Password · guides

Password manager: which one, and the second factor

By Alberto Gulotta · Updated · 7 min read

This is the entrance to the password manager tower. Eighteen guides are open — the ones people reach for when an account has locked them out or a six-digit code will not work. The wing about the managers is no longer a promise: six of those guides are in it, one manager each, and every one of them is put to the same four questions so that they can be read against one another.

Nearly everyone arrives from the same place. There are too many accounts, one password is doing most of the work, and something has happened — a warning in a browser, a message about a service that was breached, a friend whose account started sending things. The floors above split that into the parts you can actually act on: where the passwords live, what you add on top of them, and the questions people type when an account will not open.

Two rules will hold for every floor. Anything a manager claims about itself is quoted from its own documentation with the date we read it, because these products change what they include and an undated claim quietly stops being true. And nothing is ranked until we have paid for the accounts, used them across a phone and a computer for two weeks, and tried the part nobody tests — getting the data back out again.

Five more guides sit outside this tower and answer part of the same question, which is worth knowing before you climb: where an iPhone keeps the passwords it has saved, changing an email password on a phone without locking yourself out, changing a wifi password, and the second one on the same router, where a BitLocker recovery key is and who else has it, and what to do when a service you use is breached.

Where to start

Pick the one that sounds like your morning.

“I have to pick one and I do not know which.”
Start with the managers
“Something asked me for a six-digit code.”
That is the second factor
“One of my passwords was in a leak.”
That is Data breach

The managers

Four questions decide what living with a manager is actually like: where it keeps the vault, what happens on the day you cannot produce the key, how it behaves on a phone, and how hard it is to leave. Each floor puts the same four to a different manager and answers them out of that maker’s own documentation — including, where the documentation is silent, by saying that it is.

The Opera password managerTwo of the four questions answered, and two the maker’s own help does not touch.Open this guide → The Firefox password managerTwo locks, and one of them empties the drawer if you forget it.Open this guide → The Apple password managerTwo names, one drawer, and a ten-attempt limit written into firmware.Open this guide → When Google Password Manager will not answerThree documented causes, and the address to check first — plus the one case where that check needs a key of its own.Open this guide → The Edge password managerOne condition decides whether you have it at all, and it is which profile you signed in with.Open this guide → Is Bitwarden safeTwenty-five published audits with the auditors named, and the password nobody can reset.Open this guide →

The second factor

What you add on top of the password. These floors are ordered by how well each one actually holds up, which is not the order in which services offer them to you.

Two-factor and two-stepTwo steps from one category is not two factors, and the standard that never uses either name.Open this guide → When an authenticator stops workingThe clock that decides whether six digits are right, and the feature withdrawn rather than broken.Open this guide → Turning two-factor offWhere the switch still exists, where it has gone, and the two clean-ups afterwards.Open this guide →
Codes by text messageFar better than nothing, weaker than it looks, and the specific reason why.Being built

The questions

What people type at midnight, answered without a product attached. If you are not shopping for anything, this is the wing you want.

Forgotten Mac passwordThe three reset routes, and the keychain that does not come back with the account.Open this guide → Resetting a Gmail passwordNo limit on attempts, a seven-day wait on new recovery details, and no number to call.Open this guide → Changing a Facebook passwordA daily cap, and the phone number that two-factor takes out of play for a reset.Open this guide → Changing an Instagram passwordThe reset email that carries two links, only one of which changes the password.Open this guide → Changing a Microsoft passwordSix things share that name, and three of them are changed somewhere other than where you are looking.Open this guide → A ChatGPT passwordWhether there is one to reset at all, and why the email never arrives when there is not.Open this guide → Erasing a locked iPhoneThree routes in Apple’s order, and the one password none of them can skip.Open this guide → Sharing a wifi passwordThe prompt with six conditions, the code with none, and what each one asks of the guest.Open this guide → What a network security key isThe name Windows gives your Wi-Fi password, and the protocol that decides what it is worth.Open this guide →

Not covered here. It will not tell you the best password manager. That verdict needs paid accounts, two weeks of ordinary use on more than one device, and an honest account of what broke — including the export, which is the step that decides whether you are a customer or a hostage.

It will not carry affiliate links, on any floor, ever. This category pays well for recommendations, and a recommendation that is paid for is not a recommendation.

And it will not tell you that a manager makes you safe. It removes one enormous problem — the same password everywhere — and leaves the others standing. The floors will say which ones.

There is one thing worth knowing before you climb any of these stairs, because it will be the same on every floor and nobody puts it on a sales page. Whichever manager you choose, you are moving from a situation where losing one password costs you one account, to a situation where losing one password costs you all of them. That trade is overwhelmingly worth making — but it is a trade, and it has a condition attached. The master password has to be long, it has to be used nowhere else, and it has to exist somewhere outside your head: written on paper, in a drawer at home, in handwriting. The managers wing keeps coming back to that key under whatever name its maker gives it — a master password, a Primary Password, a screen lock, an account you have to be able to sign in to — because the thing that loses a vault is not an attacker. It is a memory. What holds instead is simple: no rankings until we have paid for the accounts ourselves and used them for two weeks, and no affiliate links ever.

Written by Alberto Gulotta

Founder and editor of AI Tools Primer, writing from Palermo, Italy. Thirty-five years of taking computers apart, starting with a Commodore 64 — the long version is on the about page.

Something wrong on this page? Write to aitoolsprimer@gmail.com and it gets fixed.

Written on 20 August 2026 · last checked 10 September 2026.

Independence and limits

No affiliate links and no paid placements anywhere on this site. Nobody pays to appear here, and no company has seen this page before you did.

This is general information, not professional advice. Where a page touches money, health, safety or the law, it names its source and the date it was read — and your situation may still differ. See the privacy page and the cookie policy.