What's the best password manager?
Hi, everyone. Leo Notenboom
here for askleo.com.
It's no secret that I and many, many other tech and security professionals
specifically recommend that you use a password manager or a password vault
to enable you to use multiple different passwords that you can't possibly remember
because the password vault remembers them for you.
The question, of course, is what's the best one?
What password manager should I use?
Well, there's actually some really good
news here, and that is that it's kind of hard to go wrong.
I'll look at some of the password managers
that are available today, mention a few that I think are worth
considering, tell you what I use, and then tell you about one specific
decision that you need to make when you choose which password manager to use.
So I'll cut to the chase.
I use and recommend LastPass.
I've used it for years.
I started using it many years ago when
the one I had been using basically locked you in.
That's changed since then,
but I was unable to export, so I basically had to start over if I was
going to start over with a different password manager.
LastPass lets you import, lets you export, let you do all the good things.
One of the reasons I switched to it, though, is that at the time,
and this goes back a few years, steve Gibson of GRC and the Security Now
podcast did a breakdown of exactly how the technology in LastPass was implemented.
And it just makes sense.
I mean, it makes sense to me.
I understand what they're doing.
They're doing things right, and I appreciate that.
I've gone all in on LastPass ever since.
Now, if I weren't able to use LastPass for whatever reason, what would I look at?
There are three that come to mind right off the top of my head.
Number one would probably be BitWarden.
Whenever I've talked about password managers here in the past,
BitWarden is one that a lot of readers comment on and recommend.
So really don't have any difficulty recommending that as an alternative.
A good friend of mine switched to it not
that long ago and seems to be very happy with it.
Another one, 1password, is another
approach to password management that is a good tool.
I keep hearing lots and lots of good things about it.
I would evaluate it before I formally recommended it.
But again, I have friends that either use it or have used it and really don't have
too much hesitation saying, if you choose that one, you'll be fine.
Another one is Keepass.
Keepass is a free open source utility that stores passwords for you.
KeePass highlights one of the distinctions between different families of password
managers and that is where do they store your stuff?
So LastPass and BitWarden,
and I believe now 1password all store your encrypted passwords on their servers.
It's encrypted in such a way that even if
hackers were able to gain access to their servers, that data would do them no good.
They would not have access to your passwords.
Just because it's stored there doesn't mean that it's accessible.
All of these utilities do the right thing when it comes to encryption.
One thing that's important to understand is that I know for LastPass,
and I assume for these others, they don't know your password.
I've talked about how passwords and hashes relate.
All they can do is determine that you
typed in your password correctly, but they can't tell you what your password is.
What that means is that your password is not stored at the data center.
It's not there anywhere.
They have no way of accessing your data, even though it's stored on their servers.
That's convenient, because what it means is that for me, using LastPass,
I sign in on whatever machine I happen to fire it up on, and my entire password
vault becomes available to me without much delay at all, actually.
And everything is kept in sync across all of the machines that I happen to use.
And as you might imagine, I use several.
Key\epass, on the other hand, doesn't have a central store.
What they do is they let you decide where you want to keep your database.
You can keep it on your machine, you can keep it on a thumb drive,
you can keep it on a Dropbox account if you feel so inclined.
You can do the storage.
You can manage where things are stored yourself.
Once again, it's an encrypted database so
that if somebody were able to get their hands on it without knowing your master
password, they would not be able to get in.
The difference is it's stored explicitly
where you say it is going to be stored, and not on someone else's cloud server,
unless you choose a cloud service provider like Dropbox or OneDrive or whatever.
Now, there are a couple of others that have good reputation that
I would probably not evaluate right away if I had to switch myself.
But they're worth mentioning because
there are also cases where you probably wouldn't go far wrong if you chose them.
Those two right now are Dashlane, which I did look at a couple of years ago,
and RoboForm, which is the one that I switched away from many years ago.
They've been around forever.
RoboForm has implemented export since then, so I probably wouldn't have been
quite as incentivized to move away from them.
So it is one of those tools that, again, it's been around forever,
has a good following, and seems to be pretty reputable.
The question, of course, is which one is best?
Well, here's where the good news comes in.
Of all of the ones I've mentioned, and probably some others,
the best password manager is whichever one you will actually use.
It's kind of like backing up that way.
The best backup is whatever backup
technology or strategy you'll actually do so if you don't like the concept of having
your passwords stored in the cloud, like LastPass or one password,
then use something like Keypass and store it somewhere safe yourself.
Take responsibility for backing it up,
take responsibility for keeping it secure, but do it yourself.
On the other hand, if you
use Lastpass and you don't like it, then try one of the others.
If you use 1password and you don't like it, try one of the others.
They all have their quirks, right?
None of them are perfect, but all of them are good.
So my bottom line is use a password manager.
Absolutely. Use a password manager.
Then, as you're deciding which one to use, consider where it's going to keep your
data, which platforms are supported in, the various plans that the password
manager may offer, how they make your passwords available
across all the different platforms that you might happen to use,
how complicated it feels to set up and to actually use, and of course, cost.
I think all of these either are or have free versions available.
But honestly, password management and overall security
is something that I feel is worth investing in.
I have a paid LastPass account that gives me some additional features that are
important to me and of course supports the development.
It's one of those things where you do want to pay attention to what you might end up
having to spend, but realize that you're spending it on something important.
I hope that helps you decide.
By all means, use a password manager.
Please.
For updates, for comments,
for links related to this topic and more, visit askleo.com./148053
I'm Leo Notenboom.
And this is Askleo.com. Thanks for watching.