Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
There is no single replacement for a password manager. Passkeys can replace passwords on compatible sites, built-in browser or operating-system storage can handle credentials with minimal setup, and a local or self-hosted vault can give you more control. Many people should combine them: use passkeys where they are supported, retain a vault for remaining passwords and recovery information, and choose built-in storage only when it works across every device you need.
The right choice depends on four practical questions: which services you use support passkeys, which devices and browsers must work together, how you will recover access after a lost device, and whether you want to operate backup and server infrastructure yourself.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →As an Amazon Associate I earn from qualifying purchases.
What are the main alternatives to a dedicated password manager?
The alternatives fall into four overlapping categories rather than four mutually exclusive products.
| Approach | What it stores or does | Best fit | Main responsibility |
|---|---|---|---|
| Passkeys | Cryptographic sign-in credentials for services that support them | Phishing-resistant sign-in with little or no password entry | Protecting and recovering the passkey provider or device |
| Browser or operating-system storage | Passwords, passkeys, and sometimes payment or identity data, depending on the platform | People already using one compatible device ecosystem | Checking cross-device compatibility, account recovery, and sharing limits |
| Local encrypted vault | A vault file kept under your control, often with passwords, notes, and recovery codes | Users who want offline ownership and are willing to manage synchronization | File security, synchronization, backups, and restoration |
| Self-hosted vault service | A server-based vault accessed by your own clients | Households or organizations needing centralized access and control | Server deployment, updates, network security, monitoring, backups, and disaster recovery |
These layers can coexist. A passkey provider may hold passkeys while a vault stores accounts that still require passwords, backup codes, software licenses, secure notes, or household information.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
How do passkeys work, and are they a replacement for passwords?
A passkey is a credential created and managed by a passkey provider for a compatible website or app. The provider may be built into a browser or operating system, or supplied by a third-party manager. During sign-in, the service verifies a cryptographic response rather than receiving a reusable password; the private key remains with the provider and is not sent to the service.
The FIDO Alliance describes the provider’s role this way: “A passkey provider is responsible for the creation and passkey management of a user’s passkeys.” That definition matters because a passkey is not simply a password that a browser has autofilled. It has its own creation, synchronization, device, and recovery behavior.
Synced and device-bound passkeys are different
A synced passkey can be made available on other devices signed in to the same provider account, subject to that provider’s platform support. Google documents local encryption before synchronization and supported cross-device sign-in flows, including using a nearby phone. A device-bound passkey keeps its private key on one physical device; losing that device can therefore require another registered sign-in method or an account-recovery process.
Do not assume that a passkey created on one phone will appear everywhere. Availability depends on the provider, operating system, browser, account state, and the service’s own implementation. A compatibility table published for one service, such as Microsoft Entra, describes that service’s supported providers and minimum versions; it is not a universal promise for every website.
What a passkey protects against
Passkeys avoid many password-reuse and password-phishing scenarios because a site receives a public key and the private key is used locally. They do not protect an account if you approve a fraudulent login prompt, lose control of the provider account, or leave no usable recovery method. A passkey also cannot sign in to a service that still requires a conventional password unless that service offers another supported method.
Where hardware security keys fit
A FIDO2 security key is an optional physical way to hold a device-bound credential on services that support it. It can provide a separate sign-in factor or a way to register a passkey outside your phone, but it is not a complete password manager. Keep at least one recovery route and understand whether the service requires a backup key, a recovery code, or an administrator reset.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Should I use passkeys without keeping a vault?
Usually, no. Passkeys can reduce the number of passwords you need, but they do not remove every credential or every sensitive record from your life.
- Some banks, government portals, older business systems, and other services still require passwords.
- Recovery codes, backup keys, identity documents, Wi-Fi credentials, software licenses, and secure notes are not automatically handled by a passkey.
- Changing devices or recovering a provider account can require information that is separate from the passkey itself.
A practical arrangement is to register passkeys on supported services while retaining a small, well-protected vault for the accounts and recovery material that cannot use them. Review that vault periodically; its purpose is to cover the remaining gaps, not to duplicate every passkey.
Is a browser or operating-system password manager enough?
Built-in storage is enough when it is available on all of your important devices, fills credentials reliably in the browsers and apps you use, and gives you an account-recovery method you trust. It is the lowest-maintenance option because it is already integrated, but convenience can be lost when a household spans several ecosystems.
Recommended Free Tools
Check the actual devices, not the brand label
Make an inventory of the operating systems, browser profiles, phones, tablets, and computers that need access. Google documents Google Password Manager behavior across Chrome and Android environments, while platform support varies elsewhere. A built-in provider on one operating system may not expose the same passwords or passkeys to another operating system, and a browser’s desktop and mobile behavior may differ.
Before moving everything, test a non-critical account on each device. Confirm that the provider appears in the browser or operating-system credential settings, that autofill works in the apps you use, and that a newly created passkey can be found from a second device if synchronization is expected.
