The problem with built-in password managers

In recent years, it’s gotten a lot easier to have better password hygiene without using a dedicated password manager.

Thanks to built-in password management tools on iOS and Android, and at the browser level on Chrome and Microsoft Edge, you can create secure passwords with minimal efforts. These tools are becoming increasingly sophisticated, such that a separate password manager might not be necessary.

But before you tie all your logins with the likes of Google, Apple, and Microsoft, take some time to consider the trade-offs. In exchange for the convenience of their built-in solutions, you’ll lose both the freedom and features that a proper password manager provides.

Built-in options are improving

Relying solely on your web browser for password management used to be a laughable concept.

Sure, the auto-fill features in Chrome, Firefox, and other browsers made logging into websites easier, but they didn’t help you log into apps on your phone. They also didn’t include some features that were table stakes in dedicated password managers, such as the ability to generate secure passwords when signing up for new services.

As a result, they didn’t deliver the main benefit of using a dedicated password manager such as Dashlane or Bitwarden, which is to keep you from using the same weak passwords everywhere.

But a lot’s changed since then:

• In 2020, Google added auto-fill support in Chrome for iOS, so if the browser is installed on your phone and synced to your Google account, it can fill out passwords in other apps. (A similar feature launched on Android a few years earlier.)
• Microsoft followed suit a year later, so that Edge’s mobile apps (or the separate Microsoft Authenticator app) can fill out passwords for other apps on your phone.
• Mozilla also added auto-fill support in the Firefox mobile app in 2021 after discontinuing its dedicated Lockwise password manager app.
• Apple, meanwhile, launched a Chrome extension for iCloud Passwords in 2021, so logins you save to iCloud on an iPhone, iPad, or Mac are easily accessible on Windows PCs.

These built-in password managers have also gotten better on the security front. They all have the ability to generate strong passwords on your behalf, and they can alert you to any passwords that are weak, redundant, or stolen. Apple even added two-factor authentication code support to iCloud in 2021, so you don’t need a separate app to help lock down your accounts.

All of which adds up to a compelling case for whatever password manager is built into your favorite web browser. Compared to dedicated password managers, the setup process is minimal, and they’ll likely never cost you anything, so I suspect that lot of people will use those default password tools without even thinking about it.

So what’s the problem?

The main reason I don’t rely on any of these password managers is largely about flexibility. I have a borderline obsession with not being permanently tied any particular device or computing platform, and these built-in password managers can ultimately be another mechanism for lock-in.

Since I’m using Bitwarden as my password manager, bringing my passwords to a new device or web browser only requires installing the Bitwarden app or browser extension, then logging in, and my passwords automatically sync no matter where I am. With built-in password managers, switching can be more of a hassle:

• Microsoft, to its credit, offers a Chrome extension for accessing your passwords outside of Edge, but it doesn’t offer add-ons for Firefox or MacOS Safari. If you want to use those browsers, you’ll need to import your password list from Edge.
• Chrome has no way to sync your passwords in other browsers, so whenever you switch, you’ll have to import your Chrome password list.
• With iCloud Passwords, you can’t access your passwords on Android or sync passwords in Windows browsers other than Chrome and Edge. And unless you have a Mac, you can’t export your passwords to a different service at all.
• Some alternative browsers, such as Vivaldi, Brave, and Opera, don’t offer auto-fill features for mobile apps. If you rely on their built-in password managers, you won’t have an easy way to log into apps on your phone.

Lock-in isn’t the only reason to consider a dedicated password manager. The major browsers still don’t offer group sharing options so that family members can easily log into shared services. Some password managers can also auto-fill passwords in desktop apps—Chrome, Edge, and Firefox can’t do this—and they have their own standalone mobile apps that make it easy to view your credentials from anywhere. Bitwarden even lets you plug in masked email addresses from a wide range of providers, while 1Password integrates with Privacy.com for limited-use credit cards.

But for me, the option to seamlessly switch between browsers or devices is by far the biggest factor. Being able to try new tools—or abandon ones that no longer work well—is important to me, and I never want something as mundane as passwords to get in the way. PCWorld’s guide to the best password managers can help you find the best option to fit your specific needs.

Get more practical tech advice every week with Jared’s Advisorator newsletter, where a version of this column first appeared.