Recommended Free Tools
Set up a password manager on the devices and browsers you use, protect its main account with a long, unique passphrase and multi-factor authentication (MFA), then let it generate and save a different password for every account. Start with new accounts and replace old reused passwords over time. The exact controls depend on your manager, device and software version.
Choose a manager that fits your devices
Before moving passwords, check that the manager works on your phone, computer and browsers, and that its syncing and recovery options suit you. NIST recommends choosing a password manager that supports MFA. Also check whether it can generate passwords, autofill sign-ins, flag weak, reused or exposed credentials, and let you export your data if you later switch.
As an Amazon Associate I earn from qualifying purchases.
Apple and Google both document built-in options; neither is the right choice for everyone. Google Password Manager can suggest and save unique passwords, autofill them, and alert you to compromised passwords. Signing in to Chrome with your Google Account can make saved passwords available across devices. Apple’s Passwords app supports passwords, passkeys and verification codes on iOS 18, iPadOS 18, macOS Sequoia and visionOS 2; iCloud Keychain sync and available controls depend on supported devices, operating-system versions and sites or apps. See Google’s setup and security guidance and Apple’s Passwords app guide for current platform-specific steps.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteFor a third-party manager, use the same criteria rather than assuming a particular vendor is best: MFA for the manager login, device and browser coverage, sync, autofill, security alerts, recovery, and import and export options.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Secure the manager before adding passwords
- Create a long, unique primary password or passphrase. Do not reuse a password from another account. CISA advises using a long, unique, random passphrase to protect the vault.
- Turn on MFA for the manager account if it is offered. Follow the manager’s setup flow and keep its recovery information somewhere safe and accessible to you.
- Set up sync and autofill on the devices where you need them. On Apple devices, Apple documents Password AutoFill under Settings > General > AutoFill & Passwords. Google’s documented cross-device flow uses a Google Account signed in to Chrome and permission for Chrome to use saved passwords. Exact labels and options can vary by OS and version.
Keep recovery details current. If you lose access to the manager and have no working recovery method, getting back into the vault may be difficult or impossible; do not treat recovery as an optional afterthought.
Use a generated password when creating an account
- Open the genuine service or app and start its sign-up process.
- When the manager offers a strong password, accept it rather than inventing one you might reuse.
- Save the password in the manager when prompted, and let autofill enter it at the next sign-in.
- If the site rejects the generated password’s length or character combination, adjust the manager’s generator to meet that site’s rules. Generate a different password; do not recycle one from another account.
Apple’s iPhone guide documents the suggested-password, save and AutoFill flow at Automatically fill in strong passwords on iPhone. Google documents generated-password saving and autofill in its Password Manager guide.
Rank #2
- Requires 3 "AAA" batteries (included)
- Unit auto-locks for 30 minutes after 5 consecutive incorrect PINs
Replace reused or weak passwords gradually
You do not have to change every password in one sitting. Use the manager’s security review, if available, to identify reused, weak or exposed passwords. Prioritize accounts whose loss could disrupt access to many others—such as your primary email—and financial accounts. For each one, go directly to the real service, change the password, and save the replacement in the manager immediately. Change credentials on the affected service when an alert reports exposure; the manager cannot change them for you.
Free tools Windows power users keep installed
One-click scans. No signup required.
A unique password limits the damage from reuse: if one service is breached, an attacker cannot use that same password to try to enter your other accounts. NIST recommends password managers for password-based accounts and explains that MFA can help protect an account even if its password is compromised. See NIST’s password and MFA guidance.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Turn on MFA and keep recovery details current
Enable MFA or 2-Step Verification on important accounts wherever it is available, especially accounts that can reset access to others. If a service offers multiple factors, choose a stronger available option that you can reliably use. MFA adds a layer of protection; it does not eliminate phishing or account-recovery risks. Google also advises users to add recovery information and turn on 2-Step Verification in its Password Manager guidance.
Review security alerts from your manager. For a reused or exposed password, change it on the actual service, then save the new credential. If you receive a sign-in prompt or link unexpectedly, do not assume the manager makes it safe: check that you are on the genuine service before entering credentials.
Rank #4
- FIDO-ONLY FUNCTIONALITY: Supports FIDO2 (passkeys) and FIDO U2F protocols for passwordless and second-factor authentication. Does not support OTP, TOTP, Smart Card (PIV), or other advanced features - upgrade to YubiKey 5 Series for extended functionality
- SECURE AND CONVENIENT: Passwordless MFA login with the YubiKey Bio authenticator and biometric information using a fingerprint, with a PIN as a fallback. Simply plug in via USB and use your fingerprint to authenticate
- DEVICE & OS COMPATIBILITY: Compatible with Windows, macOS, ChromeOS, and Linux. Works seamlessly with supported services like Google and Microsoft accounts, and major password managers. See the full compatibility list at "Works With YubiKey"
- DURABLE & RELIABLE: Resistant to tampering, water, and crushing. No batteries or network connectivity required, offering dependable authentication without any downtime. Securely manufactured in USA & Sweden
- Yubico Authenticator App - Fingerprint enrollment, passkey management and PIN configuration available via the app app - Upgrade to YubiKey 5 Series to generate one-time-passwords (OTP) via Yubico Authenticator and for advanced compatibility (OATH, PIV)
Know what a password manager cannot do
A password manager helps create and remember distinct passwords; it cannot stop you from typing a password into a convincing fake site. NIST cautions that even a long, complex password will not help if you send it to an attacker. Verify the site or app before signing in, and be wary of unexpected links and requests.
Passkeys are another sign-in option where a service supports them. They are not passwords, and adopting them does not mean you must abandon a password manager: many accounts still use passwords, and a manager can continue storing those credentials and, depending on the product, other sign-in information.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