Convenience, sharing, and organization trade-offs
Built-in tools are often excellent for one person inside an established ecosystem. Dedicated vault products may offer broader browser coverage, multiple vaults, family or team sharing, custom fields, and richer organization, but those features vary by product. Do not infer that every built-in manager lacks sharing or that every standalone tool supports it; verify the exact feature on the platforms in your household.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
When built-in storage is a poor fit
Choose another arrangement when you regularly move between incompatible ecosystems, need controlled sharing with family or colleagues, require a local offline copy, or need secure records beyond ordinary logins. A browser manager can still remain enabled for passkeys while a separate vault handles those exceptions.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →What is the difference between a local vault and a self-hosted vault service?
A local vault is an encrypted file that you control directly. A self-hosted service is a server application that you deploy and maintain, with clients connecting to it over your network or the internet. Both reduce dependence on a vendor’s hosted storage, but self-hosting adds substantially more operational work.
Local or offline vaults
Applications such as KeePassXC use an encrypted vault file that can remain on one computer or be copied to your own storage. You choose where synchronization and backups occur. That control is attractive for an offline-first workflow, but every copy becomes part of your security boundary: protect file permissions, encrypt the storage and backups, and decide how another device will receive an updated copy without creating conflicting versions.
Recovery is your responsibility. If the only copy is on a failed disk, or the encryption password is forgotten, there may be no provider able to restore it. Keep more than one protected backup and periodically open a test copy to confirm that it can be decrypted.
Self-hosted services
A self-hosted service centralizes the vault and can make multi-device access and sharing easier. Bitwarden’s self-host documentation lists several deployment paths, including standard server deployment, manual and offline options, a lighter deployment, and Kubernetes. Those paths have different skill and infrastructure requirements; selecting one is an operations decision, not merely an installation preference.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteSelf-hosting does not automatically make a vault safer. It transfers custody of the server, database, encryption configuration, network exposure, updates, logs, and backups to you. A well-maintained hosted service may be safer for a non-administrator than an internet-facing server that is rarely patched or never tested for restoration.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What must I maintain when I self-host a vault?
Plan self-hosting as a small production service. Bitwarden’s setup guidance calls for networking, certificates, updates, security review, backups, disaster recovery, monitoring, and user support; omitting any one of these can turn a minor outage into account lockout.
Deployment checklist
- Choose the deployment path. Match the documented method to your operating system, available hardware, container or Kubernetes experience, and whether the service must work offline.
- Define network access. Decide whether clients connect only on a local network or from outside it. If remote access is required, document firewall rules, DNS, and the exact exposed endpoints before opening ports.
- Configure certificates. Use the current instructions for trusted HTTPS certificates and plan how they will renew. An expired certificate can prevent every client from connecting even when the server itself is healthy.
- Create administrative recovery. Store administrator credentials, encryption keys, recovery codes, and any required environment secrets in a separate protected location. Do not leave the only copy on the server.
- Apply updates deliberately. Track application, operating-system, container, database, and certificate updates. Read release notes for migration or backup requirements before changing versions.
- Set up monitoring. Watch service availability, disk space, certificate expiry, failed logins, and backup jobs. A backup that silently stopped running is not a recovery plan.
- Test clients. Connect each browser, desktop app, and mobile device using the service’s client instructions. Test both local and remote paths if both are supported.
- Rehearse disaster recovery. Restore to an isolated system or test instance, verify that the vault opens, and document the order of operations. Repeat after major deployment changes.
Bitwarden explicitly states that self-hosted administrators are responsible for implementing their own backup procedures. The exact backup behavior depends on the deployment: its documentation notes, for example, that the Lite option does not take nightly backups and requires the operator to manage that process.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsHow should I design recovery and backups?
Recovery is the deciding factor among these alternatives. Write down how you would regain access after losing your main phone, forgetting a vault password, corrupting a server, or losing an authentication device, then verify that the plan works without relying on the failed item.
For passkeys and built-in providers
- Identify whether each important passkey is synced or device-bound.
- Confirm that the provider account has a current recovery email, phone, hardware method, or printed recovery code where the service allows one.
- Register a second device or another supported sign-in method before removing the old device.
- Keep account-recovery material outside the device that it is intended to recover.
For local vaults
- Keep multiple encrypted copies in separate physical or logical locations.
- Protect the vault password or key material with a method your future self can retrieve, without placing it unencrypted beside the vault.
- Test opening a backup on a spare device or isolated account.
- Record which copy is current and how synchronization conflicts are resolved.
For self-hosted services
- Back up the application data, database, configuration, certificates, and required secrets according to the deployment documentation.
- Use retention periods that cover delayed discovery of corruption or accidental deletion.
- Store at least one backup away from the server and protect it from the same administrator credentials.
- Perform a complete restoration exercise, not just a check that a backup file exists.
Recovery testing should produce a written runbook: where the backups are, which versions are required, which credentials unlock them, and how clients are pointed to the restored service.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How do I export credentials safely?
Export only when you have a specific migration or backup purpose. Export formats and encryption options differ. Bitwarden documents both plaintext and encrypted exports and warns that an unencrypted export must be handled as sensitive data.
- Choose a private device and a storage location that is not automatically shared or synchronized.
- Prefer an encrypted export when the destination supports it; if plaintext is the only option, treat the file like an exposed password list.
