Your browser offers to save the password. You click Save, because you are in a hurry and it works. That is how a lot of people end up with eighty logins sitting inside Chrome or Safari, protected mainly by the fact that you are already logged into your own computer. Dedicated password managers promise something better: one locked vault, strong encryption, and a single master password to remember. The honest answer to which is safer is not "the app." It depends on what you are defending against.

Where each one actually keeps your passwords

Browser storage is tied to your operating system account. On macOS, saved Safari logins live in Keychain. Chrome encrypts its local password database with a key protected by your Windows or macOS login. In practice, that means anyone who can unlock your computer and open your browser profile can often walk into Settings, click the eye icon, and read your passwords out loud. Some browsers now ask for a fingerprint or system password first; Firefox's optional primary password is switched off by default.

A dedicated manager works differently. The vault is encrypted on your device with a key derived from your master password, deliberately run through a slow key-derivation function so guessing is expensive. The company's servers store ciphertext. In a properly built manager, nobody at the vendor can read your entries, which is why these are called zero-knowledge designs.

The part both share

If malware is running on your machine, or someone is watching over your shoulder while you type, neither option saves you. Encryption protects data at rest and in transit, not a compromised endpoint. Be skeptical of anyone who claims otherwise.

Encryption is mostly a tie, and mostly not the point

Both sides use solid modern cryptography. Arguing about cipher choices is a distraction. What differs is key management: who holds the key, how it is derived, and what happens when the vendor's servers are breached or subpoenaed.

• Zero-knowledge manager: a server breach yields encrypted blobs. Attackers then have to crack your master password, which is why a long passphrase matters more than anything else.
• Browser sync: your vault travels with your Google, Apple, or Microsoft account. Its safety is now that account's safety, including its recovery paths. Someone who social-engineers their way into your account may reach the passwords too.

Breach risk: the attack paths that show up in real life

Most compromised accounts are not cracked. They are re-used, phished, or copied off an unlocked device. Here is how the two options fare.

• Unlocked laptop. Browser wins the attacker's heart: passwords are a few clicks away. A manager typically re-locks and asks for the master password or biometric again.
• Infostealer malware. Many families specifically hunt browser credential files. A manager's vault is a locked file, though a keylogger can still capture the master password you type. Hardware-key two-factor authentication on the vault helps here.
• Phishing. A manager that only fills on the exact matching domain means you never type the password into a lookalike site, and typing is the moment people get fooled.
• Hidden-field tricks. Browsers can be coaxed into autofilling saved credentials into invisible form fields that scripts then read. Good managers require a click or biometric before filling, which blunts this.
• Password re-use. The single biggest real-world risk. Managers make unique passwords effortless, which is most of their value.

Convenience: browsers win on friction, managers win on scale

Browser storage has zero setup. It syncs to your phone, fills forms, and works with the fingerprint reader you already use. For ten logins, that is genuinely hard to beat.

It falls apart as you grow. There is no secure sharing with a partner or coworker, no place for Wi-Fi codes and license keys, no cross-browser sync if you use two browsers, no breach alerts, no emergency access for a family member, and no useful way to audit eighty old accounts. Managers also handle odd cases better: multiple accounts on one site, one-time codes, and passkeys stored alongside the password.

Recovery and lockout: the difference nobody plans for

This is where the two philosophies split hardest. With a browser, password recovery means account recovery. Lose access to the Google account, and the vault may go with it. Your logins also sit behind your email address, which is the reset back door to nearly everything else.

With a manager, there is no "forgot master password" email. If you lose it, the data stays encrypted forever. That is the security feature and the disaster, depending on your planning. So do this before you need it:

1. Write your master passphrase on paper and store it somewhere physical and private, like a safe or a locked drawer.
2. Turn on two-factor authentication for the vault account and save the recovery codes offline.
3. Set up emergency access or a trusted contact if your manager offers it, and test that it works.
4. Keep an encrypted export on a USB drive, refresh it every few months, and practise restoring it once.

A setup most people should copy

Pick one manager and commit: Bitwarden, 1Password, Dashlane, and KeePassXC are all reasonable, and the right choice depends on which interface you will actually use daily. Judge candidates on zero-knowledge design, published security documentation, two-factor support for the vault itself, and whether you can export your data.

Then migrate properly. Export your logins from the browser as a CSV, import them into the manager, and delete that CSV file immediately, because it is plaintext and anyone who finds it has everything. Afterwards, turn off password saving in the browser, or restrict it to throwaway accounts you do not care about. Keep your email and banking logins only in the manager so you are never tempted to fall back.

Layer two-factor authentication and passkeys on top. The manager protects the password; the second factor protects the account when the password leaks anyway. If you are handling credentials for an employer, follow your IT or security team's policy before installing anything.

The verdict

For most people, a dedicated password manager is the safer choice, not because its cryptography is magic, but because it locks by default, matches sites precisely, and forces you to think about recovery while you still can. Browser storage is not reckless. It is fine for low-stakes accounts and it is far better than reusing one password everywhere, which remains the fastest way to lose everything at once. If you will not do the fifteen minutes of setup a manager requires, keep the browser vault but add a screen lock, a strong passphrase for your operating system account, and two-factor authentication everywhere it is offered. What you should not do is leave eighty passwords readable by anyone who borrows your laptop for a minute.

Photo: himanshu marathe / Pexels