Password managers are one of the rare security tools where the paid and free tiers of good options are both genuinely solid — the real decision is about features and trust, not basic security.
What "zero-knowledge" actually means
A zero-knowledge password manager encrypts your data on your own device before it ever reaches the company's servers, using a key derived from your master password — which the company itself never receives or stores. In practice, this means that even if the provider's servers were breached, an attacker would only get encrypted data they can't read without your master password. This is the single most important security property to check for, more than any other marketed feature. Nearly every reputable password manager uses this model today; it's worth confirming rather than assuming, especially for lesser-known providers.
Your master password is the entire system
Because of zero-knowledge encryption, there's no "forgot password" recovery option that bypasses your master password — if you lose it and haven't saved a recovery key somewhere safe, your data is unrecoverable by design, not by poor customer service. This is a deliberate security tradeoff, not a flaw, but it means choosing a master password you'll actually remember (or storing a recovery kit somewhere safe) matters more than almost anything else in the setup process.
Where free plans genuinely fall short
Free tiers from reputable providers are cryptographically just as secure as paid tiers — the encryption isn't weaker. What's usually restricted is convenience: syncing across a limited number of devices, sharing passwords securely with family members, or advanced features like security breach monitoring. For a single person on one or two devices, a free plan is often genuinely sufficient; for a family or someone who needs secure sharing, a paid plan earns its cost through those features, not through "more security."
Two-factor authentication is not optional
Enable two-factor authentication (2FA) on the password manager account itself, ideally using an authenticator app rather than SMS text messages, which are more vulnerable to interception. The password manager is protecting access to every other account you own — it deserves the strongest login protection available, not just a strong master password alone.
The one thing people forget
Export or back up your vault periodically, even with a reputable provider. Company shutdowns, account lockouts, and sync issues do happen, and having your own encrypted backup means you're never fully dependent on one company staying in business or your account staying accessible.