A data dump that contains 2.7 billion records of personal information for people living in the US, including their Social Security Numbers, have recently been leaked online. The data dump's contents were linked to National Public Data, a company that scrapes information from non-public sources and sells it for background checks. Now, the company has confirmed that it did have "a data security incident" wherein people's names, emails, addresses, phone numbers, social security numbers and mailing addresses had been stolen. 

National Public Data's wording in its Security Incident report is a bit a vague and convoluted, but it did blame the security breach on a third-party bad actor. It said that the bad actor "was trying to hack into data in late December 2023" and that "potential leaks of certain data" took place in April 2024 and summer 2024, indicating that the hacker had successfully infiltrated its system. In April, a threat actor known as USDoD tried to sell 2.9 billion records of people living in the US, UK and Canada for $3.5 million. It claimed that it stole the information from National Public Data. Since then, the records have been leaked in chunks online with the more recent one being more comprehensive and containing more sensitive information. 

The company said it worked with law enforcement to review potentially affected records and will "try to notify" individuals "if there are further significant developments applicable" to them. It also said that it published the notice so that those who were potentially affected can take action. The company is advising people to monitor their financial accounts for fraudulent transactions, and it's also encouraging them to get free credit reports and to put a fraud alert on their file. 

The National Public Data is already facing a proposed class action lawsuit that was filed in early August by a plaintiff who received a notification from their identity theft protection service that their personal information was posted on the dark web. They argued that the company failed "to properly secure and safeguard the personally identifiable information that it collected and maintained as part of its regular business practices." 

When we’re logging into our online accounts, it's usually with a purpose. We want to get in as quickly as possible to scroll social media or check a bank statement without interruption. It’s easy to become impatient and let login security slip by using the same passwords for everything — think the usual suspects like streets you've lived on or your kids' or pets' names. But that’s a security nightmare: With just one leak, a malicious actor can access some of your most sensitive accounts. Password managers help mitigate this threat by giving you an easy way to store and develop unique, strong passwords for every account. Yet, these services are not all built the same. We tested out nine of the best password managers available now to help you choose the right one for your needs. 1Password remains our top pick for the best password manager, thanks to its zero-knowledge policy, numerous security features and general ease of use, but there are other solid programs out there to consider as well.

How do password managers work?

Think of password managers like virtual safe deposit boxes. They hold your valuables, in this case usually online credentials, in a section of the vault only accessible to you by security key or a master password. Most of these services have autofill features that make it convenient to log in to any site without needing to remember every password you have, and they keep your credit card information close for impulse purchases.

But given that passwords are one of the top ways to keep your online identity secure, the real value of password managers is staying safe online. “It's just not possible without a password manager to have unique, long and hard-to-guess passwords,” Florian Schaub, an associate professor of information and of electrical engineering and computer science at the University of Michigan, said.

Common guidance states that secure passwords should be unique, with the longest number of characters allowed and uppercase letters, lowercase letters, numbers and special characters. This is the exact opposite of using one password everywhere, with minor variations depending on a site’s requirements. Think of how many online accounts and sites you have credentials for — it’s an impossible task to remember it all without somewhere to store passwords safely (no, a sticky note on your desk won’t cut it). Password managers are more readily accessible and offer the benefit of filling in those long passwords for you.

Are password managers safe?

It seems counterintuitive to store all your sensitive information in one place. One hack could mean you lose it all to an attacker and struggle for months or even years to rebuild your online presence, not to mention you may have to cancel credit cards and other accounts. But most experts in the field agree that password managers are a generally secure and safe way to keep track of your personal data, and the benefits of strong, complex passwords outweigh the possible risks.

The mechanics of keeping those passwords safe differs slightly from provider to provider. Generally, you have a lengthy, complex “master password” that safeguards the rest of your information. In some cases, you might also get a “security key” to enter when you log in to new devices. This is a random string of letters, numbers and symbols that the company will send you at sign up. Only you know this key, and because it’s stored locally on your device or printed out on paper, it’s harder for hackers to find.

These multiple layers of security make it difficult for an attacker to get into your vault even if your password manager provider experiences a breach. But the company should also follow a few security basics. A “zero-knowledge” policy means that the company keeps none of your data on file, so in the event of an attack, there’s nothing for hackers to find. Regular health reports like pentests and security audits are essential for keeping companies up to par on best practices, and other efforts like bug bounty programs or hosting on an open source website encourage constant vigilance for security flaws. Most password managers now also offer some level of encryption falling under the Advanced Encryption Standard (AES). AES 256-bit is the strongest, because there are the most number of possible combinations, but AES 128-bit or 192-bit are still good.

Who are password managers for?

Given their universal benefit, pretty much everyone could use a password manager. They’re not just for the tech-savvy people or businesses anymore because so much sensitive information ends up online behind passwords, from our bank accounts to our Netflix watch history.

