Any reputable password manager beats reused passwords. CISA notes free built-in browser managers are an option, and its guidance for highly targeted individuals lists several managers that alert on weak, reused or leaked passwords. Choose by where you sign in, who shares with you and how you recover access, not by a feature list.
What CISA says about managers
CISA's general advice is that a password manager generates, stores and fills passwords and flags weak or reused ones, and that you then remember one strong password for the manager. It mentions free options such as built-in browser managers and suggests comparing paid options through trusted reviews.
The guidance for highly targeted individuals lists several managers by name and notes that some alert on weak, reused or leaked passwords, and that some generate authenticator codes. It does not rank them. We do not rank products either.
Questions that decide it
Where do you sign in? If you use one browser on one phone and one laptop, a built-in manager may cover you. If you switch browsers, use several operating systems or use apps with their own login screens, check that the manager fills in all of them.
Who else needs a password? Households and teams share logins. Check whether the manager supports shared items with separate permissions.
How do you recover? Look at what happens if you forget the vault passphrase or lose your device. Some tools can recover, some cannot by design. Decide which you want. Our vault passphrase guide covers backing it up.
What can it protect? Does it support passkeys and security keys for sign in? Can it warn you about leaked passwords? CISA's list names alerts as a useful feature.
What is the exposure if the browser is compromised? A manager that lives inside the browser shares its fate. This is a general design point, not a claim from CISA, so weigh it for your own threat level.
Comparison of approaches
| Approach | Strength | Watch for |
|---|---|---|
| Built-in browser manager | Free, already there, low friction | Tied to one browser or ecosystem, fewer sharing options |
| Standalone app | Works across browsers and devices, richer sharing and recovery choices | Cost, one more thing to keep up to date |
| Paper and notebook | Not online | CISA advises against writing passwords down or saving them in a file |
A sensible default
- Individuals in one ecosystem: the built-in manager plus a strong passphrase on the account that holds it and a passkey or key for that account.
- Executives with a high profile, or mixed devices: a standalone manager with a long passphrase and multi-factor sign in.
- Teams: read our password manager guide for teams.
Switching
- Export from the old manager only on a trusted device and delete the file after import.
- Change passwords for email, bank and your device account first.
- Turn off the old manager's autofill so you do not have two competing sources.
Quick check
Is a built-in browser password manager acceptable?
CISA names free built-in browser managers as an option. Add a strong account passphrase and multi-factor sign in.
Sources
Last reviewed: 19 October 2026.
