Password manager free tiers: where the ceiling actually is

Password managers are the rare category where the free tier is genuinely worth using. That is because the alternative most people actually practise — reusing a handful of passwords — is so much worse that almost any manager clears the bar.

The useful question is not whether the free tier is good. It is which limit you will hit first, and whether that limit costs more than the paid plan.

The four limits that decide it

1. Device sync

This is the one that catches most people. Some free tiers store your vault locally and sync only on a paid plan. Others sync across unlimited devices. Others cap the number of devices.

If you use one phone and one laptop, a local-only vault is workable but awkward. If you use a phone, a work laptop and a personal laptop, a sync cap becomes a real problem immediately — you are choosing which device gets the good passwords.

2. Secure sharing

Sending a password by message is the thing you are trying to stop doing. A proper shared vault or send feature lets you hand over a credential without it living in a chat history forever.

Free tiers often exclude this. For one person, that is fine. For a household or a small team, it is usually the first feature you pay for.

3. Two-factor codes stored alongside the password

Some managers store your TOTP codes in the same vault as the passwords. That is convenient. It is also a real security trade-off: if the vault is compromised, the second factor is compromised with it.

Free tiers vary on whether they include this. The decision is not about cost — it is about whether you want your second factor in the same place as your first.

4. Emergency access

If something happens to you, can someone get in? Most free tiers do not offer a structured way to do this. Paid plans often do.

This matters differently depending on your situation. It is a real gap and it is invisible until it is urgent.

What a free tier is genuinely good for

• One person, a normal number of accounts. A few hundred credentials is not a storage problem.
• A browser extension that fills forms. This is where most of the daily value lives.
• Generating long random passwords. Free tiers do this as well as paid ones.
• A strong master password and a written recovery plan. This costs nothing and matters more than any paid feature.

Where free tiers actually fail

Failure in this category is rarely about hitting a limit. It is about never finishing the setup.

A password manager you have not migrated into is not protecting anything. The common pattern: install it, save two logins, keep using the old system for everything else, and stop opening the app within a month.

Before worrying about the paid tier, finish the migration. Import from the browser, change the passwords that actually matter, and turn on 2FA on the accounts that support it.

The honest comparison

A free tier with local-only storage and no sharing is still worth using. A paid tier adds convenience and sharing. Neither is the point.

The point is that your accounts stop sharing a single password. If the free tier gets you there, it has done its job, and upgrading is a preference rather than a necessity.

How we examined this

This piece is built from published plan features, the behaviour each free tier documents, and the security trade-offs that are consistent across the category. It is not based on a multi-week trial of each service.

What that analysis surfaces:

• Device sync, not storage, is the first wall. Credential counts never approach the storage caps anyone advertises.
• Sharing has no free workaround. Everything else in this category has a manual substitute; sharing does not.
• Storing TOTP alongside passwords is a trade-off, not a feature. Convenience and single-point compromise arrive together.

Before you upgrade, finish the migration. A manager you have not moved into is not protecting anything.

Caveats worth stating

Security claims in this category cannot be settled by reading a feature list. You can verify whether a feature exists and how it is documented; independently auditing a vendor’s encryption implementation is a different job, and you should not take a marketing page’s word for it.

Free tier limits change, often quietly. The specific mechanism matters more than any number quoted at signup.

And this is not a recommendation to avoid paid plans. If you share credentials with someone, or you want an emergency access path, paying is the reasonable answer. The point is to know which limit you are paying to remove.