Your browser offers to save every password you type. It is free and built in, so why use anything else? The honest answer: for some people the browser is fine, and for others it leaves real gaps.
Where the browser is good enough
- You use one browser on all your devices, signed in to the same account.
- You mostly store website logins, not API keys, recovery codes or notes.
- You don't share devices and you lock your computer.
Modern browsers encrypt saved passwords and sync them with your account. Some offer on-device encryption of the sync data as an option, which is worth turning on.
Where it falls short
- More than logins. API keys, database passwords, Wi-Fi keys, licence codes, 2FA backup codes and private notes have no good home in a browser.
- Several browsers. Chrome at work, Firefox at home, Safari on the phone: each keeps its own list.
- Who can read it. Unless you turn on extra encryption, your browser's sync provider can usually decrypt your saved passwords, because it holds the key.
- Anyone at your unlocked computer. Browsers can show saved passwords to whoever is at the keyboard, sometimes after only the computer's own password.
- Moving away later. Exports are usually a plain CSV file, which you then have to protect yourself.
What a separate password manager adds
| Browser | Zero-knowledge password manager | |
|---|---|---|
| Website logins | Yes | Yes |
| API keys, notes, recovery codes | Awkward | Yes |
| Works across browsers and apps | No | Yes |
| Provider can't read your data | Optional, often off | Always |
| Own passphrase separate from your account | Rarely | Yes |
| Encrypted files | No | Often |
A sensible middle ground
You don't have to choose all or nothing. Many people keep low-stakes logins in the browser and put the important things in a vault: email, bank, domain registrar, cloud dashboards, API keys and 2FA backup codes. That is exactly what Potent Cipher's free plan is built for: 100 encrypted secrets, labels included, readable only on your devices.
The question to ask yourself
If your browser account were taken over tomorrow, what would the attacker get? If the answer includes the keys to your business, your servers or your email, those secrets deserve a vault with its own passphrase. Start one for free.