Password Manager Security Checklist
A password manager can dramatically improve account security, but only if it is configured and used correctly.
This checklist explains how to evaluate the app, lock down the vault, and reduce the most common failure points before they become an incident.
What a Secure Password Manager Should Protect
A strong password manager protects encrypted credentials, supports secure authentication, and limits exposure if a device or account is compromised.
The best tools also use modern cryptography, support multi-factor authentication, and offer transparency through independent audits and security documentation.
- Encrypted vault storage: Passwords should be encrypted at rest with a strong, well-reviewed algorithm.
- Zero-knowledge design: The provider should not be able to read your vault contents.
- Multi-device sync: Sync should be convenient without weakening access controls.
- Cross-platform support: Desktop, browser, and mobile apps should be regularly updated.
Choose a Trusted Provider First
Before configuring anything, verify that the product has a strong security reputation.
Look for published security whitepapers, bug bounty programs, third-party penetration tests, and a history of responsible incident disclosure.
Providers such as 1Password, Bitwarden, Dashlane, NordPass, Keeper, and LastPass are widely known, but brand recognition alone is not enough; the details of implementation matter.
Provider evaluation checklist
- Supports end-to-end encryption or zero-knowledge architecture.
- Uses a modern password-based key derivation function such as Argon2id, PBKDF2, or scrypt.
- Offers MFA options like authenticator apps, security keys, or passkeys.
- Publishes security audits from firms such as Cure53, NCC Group, or other reputable assessors.
- Explains its breach history clearly and describes remediation steps.
Set a Strong Master Password?
The master password is the single most important secret in the system.
If it is weak, reused, or guessable, the entire vault becomes vulnerable regardless of how strong the saved passwords are.
Master password best practices
- Use a long passphrase of at least 16 characters, and longer if possible.
- Avoid personal information, dictionary-only phrases, or patterns.
- Never reuse a master password from email, banking, or social accounts.
- Store it only in memory or in a secure recovery process, never in plain text notes.
If the manager supports a password generator for the master credential, use one only if you can securely back up the recovery method.
For many people, a memorable passphrase is safer than an unremembered random string that gets written down poorly.
Turn On Multi-Factor Authentication
Multi-factor authentication adds a second layer of defense if the master password is exposed.
For a password manager, the ideal second factor is a hardware security key or passkey, followed by an authenticator app.
SMS-based verification is better than nothing, but it is weaker because phone numbers can be hijacked through SIM swapping and social engineering.
Preferred MFA order
- Hardware security key or passkey.
- Authenticator app such as Microsoft Authenticator, Google Authenticator, or 1Password’s built-in TOTP support where appropriate.
- Backup recovery codes stored offline.
- SMS only as a fallback, not the primary method.
Review the Encryption and Key Derivation Settings
Not all password managers use the same cryptographic defaults.
A proper password manager security checklist should include verification of the key derivation function, encryption standard, and local data protection model.
The application should protect the vault even if cloud storage is compromised.
- Encryption: Look for AES-256 or another modern, well-validated cipher.
- Key derivation: Argon2id is considered strong for resisting brute-force attacks; PBKDF2 remains common in many mature products.
- Local protection: Desktop and mobile apps should support biometric re-locking, device PINs, or OS-level secure storage.
- Session control: Idle vault auto-lock should be configurable and enabled by default.
Harden Device and Browser Security
A password manager is only as secure as the device that runs it.
Malware, malicious browser extensions, and insecure operating systems can capture credentials after they are decrypted for use.
Device hygiene checklist
- Keep the operating system updated on Windows, macOS, Linux, iOS, and Android.
- Install browser extensions only from trusted vendors.
- Remove unused extensions, especially coupon tools, download helpers, and shopping add-ons.
- Use full-disk encryption on laptops and smartphones.
- Enable screen lock, biometric unlock, or strong device PINs.
If you use browser autofill, make sure it is limited to known sites and that the browser itself is configured to prevent unauthorized extension access.
Consider using a dedicated browser profile for sensitive work.
Audit Sharing and Recovery Features
Sharing is one of the most overlooked risk areas in password management.
Family plans, team vaults, emergency access, and shared folders can be useful, but they expand the attack surface if permissions are too broad.
Questions to ask about sharing
- Can you share individual items instead of entire vaults?
- Are permissions limited to read-only when needed?
- Can access be revoked immediately?
- Are audit logs available for team or business accounts?
Also review account recovery carefully.
Recovery options should be secure enough to help legitimate users, but not so weak that they bypass the main authentication model.
Store backup codes offline and verify the recovery process before an emergency occurs.
Use the Password Generator Correctly
The built-in generator is one of the most valuable features in any password manager.
It should create long, unique credentials that are different for every service, including email, financial accounts, cloud platforms, and work logins.
- Generate unique passwords for every account.
- Prefer 16 to 24 characters or more when site rules allow it.
- Use mixed character sets unless a service has strict limitations.
- Avoid modifying generated passwords to make them “easier” to remember.
Where supported, upgrade major accounts to passkeys.
Passkeys reduce dependence on reusable passwords and can make phishing much harder, especially when paired with a secure device and biometrics.
Check for Breach Monitoring and Alerting
Many password managers now include breach monitoring, dark web alerts, and reused-password detection.
These features do not prevent compromise on their own, but they can speed up response time when a credential appears in a leak.
- Enable breach alerts for primary email addresses and critical accounts.
- Review security dashboards that flag weak, reused, or compromised passwords.
- Update credentials immediately when a service reports a known incident.
Make sure alerting is tied to a monitored email inbox and that notifications are not buried by marketing messages.
Secure Your Vault in Daily Use
Day-to-day behavior matters as much as setup.
A well-configured password manager can still be undermined by bad habits like leaving the vault open, approving login prompts blindly, or entering credentials on lookalike sites.
- Lock the vault when switching devices or stepping away from the screen.
- Verify domain names before autofill on sensitive accounts.
- Do not approve unexpected MFA prompts.
- Use separate vaults or profiles for work and personal credentials when appropriate.
- Review recent logins and security activity regularly.
Perform a Quarterly Security Review
Security is not a one-time setup.
A quarterly review helps catch drift in settings, outdated apps, new sharing links, and credentials that were added without proper hygiene.
Quarterly review checklist
- Confirm the master password is still strong and private.
- Verify MFA is enabled and backup codes are stored safely.
- Check for weak, reused, or old passwords.
- Remove inactive shared items and expired access.
- Update all apps and browser extensions.
- Test account recovery on a non-critical account if the provider allows it.
Organizations should also review admin roles, device trust policies, and offboarding procedures for former employees or contractors.
For families, make sure emergency access and shared vault permissions still match current needs.