That’s the other perk of password managers: safe password sharing. Families, friends or roommates can use them to safely access joint accounts. Texting a password to someone isn’t secure, and you can help your family break the habit by starting to use one yourself, Lisa Plaggemier, executive director at National Cyber Security Alliance, said. Streaming is the obvious use case, but consider the shared bills, file storage and other sites you share access with the people around you as well.

Are password managers worth it?

You likely already use a password manager, even if you wouldn’t think to call it that. Most phones and web browsers include a log of saved credentials on the device, like the “passwords” keychain in the settings of an iPhone. That means you’ve probably seen the benefits of not having to memorize a large number of passwords or even type them out already.

While that’s a great way in, the downfall of these built-in options are that they tend to be device specific. If you rely on an Apple password manager, for example, that works if you’re totally in the Apple ecosystem — but you become limited once you get an Android tablet, Lujo Bauer, professor of electrical and computer engineering, and of computer science, at Carnegie Mellon University, said. If you use different devices for work and personal use and want a secure option for sharing passwords with others, or just don’t want to be tied to one brand forever, a third-party password manager is usually worth it.

How we tested

We tested password managers by downloading the apps for each of the nine contenders on iPhone, Android, Safari, Chrome and Firefox. That helped us better understand what platforms each manager was available on, and see how support differs across operating systems and browsers.

As we got set up with each, we took note of ease of use and how they iterated on the basic features of autofill and password generators. Nearly all password managers have these features, but some place limits on how much you can store while others give more control over creating easy-to-type yet complex passwords. From there, we looked at extra features like data-breach monitoring to understand which managers offered the most for your money.

Finally, we reviewed publicly available information about security specs for each. This includes LastPass, which more experts are shying away from recommending after the recent breach. For the sake of this review, we’ve decided not to recommend LastPass at this time as fallout from the breach still comes to light (The company disclosed a second incident earlier this year where an unauthorized attack accessed the company’s cloud storage, including sensitive data. Since then, hackers have stolen more than $4.4 million in cryptocurrency using private keys and other information stored in LastPass vaults.)

These are the password managers we tested:

• 1Password

• LastPass

• Bitwarden

• Dashlane

• Keeper

• NordPass

• Enpass

• Norton password manager

• LogMeOnce

Other password managers we tested

LastPass

For a while, security experts considered LastPass a solid choice for a password manager. It’s easy to use, has a slew of helpful extra features and its free version gives you a lot. But we decided not to include LastPass in our top picks because of the high profile data breaches it has experienced over the past couple of years.

Keeper

Keeper met a lot of the basic criteria we tested for, like autofill options and cross-platform availability. We liked its family plan options, too, that can keep your whole household secure. But we didn’t think its extra features, like the encrypted messaging app, added much value. Plus, it has a self-destruct feature after five incorrect login attempts which, despite adding extra protection, could be a recipe for disaster for casual users.

Enpass

Enpass works well as an affordable password manager. That includes an inflation-beating “lifetime” access pass instead of a monthly payment for users really committed to the service. Still, it was confusing to set up across devices and because Enpass stores data locally, as opposed to in the cloud, we struggled to get started with it on mobile.

Norton

A familiar name in security, we were excited to test out Norton’s password manager. While it’s free, its features seem underdeveloped. It lacked password sharing, account recovery and complex form-filing tools that come standard in many of the other password managers we tested.

LogMeOnce

LogMeOnce comes with a wide range of premium tiers, from professional to family, that include different levels of storage and features. But when we tested, it lacked some basic cross-platform availability that other password managers had already, like compatibility with Mac and Safari.

FAQs

Why use a password manager?

Using a password manager can enhance your online security. They store all of your complex passwords and autofill them as needed, so that you can have unique, strong passwords across the web without remembering each of them yourself. In many cases, unique passwords are your first defense against attack, and a reliable manager makes it easier to keep track of them all.

Are password managers 100 percent safe?

Password managers are a secure way to store your credentials. Experts in the field generally agree that the benefits of accessibility when storing complex passwords outweigh the possibility of attack, like what happened with LastPass. But with any service, it can vary from provider to provider. You should look out for zero-knowledge policies, regular security audits, pentests, bug bounty programs and encryption when choosing the right secure password manager for you.

What if I forget my master password?

Forgetting a master password won’t necessarily lock you out for good, but the recovery process varies from provider to provider. Some services give you a “security key” at sign up to enter when you log into new devices. It can also be used to securely recover your account because it’s a random string of keys stored locally that only you have access to. Other services, however, have no way to recover your vault. So creating a master password that you won’t forget is important.

How can I make a good master password?

A good master password should be unique, with the longest number of characters allowed and uppercase letters, lowercase letters, numbers and special characters. Experts often recommended thinking of it like a “passphrase” instead of a “password” to make it easier to remember. For example, you can take a sentence like “My name is Bob Smith” and change it to “Myn@m3isB0b5m!th” to turn it into a secure master password that you won’t forget.