- Keep the export only for the time needed to import or verify it.
- Delete temporary copies, empty the recycle bin, and check synchronization folders, email attachments, downloads, and backups for duplicates.
- Change passwords or revoke sessions if an unencrypted export was misplaced or exposed.
An export is not a substitute for a tested backup. It may omit provider-specific data, passkeys, sharing relationships, attachments, or settings, so verify exactly what the selected format contains before relying on it.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Which option should I choose?
Use the following decision path instead of choosing by feature count.
Choose a passkey-first setup when
- Your most important services offer passkeys and your devices support the same provider.
- You want strong resistance to password phishing and fewer passwords to type.
- You are prepared to maintain provider-account recovery and a second sign-in route.
Choose built-in storage when
- Your devices and browsers are concentrated in one compatible ecosystem.
- You value automatic integration more than advanced organization or sharing.
- You have confirmed autofill, passkey, and recovery behavior on every device you actually use.
Choose a local vault when
- You want the encrypted vault file under your own control or need reliable offline access.
- You can manage synchronization, version conflicts, backups, and a recovery key.
- You do not need a continuously available shared service for a large group.
Choose self-hosting when
- You have a clear reason to operate the service yourself, such as infrastructure control or a specific deployment requirement.
- You can patch, monitor, secure, back up, and restore the server throughout its life.
- You have a recovery plan that still works when the host, network, or administrator account is unavailable.
If none of these conditions is true, a mixed arrangement is usually the least fragile: passkeys for compatible accounts, built-in storage where it is genuinely cross-device, and a carefully backed-up vault for passwords and recovery data that remain.
How can I migrate without locking myself out?
- Inventory accounts. Mark each account as passkey-capable, password-only, shared, business-critical, or recovery-sensitive.
- Secure recovery first. Confirm recovery methods and save codes before changing a sign-in method.
- Trial one low-risk account. Create a passkey or move one login to the proposed provider, then sign in from every required device.
- Build the destination vault or provider. Configure encryption, device locks, sharing permissions, and backup locations before importing more data.
- Move in batches. After each batch, verify sign-in, autofill, mobile behavior, and recovery. Keep the old method until the new one is proven.
- Remove stale access. Revoke old sessions, delete duplicate exports, and remove lost devices or unused passkeys from account settings.
- Document the final arrangement. Note which provider holds each passkey, where the vault backup lives, and who can perform recovery.
What commonly goes wrong?
| Symptom | Likely cause | Fix |
|---|---|---|
| A passkey is missing on a new device | It is device-bound, synchronization is disabled, or the provider is unsupported on that platform | Check the provider and account state, use the original device or another registered method, and register a supported synced passkey for future access |
| Autofill works on a computer but not in a phone app | The operating system has a different credential-provider setting or the app does not expose a compatible login field | Review the phone’s autofill and passkey-provider settings and test the app’s supported sign-in methods |
| Family members cannot use the same credentials | The selected built-in tool lacks the required sharing or separate-user model | Use an arrangement with explicit sharing controls, or keep shared records in a vault designed for that workflow |
| A self-hosted client suddenly cannot connect | Certificate expiry, DNS or firewall changes, a failed update, or a stopped service | Check monitoring, certificate validity, service logs, network rules, and the documented rollback or restore procedure |
| A backup exists but cannot restore | Only part of the deployment was copied, secrets are missing, or restoration was never tested | Restore in an isolated environment, capture every required component, and update the runbook before the next incident |
| An exported file was exposed | A plaintext export remained in downloads, cloud sync, email, or an old backup | Delete every copy you can find, revoke sessions, and rotate affected passwords; use encrypted exports where available |
What is the safest overall arrangement for most households?
For many households, the most resilient design is layered rather than ideological: use passkeys on supported services, use a built-in provider when all required devices are covered, and keep a separate encrypted vault for password-only accounts, recovery codes, and other sensitive notes. Add a local or self-hosted component only when you are willing to own its synchronization, maintenance, and restoration work.
Evaluate the arrangement after adding a new phone, computer, browser, or family member. Compatibility and provider support change by platform and service, so a setup that worked last year should not be assumed to work unchanged.
Free tools Windows power users keep installed
One-click scans. No signup required.
Frequently Asked Questions
Can I use passkeys and a password manager at the same time?
Yes. Passkeys and password vaults solve different parts of account access, and many people use both. Keep passwords and recovery records for services that have not adopted passkeys while using passkeys on compatible accounts.
What happens to my passkeys if I lose my phone?
The answer depends on whether each passkey is synced or device-bound. A synced passkey may be recoverable through the provider on another authorized device; a device-bound passkey requires another registered authenticator or the service’s account-recovery process.
Is a self-hosted vault usable without an internet connection?
Some deployment paths and clients support local or offline operation, but behavior depends on the specific software and configuration. Test offline sign-in before relying on it, and remember that a server isolated from the network still needs local backups and updates.
Should I print my recovery codes?
A printed copy can be useful when digital devices are unavailable, provided it is stored somewhere private and protected from casual access. Treat the paper as a high-value credential, limit who can reach it, and replace it when codes are regenerated.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
