Three Reasons Why You Shouldn’t Use Your Browser’s Password Manager (and What to Use Instead)
Most modern browsers have a built-in password manager that allows you to save your login information and automatically fill it when you sign in to your accounts on various websites. While Google Password Manager in Chrome and similar tools in other browsers like Firefox, Brave, and Microsoft Edge certainly make it easier to store and use strong passwords, they have significant limitations in terms of security and functionality. That’s why you should use a dedicated password manager.
Browser password managers only work within the browser.
If you store your passwords in your browser, it can automatically fill in your credentials for websites directly from your browser. (If you’re using Android, Google Password Manager also syncs with your device and works in any browser or app.) But if you use multiple browsers or want to sign in to apps on your iPhone or PC, you’ll have to manually copy and paste your password from your browser into these form fields—not ideal from a convenience or security standpoint.
Browser password managers are more vulnerable to security threats.
Password management in the browser is secure at a basic level: Google uses the same AES encryption for transmission and storage as many dedicated password managers, and allows you to add biometric authentication to autofill login credentials. However, this isn’t zero-knowledge encryption by default: Google manages your encryption key unless you enable encryption on your device, so your vault can only be unlocked on your device by you using your Google password or biometric data. Firefox also uses AES-256 encryption and has a ” master password ” feature to protect your saved data; without it, anyone with access to your computer or browser profile can view your saved passwords. Adding these layers of security is up to the user, as they are disabled by default.
As Wired notes , the more serious issue isn’t encryption, but the risk inherent in storing passwords on a high-value account that could be the target of an attack—either by an attacker gaining access to your device or as part of a takeover attempt, such as a phishing or brute-force attack. This creates a single point of failure, and if someone gains access to your Google account or your browser, your passwords for everything else will also be compromised.
Password managers for browsers only have basic features.
Browser password managers essentially do one thing: store your login credentials and use them on websites when you visit them. Google Password Manager will also notify you if your password has been compromised in a data breach, but most browsers lack additional tools and features, such as password management, secure data sharing, email masking, emergency access, and storage of payment cards, identification data, and documents.
Use a dedicated third-party password manager instead.
The solution is to choose a dedicated password manager that works across multiple platforms and devices and provides an additional layer of security outside of your browser. There are many excellent password managers to choose from , including free services like Bitwarden and the privacy-focused Proton Pass (which also has a decent free plan). The best password managers also offer features like secure file storage, encrypted credential sharing, and data leak monitoring, making them useful tools in your privacy and security arsenal.
Of course, even a browser password manager is better than nothing if the alternative is reusing the same easy-to-remember credentials for all your accounts. (Your reused passwords likely don’t meet basic security standards and are easily guessed.) Storing passwords in Chrome, Firefox, and other browsers does make it easier to switch to strong, unique passwords for your accounts, and that’s a good step in itself. But a third-party password manager is a better choice if you’re willing to invest a little time and effort into setting it up.