Password Managers and Saving the Web.

The Most Important Line of Defense is the First One.

You need an account for everything these days. We live in an age where literally our clocks connect to the internet and authenticate through a user account we own. Password fatigue is the term for a feeling people experience when remembering passwords becomes an unavoidable part of everyday life. SSO(Single Sign-On) is one attempt to alleviate this problem, but this requires either a highly complicated business-grade configuration or further centralizing Silicon Valley's already significant hold. And that is if it is even supported by the services you want to use which when dealing with web services, the primary culprits of our current account flood woes, is a pretty massive if. This issue is more severe than most people give it credit for because it directly encourages bad OPSEC by users. We already have a hard enough time encouraging users to actually think of secure passwords in the first place, but it is practically impossible to expect users to manage dozens and dozens of different passwords for the dozens and dozens of services they use. The easy solution for most people is to use the same(hopefully secure) password everywhere. This becomes a problem when you consider the massively growing amount of detailed personal information that people put online, which leaves us with a massive issue, one that cannot be underestimated, and needs to be taken seriously.

So What do We do?

We delegate. Computers got us into this mess, and computers can get us out. Password managers are programs that store, encrypt, and organize a plethora of accounts, and often even provide other services, like notifying you if an account is leaked, generating secure passwords, or auto-fill. While I am firmly in the belief that any password manager is better than none, not all are created equal, far from it.

So How do We Choose?

Well, first we need to understand what we are comparing. Password managers can roughly be split into two groups, cloud-based, and local storage. The difference is somewhat self-explanatory, cloud-based password managers store your accounts remotely on a central server and sync this with you various devices when needed, whereas local storage password managers store your accounts on one or multiple devices(Most local storage options also utilize cloud syncing between devices, but the distinction is unimportant for the topic at hand). There are trade-offs for both methods, and picking the right password manager for you is important, as it will become a more and more integral part of your routine online as you become accustomed to it.

The Cloud-Based Options

We will be getting my least favorite of the two choices out of the way first. Cloud-based option though having significant advantages in password/account recoverability, and convenience. Have the critical flaw in that you are putting a huge amount of trust in a single service. Cloud-based solutions by their very nature, centralize, not just yours, but everyone's, critical data in one place, and you are placing a huge amount of trust in whoever you choose as your provider to keep your passwords safe.

Google Password Manager

Google password manager is about as convenient as convenience gets. Seeing as Google Chrome continues to absolutely dominate the browser space, and many of its competitors are still reliant on chromium and google services, a password manager baked into your google account is pretty much a Just Works^tm solution. They don't offer any local applications, making managing non-website accounts cumbersome, and as with all things non-apple, support for Mac/ios is rocky. As much as I might loath the idea of ever recommending anyone sell out to Big Daddy Google^tm they are big for a reason, and the combination of seamless android integration and a hassle-free browser experience make it a compelling option if you have no standards and don't value your soul. I mean we already trust google, with the livelihood of essentially our whole society so what are a few passwords right?
Found here:
https://passwords.google.com/

Firefox Lockwise

Mozilla's half-assed competitor to Google Password Manager. It can provide convenient storage of website passwords and provides essentially all the same basic functionality that GPM does, and has the advantage of not being owned by Google, with the disadvantage of being owned by Mozilla. They used to provide an android and ios app, but these have been largely abandoned in favor of their useless VPN service. This is hilariously typical of Mozilla, perhaps it stepped on Daddy Google's toes a bit too much. All in all, I would avoid it, it lacks the ubiquity of googles solution and suffers from all the same drawbacks.

LastPass

LastPass while theoretically not as soul-sucking as Google, is probably one of the worst actual products on offer. The free version of Lastpass is essentially worthless, with heavy limitations on how you can use it, an unwelcoming interface, and a long history of security issues, it isn't anything I can recommend in good or bad faith. It lacks even the superficial advantages of GPM and just gets in the way more than it helps.
Found here if you hate yourself:
https://lastpass.com/

The Good Ones

Now that we have sifted through the trash, we can talk about local storage password managers, these tend to be much more competent, and by their nature the more secure option of the bunch. They do however typically require more of the end-user. When using these you have to be careful not to forget your "master account" credentials as this will often leave the passwords irrecoverable.

Dashlane

Dashlane is rock solid as far as password managers go, tho it has the significant drawback of being a primarily paid service. The free tier is essentially a trial and wouldn't be practical for long-term use. Unlike LastPass, Dashlane is arguably worth paying for, but this cost really holds it back when compared to some of our other options. And even when comparing paid options it stands as one of the most expensive. Costing at least 3 dollars a month(if billed annually), and even then restricting you to two devices. Due to these drawbacks, I can't recommend it for personal use. It is however a really compelling option for small businesses looking to centrally manage company accounts.
Found here:
https://www.dashlane.com/

1Password

One of the big kids on the block, and overall a solid choice. Like Dashlane it is primarily a paid service costing around 3 dollars monthly(again if billed annually) while having unlimited devices. They even included additional features like a travel mode to clean your devices local storage of sensitive info when going overseas, a digital wallet to make online purchases more convenient, and alerts when your accounts are involved in breaches. They are probably the best out of all the paid options and an excellent choice for both individuals and businesses.
Found here:
https://1password.com/

Myki

Myki is a lesser-known password manager that has gained a strong core audience due to it being completely free for individuals, and advertising itself as an offline password manager, meaning that it relies on no central server to sync between devices. This appeals to the particularly paranoid as you don't need to place any trust in the company to store the information responsibly, but has the downside of making the information irrecoverable should you lose all connected devices. It does offer some additional features like a digital wallet and 2FA. Myki is a really good option for anyone that has lots of devices they use personally, for example, a desktop at home, a laptop for work/school, and a phone, all synced together.
Found here:
https://myki.com/

Bitwarden

Bitwarden is my personal favorite and password manager of choice. I mean what's not to love, it's fully featured including digital wallet and identity management, it is open-source, its free version is more than enough for the majority of users, the paid services are cheap while remaining worthwhile for power users, and it even includes the option to self-host the server component to gain access to premium features without the subscription(Guide on how coming soon). The paid tier comes with 2FA, and 1GB of encrypted storage, and comes out to $10 a year. I highly recommend it, it really stands out among its competitors even when not self-hosting or paying for premium.
Found here:
https://bitwarden.com/

Pass

Pass is the Linux power users password manager of choice (it is also available for all other major platforms). The idea is simple, build a password manager that complies with the Unix philosophy. It is probably by far the most secure out of any of the options I have covered due to its small codebase and all passwords being locally encrypted. Pass doesn't even sync between devices on its own. It is an incredibly powerful tool in the right hands but requires a significant amount of investment and configuration by the user, and so isn't something I can recommend to just anybody. If you are the kind of person that can benefit from tracking their password changes through git or are just a particularly paranoid privacy buff then I highly recommend looking into it as an option.
Found here:
https://www.passwordstore.org/

In Conclusion

There is a wide range of password managers to choose from, though the vast majority provided the same basic features. In reality, just about any of the options will suit your basic needs. So please, ditch that old one size fits all password you have had since high school and use some secure unique and reliable passwords. It is often easy to ignore these kinds of small problems and think "why would someone care about my accounts", or "so what if they get access to ___" but we often don't realize just how much information we expose on the internet, and the more someone knows about you, the easier it is to learn more.