Passwords & Passkeys, Explained

Passwords are the weakest part of how most people log in — reused, phished, and leaked by the billions. Passkeys are the replacement the big platforms have finally switched on, and a password manager is still the tool that holds the rest together. Here's the honest comparison, and who each option is best for.

How it works, in one paragraph

A password is a secret you type and a website checks — which means it can be guessed, phished out of you, or stolen in a breach. A passkey is different: your device creates a pair of cryptographic keys, keeps the private one locked behind your fingerprint or face, and hands the site only the public half. Nothing you type can be phished, and there's no password on the site's servers to leak. You sign in with your face or fingerprint, the way you unlock your phone. Passkeys don't replace passwords everywhere yet — plenty of sites still ask for one — so for now the practical setup is passkeys where they're offered, plus a password manager for everything else.

The comparison

*US prices, regular annual-billing rates checked November 5, 2026 — first-year promo prices are lower (1Password $2.99/mo, NordPass from ~$1.39/mo on a 2-year plan). Prices change — confirm on each service's own page before subscribing.

Passkeys in 2026 — where things actually stand

The plumbing is done: Apple, Google and Microsoft all support passkeys across their platforms, and the FIDO Alliance counts roughly 15 billion accounts enabled for passkeys and about 5 billion passkeys in circulation. Google reports more than 800 million accounts using passkeys; Amazon says 175 million people created one in its first year; Microsoft made passkeys the default for new accounts in 2025. But availability isn't the same as use — even on Google, passkeys still handle only about a quarter of logins in the most recent large-scale measurements. The honest picture: passkeys are ready, the big sites offer them, and most people still haven't switched most of their accounts over. That gap is the whole reason a password manager still matters.

Service by service

Apple Passwords — best for Apple households

Built into every iPhone, iPad and Mac since iOS 18 — no download, no subscription, no separate account. It stores passwords and passkeys in iCloud Keychain, fills them in Safari and apps, and warns you about reused or leaked passwords. The catch is the ecosystem: it works best if everyone in the household is on Apple hardware. Sharing with an Android user in the family is awkward, and there's no Windows app worth using. If your household is all-Apple, this is the free answer — and it's genuinely good.

Google Password Manager — best for Android & Chrome users

Also free and built in — this time into Chrome and Android. It saves and fills passwords and passkeys, checks them against known breaches, and syncs across every device signed into your Google account. The catch is the same shape as Apple's, mirrored: it's at its best inside Google's world, and your vault lives inside your Google account, so that account's own security (a strong password, a passkey, two-factor) is the single point that protects everything else.

Bitwarden — best for value overall

The cheapest honest option, and the only one here that's open source and independently audited. The free plan stores unlimited passwords and passkeys on unlimited devices — no device limit, no password cap. Premium is $19.80 a year and adds emergency access, file attachments and built-in authenticator codes. Families covers six people for $47.88 a year. The trade-off: the interface is plainer than 1Password's, and setup asks slightly more of you. If you want the most security per dollar, this is it.

Proton Pass — best for privacy-first users

From the Swiss company behind Proton Mail and Proton VPN: end-to-end encrypted, open-source clients, and a free plan with unlimited passwords on unlimited devices — plus its signature feature, hide-my-email aliases, so you can hand out a disposable address at sign-up instead of your real one (10 aliases free, unlimited on Plus). Pass Plus is $35.88 a year; Pass Family covers six for $59.88. The trade-off: fewer integrations than 1Password, and the family sharing is simpler. The value pick if you're already in Proton's world — Proton Unlimited ($9.99 a month) bundles Mail, VPN, Drive and Pass together.

1Password — best for families & polish

The smoothest app of the paid managers, and the one most often recommended for families: shared vaults are built in properly, each family member gets their own private vault, and there's a travel mode that removes sensitive vaults from your device at a border. Individual is $3.99 a month on annual billing ($47.88 a year); Families covers five people for $5.99 a month ($71.88 a year). The catch: there is no free plan — only a 14-day trial — and it's the priciest of the mainstream options. You're paying for the polish and the family sharing, and for most families that's a fair trade.

NordPass — best for NordVPN households

The straightforward pick if you already pay for NordVPN: same company, same account, and the family plan is cheap in year one. Premium's standard price is $35.88 a year; Family covers six for $71.88 a year. The free plan stores passwords and passkeys but only on one device, which makes it hard to use seriously without paying. The trade-off: it does nothing the others don't, and its renewal price is the highest of the budget options once the intro deal ends. Buy it for the bundle, not as a standalone.

Dashlane — best for built-in scam alerts & VPN

The most expensive manager here — Premium is $5.42 a month on annual billing ($65.04 a year) — and the price buys a bundle: a VPN, AI-based scam protection and dark-web monitoring on top of the vault. Friends & Family covers ten people for $8.13 a month, the largest household on this page. The free tier is the thinnest: 25 passwords on one device. The trade-off: you're paying for extras many people already get elsewhere, and there's no free plan beyond the trial. Worth it if you'll actually use the VPN and the alerts; overkill if you just need a vault.

