download their desktop and mobile apps.  

Bitwarden’s desktop app has a menu on the left where you can access all of your passwords or add certain ones to your favorites. They are also organized by types below your favorites and these include Login, Card, Identity and Secure Note. The Send button at the bottom allows you to create file or text links to credentials stored on your computer which you can then copy or share to send to others. You also have the option to select a date on which access to anything you’ve sent will expire. It’s worth noting that you need to select View in the app’s toolbar to access Bitwarden’s password generator.

Unlike Bitwarden that also has a desktop app for Linux, LastPass only has them for Windows and Mac but they can’t be used with its free version. They closely resemble the company’s web vault with your Passwords, Notes, Addresses and other stored information available from the menu on the left. You can view stored passwords as a list or in blocks and they can be sorted several different ways. With the LastPass Windows app, you can store up to 5,000 items but the company notes in a support page that you may see a performance decrease after adding 2,500 or more items.

Both password managers also offer full-featured mobile apps for iOS and Android. Bitwarden and LastPass’ mobile apps allow you to access your stored credentials, auto-fill passwords and create new, strong passwords using their built-in password generators. 

Winner: Tie

Bitwarden vs. LastPass: Form filling

Besides storing your passwords, the best password managers also make it easy to access them when logging in to different sites and services. Bitwarden and LastPass both have an auto-fill feature that can copy passwords stored in your vault and enter them when you need to log in.

With either password manager, you can auto-fill passwords using their browser extensions on desktop or their mobile apps on your smartphone. On Android, Bitwarden and LastPass have a standard auto-fill as well as an inline auto-fill option. The difference being that standard autofill uses a pop-up window while inline autofill lets you choose a password from the space above your keyboard when trying to log in.

Both password managers make it easy to auto-fill your passwords on websites from your browser and when using mobile apps on your smartphone.

Winner: Tie

Bitwarden vs. LastPass: Security

Bitwarden and LastPass both store your passwords using AES-256 encryption inside your vault and they can only be unencrypted once you enter your master password. However, once you’ve logged in and set up a two-step method like your fingerprint, you don’t need to type out your master password each time you want to access one of your stored passwords.

Although both companies undergo regular security audits, Bitwarden’s code is open source while LastPass’ isn’t. This means that anyone can review Bitwarden’s code for security flaws which will then be patched by the company. Another interesting thing about Bitwarden being open source is that you can download its code and host it on your own server instead of in the cloud.

With LastPass, all of your credentials are stored on the company’s cloud servers. Back in December of last year, the company revealed that attackers used information stolen from a previous data breach that took place in August to steal customer data, including backups of their encrypted vaults. We’re still learning more about the LastPass hack but the security implications of the incident are reason enough to choose a different password manager.

Winner: Bitwarden

Bitwarden vs. LastPass: Two-factor authentication 

Two-factor authentication (2FA) is available with both Bitwarden and LastPass. While the free version of Bitwarden allows you to use 2FA through authenticator apps like Authy or Google Authenticator as well as email, the paid version supports SMS, phone calls and security keys. However, LastPass has its own authenticator app but you can also use both Google and Microsoft’s authenticator apps. It also supports biometric (face and fingerprint) authentication, voice recognition, SMS and one-time passwords for 2FA.

Winner: LastPass

Bitwarden vs. LastPass: Customer support

As using a password manager for the first time can be difficult, Bitwarden and LastPass both have plenty of self-help resources available online in their FAQs and you can also reach out to either company’s community forum for answers to common problems from other users.

While Bitwarden only offers email as a way to directly contact someone at the company for support, LastPass offers 24/7 phone support to its paid customers as well as 24/7 email support to its business customers. 

Winner: LastPass

Bitwarden vs. LastPass: Bottom line

Bitwarden and LastPass both provide a convenient way to store, generate and auto-fill passwords on desktop and mobile. They also support all of the main platforms and have extensions available for all of the main browsers.

When it comes to their free offerings, both password managers have some limitations, like fewer 2FA options and only being able to share vault items with one other user. However, LastPass’ free plan is worse than Bitwarden’s since you can only use the service with either your mobile devices or on desktop — not with both. 

Bitwarden is surprisingly cheap for individuals at just $10 per year and its annual family plan costs just a few dollars more than LastPass’ individual plan. Still though, LastPass throws in a few nice extras like dark web monitoring and 24/7 phone support, so it might be a better choice if you’re less tech savvy.

LastPass’ recent security issues are hard to ignore as one of the main reasons to get a password manager in the first place is to keep your credentials out of the hands of hackers. Fortunately, 1Password is on a par with LastPass in terms of features and pricing, but Bitwarden’s open source nature and the fact that you can host your own server help set it apart from the competition.