classic catch-22: If they’re good, they’re hard to remember. But if they’re easy to recall, they aren’t effective. Because we are an eminently practical species, most of us err on the side of convenience. “Password” and “123456” have been the two
on the web (“admin” also ranks high), and in 2026, sadly, that’s still the case.
It doesn’t have to be this way. In this article, I’ll teach you how to memorize hundreds of random 16-character strings and keep track of which works where.
, but it probably won’t for you and me. What I will do is help you find a password manager to do the memorizing for you and give you access to those crazy-long, crazy-strong passwords whenever and wherever you need them.
Updated August 2026: We’ve revamped and reorganized this guide based on more recent testing.
is secure, open source, and free with no limits. The applications are polished and user-friendly, making Bitwarden the best choice for most users. Did we mention it’s open source? That means the
is freely available for anyone to inspect, seek out flaws, and fix. In theory, the more eyes on the code, the more airtight it becomes. Bitwarden is
to ensure it’s secure. You can even install it on a local server for easy self-hosting if you prefer to run your own cloud.
Bitwarden offers apps for Windows, macOS, iOS, Linux, and Android, as well as extensions for all major web browsers. Bitwarden also supports Windows Hello and Touch ID on its desktop apps for Windows and macOS, giving users the added security of those biometric authentication systems. The web interface (which I frequently use) is also well done and easy to use.
Bitwarden supports passwordless authentication, meaning you can log in with a one-time code, biometric authentication, or a security key. Bitwarden also has excellent support for passkeys, including the ability to
, which means you don’t need to use your username or password even to open your vault. There’s also some extras, like a feature to securely share files (called
), a built-in 2FA authenticator app (paid only), and an extremely
We like Bitwarden’s semi-automated password fill-in tool. If you visit a site you’ve saved credentials for, Bitwarden’s browser icon shows the number of saved credentials from that site. Click the icon, and it will ask which account you want to use and then automatically fill in the login form. This makes it easy to switch between usernames and avoid the pitfalls of autofill. If you simply must have your fully automated form-filling feature, Bitwarden supports that as well.
Most web browsers offer at least a rudimentary password manager. (This is where your passwords are stored when Google Chrome or Mozilla Firefox ask if you’d like to save a password.) This is better than reusing the same password everywhere, but
. In recent years, Google has improved the password manager built into Chrome, but it’s still not as full-featured or widely supported as a dedicated password manager like those below.
It’s not as secure, either. Although your passwords are encrypted in your browser, they’re trivially easy to decrypt if someone has access to your computer. Avoid using your browser’s password manager if someone else can potentially get access your machine.
WIRED readers have also asked about Apple’s password manager, which syncs through iCloud and has some nice integrations with the Safari web browser—even a dedicated app. There’s nothing wrong with Apple’s system. It doesn’t have some of the nice extras you get with dedicated services, but it can secure your passwords and sync them among Apple devices. The main problem is that if you have any non-Apple devices, you won’t be able to sync your passwords to them. All in on Apple? Then this is a viable, free, built-in option worth considering.
A concerted effort to get rid of passwords began roughly two days after the password was invented. Passwords are a pain—you’ll get no argument here—but we don’t see them going away in the foreseeable future. The latest effort to eliminate the password comes from the
, an industry group aimed at standardizing online authentication methods. Does this sound a little bit like the infamous
? Yes, yes it does. But thanks to the monopolistic nature of devices, it might work this time.
, which has caught on. Passkeys are generated cryptographic keys managed by your device (usually your phone). They’re easy to create—you don’t need to do anything, as your device handles the details. Your passkeys are stored on your device and protected by either biometrics or PINs. Since passkeys are
instead of passwords, there’s nothing to remember. If you are familiar with
, they’re somewhat similar in that there’s a public and private key; the website you want to log in to has a public key and sends it to your device. Your device compares that to the private key it has, and you’re signed in (or not, if the keys don’t match).
While passkeys aren’t a radical departure, they’re still an improvement by