The single biggest security upgrade most people can make costs nothing and takes an afternoon: stop reusing passwords and let software remember unique ones for you. We tested the leading password managers and the newer passkey systems that may replace passwords entirely. Here is the plain, non-scary version.
Why reuse is the real danger
When a website is breached, attackers get a list of email-and-password pairs and immediately try them on banks, email, and shops — a tactic called credential stuffing. If you reuse one password, a breach at a forum you forgot about can hand over your bank login. The fix is not “stronger” passwords you memorise; it is unique passwords for every site, which is only realistic with a manager.
Choosing a password manager
| Manager | Price (2026) | Notes |
|---|---|---|
| Bitwarden | Free / ~$10 per year premium | Open-source, generous free tier — our value pick |
| 1Password | ~$36 per year | Best polish, excellent family sharing, Travel Mode |
| Apple / Google built-in | Free | Fine if you live entirely in one ecosystem |
| Proton Pass | Free / paid tiers | Strong privacy focus, email aliases |
In testing, Bitwarden is the one we recommend to most people: it is open-source, audited, works on every platform, and its free tier is enough for an individual. 1Password justifies its price with the smoothest experience and the best family plan. The built-in Apple/Google managers are genuinely fine — if you never leave that ecosystem.
Passkeys: the beginning of the end for passwords
Passkeys are the biggest change in years. Instead of a secret you type, your device holds a private cryptographic key and unlocks it with your fingerprint or face; the website only ever sees a public key. That means nothing phishable is typed and nothing reusable is stored on the server to steal. Google, Apple, Microsoft, Amazon and a growing list now support them. Where a site offers a passkey, we now take it — it is both easier and safer than a password.
How 2FA actually protects you
Two-factor authentication adds a second step so a stolen password alone is not enough. But not all second factors are equal. SMS codes are better than nothing but can be intercepted via SIM-swap attacks. Authenticator apps (Google Authenticator, Authy, or the code generator built into your password manager) are much stronger. Hardware keys like a YubiKey are the gold standard. Turn on 2FA everywhere it is offered, and prefer an app or hardware key over SMS.
The afternoon plan
Here is the concrete order we give friends: install Bitwarden; change your email password first (it is the master key to password resets) to a long generated one; turn on 2FA for email using an authenticator app; then work through your important accounts — bank, main shopping, social — letting the manager generate a unique password for each. Do that and you have leapfrogged the vast majority of people on security, permanently.
Frequently asked questions
Which password manager is best?
For most people, Bitwarden — it is open-source, audited, cross-platform and has a genuinely useful free tier. 1Password is the best paid experience.
Are passkeys safer than passwords?
Yes. Passkeys cannot be phished or reused, and there is no shared secret on the server to steal. Use them wherever a site offers them.
Is SMS two-factor authentication safe?
It is better than no 2FA, but weaker than an authenticator app or hardware key because SMS can be intercepted via SIM-swapping. Prefer an app-based code.
What is the first password I should change?
Your email password. It controls resets for almost every other account, so make it long, unique, and protected with app-based 2FA first.