Every year for the last three years, someone has told me password managers are obsolete because passkeys are coming. Meanwhile the average person’s password situation has barely moved: four or five passwords reused across dozens of accounts, stored in a notes app, a browser’s autofill, and memory.
Here’s the honest state of things in mid-2026, and what I actually recommend to family members who ask.
Why passkeys didn’t replace the manager
Passkeys are real and excellent — I use them everywhere they’re offered. But adoption is uneven: banks, government services, and regional sites mostly still run on passwords. The realistic situation for years to come is hybrid: some accounts on passkeys, the rest on passwords, plus the recovery codes, one-time backup codes, and passphrases that don’t fit anywhere else.
That hybrid mess is exactly what a password manager organizes. The manager didn’t become obsolete; it became the filing cabinet for the transition.
What a manager does that browser autofill doesn’t
Browser autofill stores passwords. That’s where the feature list ends, and it’s the reason people who “use Chrome’s passwords” still have the same problems:
- Cross-device, cross-browser: your passwords work in Safari on your phone and Firefox on the family laptop.
- Recovery codes and identity documents: the 2FA backup codes, the insurance policy number, the WiFi password for the cabin — the stuff that isn’t a password but ruins your month when lost.
- Password sharing with family for shared accounts (utilities, streaming), with per-item control.
- Breach alerts that tell you which password on which site was exposed, not a vague “you may have been affected.”
- Emergency access: a designated person who can unlock the vault if something happens to you. This is the feature nobody thinks about until it’s needed at the worst possible moment.
The three questions that actually matter when choosing
Ignore the feature comparison tables. Ask:
- Is it on every device the family uses? The best manager is the one that’s there when the login prompt is. A brilliant manager that isn’t installed on the tablet is a liability.
- Is export possible? You must be able to leave. Any manager that traps your data is disqualified on principle.
- Does it have a workable recovery path? The master password is the one password with no “forgot” button. Recovery needs to be a thought-through process — an emergency kit printed and stored, a recovery contact, or both.
The mainstream paid options all pass these tests. The free ones (including the good ones) mostly do too, with sharing limits. Which specific brand matters dramatically less than whether everyone actually uses it.
The setup I give family members
The 20-minute version, done once:
- Install the manager on the phone and computer. Enable the browser extension.
- Change the email account’s password first — it’s the reset path for everything else.
- Then the bank, then the carrier, then everything with a payment method attached.
- As you log into other sites over the following weeks, the manager offers to save and to generate replacements. Let it. The migration completes itself at the pace of normal use — no marathon weekend needed.
- Print the emergency kit (master password + recovery codes). Paper, stored with important documents. Not a photo on the phone the password protects.
NOTEFor the master password itself: four random common words, written on paper, memorized over a week of daily use. Long beats clever; memorable beats both.
The honest caveats
A password manager is a single point of failure — one strong master password protecting everything. That trade is still worth it: the alternative isn’t perfect compartmentalization, it’s reuse. But it means the master password and its recovery path deserve real care, and it means enabling whatever second factor the manager itself offers.
And no, I don’t recommend remembering everything instead. I’ve met the people who do. They reuse three passwords and write the bank one on a sticky note, which is the same system with worse security and worse recall.
Bottom line
Until passkey coverage reaches the boring corners of the internet — the utility company, the tax office, the regional bank — a password manager remains the one security tool with the best effort-to-protection ratio available to normal people. Set it up once this weekend, let it catch everything you log into afterwards, and print the recovery sheet. That’s the whole playbook.
If this article helped you, please share it with others!
Some information may be outdated