Keeper — best for support & compliance-grade security

The one every major 2026 roundup still lists, and the strongest on paper for trust: SOC 2, ISO 27001 and FedRAMP certifications, zero-knowledge encryption, and 24/7 human support — the only manager here where you can reach a person around the clock. Personal is $3.58 a month billed annually ($42.99 a year) with unlimited passwords, passkeys and devices. Family covers five people for $7.67 a month ($91.99 a year), each with a private vault, plus 10 GB of secure file storage and emergency access for estate planning. The catches: the free plan is the thinnest on this page — ten records on one mobile device — and dark-web monitoring (BreachWatch) is a $19.99-a-year add-on rather than included. Best pick if you want the deepest compliance credentials and a support line that answers, or if you're choosing a manager for a small business as well as a household.

Before you decide

Household plans — where the real money is

One person can get away with a free plan. A household can't — sharing passwords by text message or a shared note is exactly the habit this page is trying to kill. Family plans cover five or six people (Dashlane covers ten): Bitwarden Families $47.88 a year for six, Proton Pass Family $59.88 a year for six, 1Password Families $71.88 a year for five, NordPass Family $71.88 a year for six, Keeper Family $91.99 a year for five, Dashlane Friends & Family about $97.56 a year for ten. Per person per year, Bitwarden is the cheapest family plan on this page at under $8. Apple and Google's built-ins are free per person, but they don't share across ecosystems — an Apple household and an Android household need different answers.

Two-factor authentication — the second lock

A password manager is the first lock; two-factor is the second. Turn it on for your email first — your inbox is the reset button for everything else — then your bank, then the rest. Authenticator apps (Google Authenticator, Microsoft Authenticator, or the code generator built into Bitwarden Premium and 1Password) beat text-message codes, which can be intercepted. And a warning from the security news this year: new malware steals the session tokens that keep you logged in, and those tokens can survive a password reset. Two-factor and passkeys don't make you invulnerable, but they close the two easiest doors.

The master password — the one rule

Every manager on this page works the same way underneath: your vault is encrypted on your device with one master password, and the company can't read it — that's called zero-knowledge, and it's the whole point. It also means one hard rule: if you forget the master password, nobody can reset it for you, not even the company. Pick one long, memorable passphrase (four random words work better than a short jumble of symbols), write it down somewhere safe — on paper, in a drawer — and never reuse it anywhere else. This is also why the LastPass breach of 2022 still gets talked about: attackers stole encrypted vaults, and the customers with weak master passwords were the ones at risk. The architecture protects you; the master password is the one place it can't.

Start here — ten minutes

If you do nothing else today, do this: first, turn on the password manager already built into your phone — Apple Passwords or Google Password Manager — and let it generate a unique password for every account you log into. Second, turn on two-factor authentication for your email, because your inbox is the reset button for everything else. Third, set up a passkey on your email and your bank, the two accounts that matter most. Fourth, write down your master password and put it somewhere safe. That's it. The rest — family sharing, the paid plans, the extras — can wait until the basics are done.

Recovery — the passkey catch nobody mentions

A passkey lives on your device, locked behind your face or fingerprint. Lose the device and the passkey goes with it — unless it's synced. Apple syncs passkeys through iCloud Keychain, Google through Google Password Manager, and the paid managers sync theirs through your vault. Before you go all-in on passkeys, check two things: that sync is actually on, and that you have a recovery path (a second device, a printed recovery code, or a trusted contact) for the account. A passkey with no recovery plan is a lockout waiting for a dropped phone.

Switching — easier than you think

Every manager on this page imports from the others and from your browser's built-in saver, usually in a few clicks — export from the old one, import into the new one, then delete the export file, which is unencrypted. Moving from a browser's built-in manager to a standalone one is the most common switch, and it's an afternoon's work, not a rebuild. You're not locked in — the cost of trying another manager is low, and the cost of staying with reused passwords is not.

What "best for" means — and what it doesn't

There is no single best password manager, and anyone crowning one is selling you a headline. The security core is the same across all eight: your vault is encrypted on your device, and the company can't read it. What differs is fit: what devices you own, whether your household shares one ecosystem, and whether you'll actually use the extras you're paying for. The free built-ins are genuinely good — most people who do nothing else should at least turn on Apple Passwords or Google Password Manager and let it generate unique passwords. The paid managers earn their money on sharing, recovery and cross-platform life.

One name you won't find here, and why: LastPass. It was once the biggest name in this category, but its 2022 breach — and the $24.5 million settlement approved in February 2026 — pushed it out of most expert recommendations, and this page follows that call. If you're still on it, the switching section above applies to you too.

One honest caveat: no manager protects you from yourself. It can't stop you handing a password to a convincing phishing page, and it can't protect a session token stolen by malware on your own device. The manager makes strong, unique passwords effortless. Staying skeptical of unexpected login prompts is still your job.

Sources & further reading