What to Check Before You Install a Password Manager

A password manager holds every login you own behind one app. This checklist covers what to verify first, from the security design to the renewal price.

A password manager asks for an unusual amount of trust: every login you own, guarded by one app and one master password. The FTC treats third-party password managers as a legitimate option, alongside letting a browser save passwords for you, and notes that studies show people are not very good at creating or remembering strong passwords on their own. Not every product handles that responsibility equally well, and switching later is real work. Run through this checklist before you install anything.

Understand the Security Model Before You Trust It

Start with how the product protects your data, not the price.

• Ask who can read your vault. The company should state plainly whether its own staff could ever access your stored passwords, or whether the design leaves only your master password capable of opening them.
• Find out what a forgotten master password means. Some designs make recovery impossible by construction; others offer recovery paths that carry their own risks. Know which tradeoff you are accepting before you fill the vault.
• Check the master password rules. The FTC’s advice for the master password matches its advice everywhere else: make it strong, and protect it the way you protect your other passwords.

• Check which second factors the manager supports. The most common type of two-factor authentication is a passcode sent by text or email, typically six digits or longer, which expires automatically. The FTC calls that the least secure type and recommends an authenticator app or a security key where a service offers them.
• Ask how the product handles passkeys. NIST has published a supplement to its digital identity guidelines addressing syncable authenticators, the category passkeys fall under. A vendor that cannot explain its approach is telling you something.

Worth knowing where the standards sit: NIST’s Special Publication 800-63B sets out how federal agencies should handle passwords and other authenticators, and the newest version of that guidance was finalized in July 2025. The guidelines are voluntary for organizations outside the government, so a consumer product can follow them or ignore them. That is exactly why it is fair to ask a vendor how its design maps to published standards.

Audits, Incident History and Update Habits

• Look for independent security audits. Reputable managers hire outside security firms to test their systems and often publish the results. If a company publishes no audits and does not answer questions about them, weigh that heavily.
• Read how the company handled past incidents. Check its own announcements and help pages for security disclosures. What matters most is whether users were told promptly and what actually changed afterward.
• Check whether researchers have a way to report flaws, such as a published security page or a bug bounty program. Silence on that front is its own answer.
• Confirm updates install on their own. The FTC warns that criminals look for weak points before software companies can fix them and advises updating programs as soon as newer versions come out. A password manager that updates itself on every device you use is the version you want.
• Lean on expert reviews. The FTC’s advice for finding a reputable password manager is to read expert reviews rather than trust marketing claims.

Check the Exit Before You Check In

• Confirm you can export the whole vault, not just a handful of entries. A manager that holds your data hostage is a manager you will regret choosing.
• Check whether export costs extra. Some products limit full export to paid plans. Find out before you fill a free vault with years of logins.
• Check the export format and whether competitors can import it. That single detail decides how painful your next switch will be.
• Plan for the file itself. An export gathers every login into one document on one device, so move it into the new manager and get rid of it promptly. Keep in mind that deleting a file does not necessarily remove it completely from a device.
• Test the import direction too. Most managers can import passwords saved in browsers, which matters for the migration step below.

Free Tiers, Device Limits and Renewal Pricing

• Read what the free tier actually includes. Check how many devices can sync, whether features are missing and whether the vault size is capped.
• Check paid device limits for your household. A plan covering one person’s phone and laptop may not cover a family sharing a subscription.
• Compare the intro price to the renewal price. Subscription pricing often starts low and rises at renewal. Check the full renewal cost before you sign up, not when the charge appears.
• Find the cancellation steps in advance. If a charge goes through that you did not want, our guide to what the law requires when you cancel online subscriptions explains what companies must do.
• Note how renewals are billed. Automatic renewal is the default for most subscriptions, so put the renewal date in your own calendar.

Emergency Access, Sharing and Inheritance

• Check whether you can name an emergency contact who could reach your vault if you could not, and what safeguards apply, such as a waiting period you can decline.
• Check item-level sharing. Look for the ability to share a single login with a family member without opening the rest of the vault. We cover safer ways to share passwords with family in more detail.
• Check inheritance options. Some managers let you designate who receives your vault if you die. How that fits with the rest of your estate planning is a bigger question.
• Store security question answers too. The FTC and the Better Business Bureau suggest storing passwords and security questions in a reputable password manager. Pick questions only you can answer, and skip answers a stranger could find in public records or online, like a birthplace or a mother’s maiden name.

Migrating Off Browser Password Storage Safely

• Import first, audit second. Bring your browser-saved passwords into the manager, then look for short passwords and repeats while you are in there.
• Replace weak ones as you go. Aim for at least 12 characters. If a site caps the length, mix uppercase and lowercase letters, numbers and symbols. A passphrase of random words works well where long passwords are allowed.
• Fix your email account first. Password reset links usually arrive in your inbox, so someone who takes over your email can reset your other accounts and take them over too. Give it a strong password and two-factor authentication.
• Act fast on breach notices. If a company notifies you about a breach, change that password immediately, along with any account that used a similar one.
• Pick one system of record. Keeping passwords in both a browser and a manager means two vaults to secure. Choose one and turn the other off.
• Close what you no longer use. An audit is a natural time to shut down dormant accounts; our guide to cleaning up old online accounts explains why they are worth closing.

The Final Checklist Before You Install

The short version, for the moment you are one click away:

• You know who can read your vault and what happens if the master password is lost.
• The manager accepts an authenticator app or security key, not just texted codes.
• The company publishes audits, discloses incidents and updates its software automatically.
• Export works for the full vault, in a format other managers can import, without an extra fee.
• The renewal price, device limits and cancellation steps are all clear.
• Emergency access, sharing and inheritance are set up the way you want.
• Your email account already has a strong password and two-factor authentication.

None of this takes more than an hour, and it is far easier to do before installation than after. If you are thinking even further ahead, our article on what happens to your online accounts when you die explains how emergency access and inheritance fit into a larger plan.

Reader questions

Is a browser’s built-in password saving good enough?

The FTC lists browser password saving as a legitimate option alongside third-party managers. The tradeoffs usually involve portability and features, since a dedicated manager often syncs across more devices and offers sharing and emergency access, but verify before assuming.

What should the master password look like?

Long, at least 12 characters, or a passphrase made of random words separated by spaces. Avoid song lyrics, movie quotes and common phrases, and never reuse a password from another account.

Do password managers work with passkeys?

Some do, and NIST has published a supplement addressing syncable authenticators, the category passkeys fall under. Check how a manager handles passkeys and whether they still work if you later leave the service.

What happens if I forget my master password?

That depends on the design, which is exactly why you check before installing. Some products offer recovery through emergency contacts or recovery codes; others cannot recover the vault at all, because no one else can open it.

We describe how services generally work; features, settings and terms change often, and they differ between companies. This is general information, not legal advice. Check the provider’s current policies and official sources such as FTC.gov.