Password Managers: Which to Choose and Where the Pitfalls Lie

Using a password manager is not paranoia of an advanced user but normal hygiene in 2026. Without it, you either use the same password everywhere (a disaster at the first breach) or forget some passwords and constantly reset them. With it, you have one master password and the manager does the rest.

Bitwarden

Open source, free for personal use, paid plan $10/year removes 99% of limitations. Storage is cloud-based (on Bitwarden servers, end-to-end encrypted), but self-hosting is possible (Vaultwarden).

Pros: Open source, regular security audits, hardware-key 2FA support, cross-platform.

Cons: UX slightly worse than commercial ones; mobile app autofill sometimes lags.

1Password

Commercial, $36/year. The most user-friendly among mass-market managers. Storage is cloud-based on 1Password servers (closed source, but independent audits exist).

Pros: Excellent UX, Travel Mode (hides sensitive passwords when crossing borders), good support for family and team accounts.

Cons: Closed source, price, requires subscription (without it, the account stops working).

KeePass / KeePassXC

Open source, local (storage in a .kdbx file on your device). Free.

Pros: Nothing goes to the cloud; the file can be kept anywhere (or nowhere, in offline storage). Suitable for a paranoid threat model.

Cons: Syncing between devices is up to you (via Dropbox, Syncthing, USB). UX noticeably worse than modern ones. Mobile clients vary in maturity.

Pitfalls of All Managers

Master password. If you forget it, access to the vault is lost forever. The manager cannot recover it for you—that's the whole point. Solution: a long passphrase (5+ words) stored in a physically secure place.

Vault file leak. If someone obtains the encrypted vault file (via a provider breach, device theft), they can brute-force the master password. With a long password (16+ characters or 5+ words), brute-forcing is impractical. With a short one, it can be cracked in reasonable time.

2FA on the manager itself. Mandatory. At least an authenticator, preferably a hardware key. Without 2FA, the manager is protected only by the master password.

Backups. Periodically export a copy of the vault (a zip with encrypted export) and store it offline. If something happens to the main account or service, you won't lose everything.

What to Choose

For most people: Bitwarden. Open, cheap, well-supported. If UX is critical and you have the budget: 1Password. If cloud absence is critical: KeePassXC. The worst choice: using nothing.