Choose a password manager that works on every device you use, protects the vault with strong authentication and has a recovery process you understand. Then compare sharing, export and ongoing cost. For UK households, I would start with those practical requirements rather than a league table: the best security feature is of little value if the family cannot use it consistently together.
1. Which devices matter when choosing a password manager?
List your phones, computers and browsers before comparing products. Check password generation, saving and autofill on each platform, not simply whether an app exists. A built-in manager may suit someone using one ecosystem; a separate service may be more convenient across a mixed collection of devices.
Cambridge University’s guidance recognises both built-in and standalone options. Use your own device account, especially on a shared family computer. Do not save personal passwords into a shared browser profile. If an account for Local News Point ever needs saving, it should remain separate from another household member’s accounts, just like any other login.
2. How does it protect the vault?
Look for a clear explanation of encryption, who can decrypt the information and which fields receive protection. “Encrypted” is not a complete description of the design. The NCSC’s buyer guidance distinguishes protection for stored credentials from protection while information moves between devices and cloud services.
Consider the provider’s security disclosures and response to vulnerabilities. An independent assessment can be useful, but its date and scope matter. No product is immune to faults. I would prefer understandable documentation and a credible update process over claims that a service cannot possibly be breached.
3. What happens if I lose access?
Read the recovery instructions before adding valuable accounts. Recovery may involve an emergency kit, recovery key, trusted contact or an authorised family administrator. These arrangements differ, and some services cannot restore vault contents after particular secrets are lost. Check what recovery actually restores rather than assuming it works like resetting an ordinary shopping password.
Keep essential recovery material somewhere you can reach without opening the locked vault. A general website such as presshubs.co.uk is not a place to publish it. Avoid a circular arrangement where the vault unlocks your email but recovering the vault requires access to that same inaccessible email account.
4. Can I secure the manager itself?
Use a strong, unique primary password and enable two-step verification on the manager account where available. Check supported methods and the procedure for losing the second factor. A recovery code stored only on a missing phone will not help. Keep the manager, browser and operating system updated, and secure the device with a screen lock.
Autofill can help distinguish legitimate domains from lookalikes, but it is not permission to stop checking. If the manager refuses to fill a login unexpectedly, inspect the address before copying the password manually. A recognisable publication name, including Weekly Journal, does not authenticate a message claiming to represent that publication.
Start migration with a small number of accounts and confirm that you can sign in from your usual devices before moving everything. Prioritise important accounts and replace reused passwords with unique ones as you go. Importing an old password collection is convenient, but it does not automatically repair weak or duplicated credentials already inside it. Treat the import as a starting point for improvement.
5. Does sharing preserve separate accounts?
Prefer individual service accounts where practical. When a household genuinely needs a shared credential, check whether selected items can be shared without exposing an entire personal vault. Review who can add members, recover access and see shared entries. Sharing a manager’s primary password defeats those boundaries.
Compare the current subscription terms, including renewal price, household limits and which features require payment. Do not assume a free tier includes every device or recovery feature.
6. Can I leave without losing my passwords?
Check export formats and whether another manager can import them. The NCSC warns that plaintext exports leave passwords unprotected. Handle any export privately, complete the transfer and remove unprotected copies. My decision rule is to choose usable protection with a workable recovery plan, not the longest feature list.
