How to Choose a Browser Password Manager

Why the browser matters

A browser extension sees the moment a login form appears. That lets it match the current site, offer the right account, generate a password, and fill credentials without sending them through the clipboard. Good autofill can also reduce phishing risk by declining to fill a credential on the wrong hostname.

The same position is sensitive. Password-manager extensions need meaningful page access to find and fill forms. A bug, malicious update, compromised browser profile, or hostile extension can threaten an unlocked vault. Review permissions, update history, source availability, and the vendor’s security evidence rather than treating “in the browser” as either automatically safe or automatically unsafe.

1. Inspect the encryption model

Find out where plaintext exists, where keys are derived, what the server stores, and which cryptographic parameters are current. “Zero knowledge” is a slogan unless the implementation explains what remains visible: account identifiers, device metadata, billing data, network logs, and item timing may still exist even when vault fields are encrypted.

Authier currently derives a client encryption key with PBKDF2 using SHA-512 and 600,000 iterations, then encrypts vault records with AES-256-GCM before synchronization. The master password is used on the client; the API stores encrypted payloads. The security page also states the limits and lack of a published independent audit.

2. Prefer evidence over adjectives

Look for recurring independent assessments, a vulnerability-disclosure policy, prompt security updates, transparent release history, and enough operational maturity to learn from real incidents. Open source makes review possible, but source availability does not mean qualified people have reviewed every path.

This criterion is where established products often lead smaller projects. Authier’s code, tests, issues, and history are public, but it does not claim to be battle-tested or independently audited. Our Authier versus Bitwarden comparison recommends the mature option for most primary-vault users today.

3. Test autofill on difficult pages

Simple forms are not enough. Try pages that split the username and password into separate steps, use one-time-password fields, render controls inside dynamic components, or present several accounts for one domain. Confirm that the manager fills only after a clear user action where appropriate and lets you remove incorrect form mappings.

Authier focuses heavily on browser autofill. It stores reusable, non-secret field-selector metadata for supported forms and can remove matching records. Its extension also detects many TOTP inputs and can read a visible TOTP QR code from the current page.

4. Match real platform support

List the devices you use now—not the ones a roadmap promises. Check the official stores for your browser and mobile platform, last update dates, and minimum versions. Native desktop or mobile applications, offline access, command-line tools, and system-wide mobile autofill may matter more than a polished extension.

Authier currently links official extensions for Chrome, Firefox, and Edge; the Firefox add-on is available for Firefox on Android. The old Authier site’s native-app roadmap and Kiwi Browser recommendation are historical and are not presented as current support.

5. Understand enrollment and recovery

Ask what happens when you add a device, lose every device, forget the master password, change it, or lose access to email. Convenient recovery can become a bypass; strict recovery can create permanent lockout. The right design makes the trade-off explicit and gives you enough warning to react to abuse.

Authier offers configurable new-device approval, a master-device role, revocable devices, and a recovery reset with confirmation and cooldown. Those controls are useful only when configured carefully and backed by a protected recovery email account.

6. Demand export before you need it

A vault should not become a trap. Verify the export formats, which item types they cover, and whether an import can be tested without overwriting the source vault. Remember that CSV and many JSON exports are plaintext: they are easy to move precisely because they no longer have the vault’s encryption boundary.

Authier exports credentials and TOTP records to CSV, imports credential CSV files and Authy-style JSON, and includes duplicate detection. Follow the vault migration guide before handling a real backup.

7. Compare the total product, not the monthly price

Free capacity, paid limits, family or team controls, support, recovery, audit history, and the cost of switching all matter. A cheaper tool can be expensive if it lacks a platform you need; a large suite can be wasteful if you only need credential and TOTP autofill.

Authier starts with 40 login credentials and 3 TOTP secrets. Monthly capacity packs add 250 credential records, 100 TOTP records, or both. Paid capacity does not change the core encryption or device-policy features.

A ten-minute evaluation

1. Read the security architecture and independent audit history.
2. Install only from an official extension store.
3. Create a test vault with low-impact accounts.
4. Try a normal login, a multi-step login, and a TOTP login.
5. Add and revoke a second device.
6. Inspect recovery, lock timeout, and TOTP sync settings.
7. Export the test data and verify you can read and protect the backup.
8. Remove the test data and confirm you understand account deletion.

NIST’s current authentication guidance says services should allow password managers and autofill because they make strong, unique passwords more practical. The important choice is not whether to use a manager blindly; it is which manager has a risk model, evidence base, and workflow you can live with.