Best password manager UK 2026: how many devices each free plan covers, and who holds the key to your vault

Before moving anything, it is worth knowing where the passwords you already have are sitting, because most people have them in more than one place without ever deciding to. Four routes cover almost everybody, and all four are worth opening once.

That last route is the clearest illustration of where a browser manager runs out: it fills in websites and nothing else. Everything that is a program rather than a page, from a mail client to a work tool, sits in a different drawer, and a standalone manager is the thing that puts both drawers in one place.

If all four routes come back nearly empty and you are reusing the same password in a dozen places, the comparison tool below starts from that case too.

The free plans from Bitwarden view › and Proton Pass view › are the ones that store passwords without a cap and work on the browser, the phone and the computer at the same time, according to what each company publishes on its pricing page. Other free plans do the same job with a condition attached, and that condition is written on their own pages: the NordPass view › table marks access from multiple devices as not included in the free tier, and LastPass states that its Free plan is "limited to 1 device type and basic password management features", meaning computers or phones, not both.

That is the only difference you need to understand in order to decide, which is why the table below opens with it. Everything else a free plan does, storing, generating and filling in, all of them do.

The National Cyber Security Centre, part of GCHQ, publishes its own guidance on this and it sits second in the search results for the whole subject, above every buying guide. It is worth reading before any of them, because it says two things that a list of products will not. First, that saving passwords in the browser is "safe for you to do this on your own devices", with the caveat that passwords kept in the browser "are only as secure as your devices and accounts". Second, that the reason to go to a separate manager is a practical one: it "can synchronise passwords even when you have a mix of different browsers and devices" (ncsc.gov.uk, page last updated 21 May 2026).

That is the same axis the tool above uses, and it is not a coincidence: the official advice and the honest commercial answer land in the same place. One phone, one browser, your own device: what you have is fine. A mix of browsers and devices: that is what a standalone manager is for.

None of this makes the built-in manager a bad choice, and it is worth saying plainly: it is free, it works on everything, it imports from other managers and it warns you about leaked passwords. For a lot of people it is enough, and switching on on-device encryption closes most of the remaining distance. What the comparison does is answer the question this search actually arrives with, which is whether what you already have will do.

The honest answer depends on one thing: whether it bothers you that the company holding your vault is able to open it. If it does not, stay where you are and skip the move. If it does, switching takes ten minutes, and the tool above says where to start.

Three of the managers on this page are run from three different places: Bitwarden from the United States, Proton from Switzerland, and NordPass by Nord Security. Since the UK left the EU, personal data leaving the country needs a legal route, and the one that covers the United States is the UK-US data bridge, which came into force on 12 October 2023 and requires the receiving company to be certified under the US framework to take UK personal data (gov.uk, explainer dated 21 September 2023).

Here is the part that matters, and it cuts against the instinct: with genuine zero-knowledge encryption, the jurisdiction question is far less dramatic than it sounds, because what crosses the border is a blob the company cannot open. Where it matters enormously is the other case, the one the previous section described, where the company does hold the key. The jurisdiction of a manager that cannot read your vault is a second-order question. The jurisdiction of one that can is the whole question.

That leaves the master password itself, which is the one thing you will have to keep in your head. The NCSC's advice here is specific and it goes against what most sites still ask for: combine three random words to make a password that is long enough and strong enough, rather than a short string stuffed with symbols. Its reasoning is that the complex version is not meaningfully stronger, that substituting a zero for an "o" is a trick criminals already know, and that the complex one is the one you end up writing on a sticky note (ncsc.gov.uk, three random words, version 2.0, reviewed 21 December 2021).

That is the division of labour the whole system is built on: one phrase you can keep in your head, and a few hundred strings you never have to see.

A security key is a piece of hardware about the size of a coin that plugs into the computer or is held against the phone, and it acts as the second factor: even with your master password in hand, nobody gets in without it. It is what comes after choosing a manager, and with Bitwarden view › there is nothing to pay to use one: its two-step login guide files FIDO2 WebAuthn credentials, meaning keys such as a YubiKey or a Google Titan, as available on every plan.

The only thing that decides which one to buy is the connector on your computer, and the two below are the same key with a different mouth. Both carry NFC, so either one also works by holding it against the phone. We would buy two and register both: one lost key with no spare is a far bigger problem than the cost of the second one.