Should I let my browser save my passwords?
What the browser's built-in manager does well, the three specific things it does not, and when moving to a dedicated manager is worth the afternoon.
- Difficulty
- beginner
- Time
- 15 min
- Read
- 3 min
Short answer
The browser's saved passwords are far better than reusing one password everywhere, so if that is the alternative, use it. A dedicated manager is better if you use more than one browser or operating system, want to store more than passwords, or need to share access with family.
The argument is often presented as safe versus unsafe. It is not: modern browser password managers are encrypted and competent. The real differences are portability, scope and what happens to the person who inherits the problem.
Step by step
- Recognise what the browser does well.It generates strong unique passwords, stores them encrypted, syncs them across your devices, warns about reused and breached ones, and fills them only on matching addresses.
- Understand the first limitation: it lives in one ecosystem.Passwords saved in one browser are awkward to use in another, and worse across a phone from one manufacturer and a computer from another. Households with mixed devices feel this constantly.
- Understand the second: it only stores passwords.A dedicated manager also holds recovery codes, passport and licence details, software licences, secure notes and card details, all in the same encrypted vault.
- Understand the third: sharing and inheritance.Dedicated managers offer family sharing and emergency access, so a partner can reach the accounts if something happens to you. Browser storage has no equivalent.
- Check the browser vault is protected properly.If you keep using it, make sure the computer account itself has a strong password, the device locks quickly, and the browser account has two-factor authentication. Anyone with an unlocked machine can read the list.
- Decide by how many places you sign in.One browser, one platform, and only websites — the browser is fine. Multiple browsers, phone and computer from different makers, apps as well as sites, or anything shared — a dedicated manager pays for itself quickly.
- Migrate gradually if you move.Every dedicated manager can import from the browsers. Import, then turn the browser's own offer to save off, then delete the browser's stored list so there are not two diverging copies.
- Keep the recovery route on paper either way.Whichever you use, the account that unlocks everything needs a written recovery method stored physically, not on the device it protects.
Tips
- Never use both at once for the same sites. Two managers offering to fill different passwords is the fastest way to lock yourself out.
- Passkeys are gradually replacing passwords and are supported by both browsers and dedicated managers. Choosing a manager that syncs passkeys avoids being tied to one platform.
- If you share a computer with anyone, a dedicated manager with its own lock is a meaningful improvement over browser storage.
Common mistakes
- Saving passwords in a browser on a shared or public computer — Anyone using that profile afterwards can view them. On any machine that is not yours, decline the offer and sign out fully when you finish.
- Migrating without deleting the old copies — Two stores drift apart. You change a password in one, and months later the other fills the old one and locks the account.
If it doesn't work
Passwords are on the laptop but not on the phone
Cause: Different browser or ecosystem on each device — Fix: Either use the same browser signed in on both, or move to a dedicated manager, which is the more durable answer.
Autofill has stopped offering a saved password
Cause: The site changed its address, or the saved entry is for a different domain — Fix: Open the saved entry and check the address stored against it, then re-save it while signing in.
The manager fills nothing on a familiar site
Cause: The address does not match — which may mean the site is a fake — Fix: Do not type the password manually. Check the address carefully; the manager declining to fill is a genuine warning.
Questions people ask
Is it dangerous to keep all passwords in one place?
Less dangerous than the alternative. The realistic threat is one reused password appearing in a breach, not someone defeating a vault's encryption. A single strong master password plus two-factor is a far better position.
What if the password manager company is breached?
The vault is encrypted on your device before it is uploaded, so what they hold is unreadable without your master password. That is why the master password must be long and unique, and why they cannot reset it for you.