Why Not Just Use Chrome's Built-In Password Manager?
Chrome's password manager is free and already there. What it does well, three places it doesn't reach, and who is actually fine without a standalone one.
Published September 9, 2026· By Juan Martinez
Chrome already saves your passwords, syncs them to your phone, fills them in on sign-in pages, and warns you when one shows up in a breach — for free, with nothing to install. Safari and Edge do the same. So the question is fair: why add a separate password manager on top of that?
The honest answer is that for some people you don’t need to. But the browser’s built-in manager makes trade-offs a standalone one doesn’t, and three of them are worth understanding before you decide the built-in tool is enough.
What the browser manager actually does well
Start with what’s genuinely good, because it’s not nothing.
Chrome generates a unique random password for each new account, which is the single most important thing any password manager does — it breaks password reuse, the habit that turns one site’s breach into a dozen compromised accounts. Its autofill matches on the saved site address rather than what a page looks like, so it won’t hand your bank password to a lookalike on another domain. Password Checkup compares your saved credentials against known breach data — and it does that comparison carefully, encrypting “your username and password with a secret key known only to your device” first, so “Google never learns your usernames or passwords during this process.”[3] Chrome can store and autofill passkeys too, and for some sites it can change a compromised password for you automatically.[1]
If that were the whole picture, there’d be little to add. It isn’t.
Gap 1: the encryption is tied to your browser account, not a separate secret
When you sign into Chrome and let it sync passwords to your Google Account, the default is that your passwords are “encrypted in transit and storage,” but “the encryption key, used to access your passwords, is safely stored in your Google Account.”[2] Google holds the key. It uses that key for features like Password Checkup and cross-device sync. In Google’s own framing, without the extra step below, “you trust Google to hold the key and keep your data secure.”[2]
That extra step exists: Chrome offers on-device encryption, where “only you have the key to unlock your data.”[2] It’s the right setting for anyone treating the browser manager as their real vault. But it’s opt-in, most people never turn it on, and it comes with a hard edge — “you’ll lose all your passwords if you lose all of your recovery options,” and once it’s set up “it can’t be removed.”[2]
Apple’s built-in manager is the exception here, and it’s worth saying plainly: iCloud Keychain is end-to-end encrypted by default, “so that Apple and other devices can’t read” your passwords, and stays protected even if “iCloud is compromised” or “a user’s Apple Account is compromised.”[6] If you’re entirely inside Apple’s ecosystem, that particular gap doesn’t apply to you.
Gap 2: on Windows, the local copy sits in a place malware knows well
Whatever the sync model, Chrome also keeps a working copy of your passwords on the device. On Windows that’s an SQLite database in your Chrome profile, with the encryption key held in a separate file protected by the Windows Data Protection API (DPAPI) and “readable by any process running under your user account.”[5] DPAPI protects that data from other users on the machine and from cold-boot attacks — but not from code running as you, which is exactly what information-stealing malware does once it’s on a system.[5]
Google knows this. In 2024 it added “app-bound encryption,” which ties encrypted data to the Chrome binary itself so another program can’t simply read it, calling DPAPI out directly for not protecting “against malicious applications able to execute code as the logged in user.”[4] The catch: that protection started with cookies, “followed by passwords and auth tokens” later — and as of early 2026 it still covers cookies only. Saved passwords are still behind plain DPAPI.[4]
A dedicated password manager keeps its local vault encrypted under your master password and locks it on a timer, so a stealer that copies the vault file gets an encrypted blob rather than a readable list.
Gap 3: it’s locked to one browser and one operating system
Chrome’s manager is built for people who live in Chrome. Open Firefox and it has its own separate password store; open Safari and that’s a third one. There’s no single vault across browsers — switching browsers, or using two, means your passwords are split or you’re leaning on passwords.google.com in a tab.[1]
The same wall runs along operating systems. Apple’s manager reaches Windows only through a companion “iCloud Passwords” app and a browser extension, and that Windows app is a cut-down version — no passkeys, no Wi-Fi passwords, no Sign in with Apple entries.[7] A standalone manager runs as the same app with the same full vault on Windows, macOS, Linux, Android, iOS, and as an extension in every major browser, so which device or browser you’re on stops being a factor.
The things it simply doesn’t have
Beyond those three gaps, a set of features just isn’t part of the browser-manager model:
- Sharing a login with a specific person — securely, not by messaging it — and taking it back later.
- Family or household plans with a shared section and per-person private vaults.
- Emergency access, where a person you designate can request your vault after a waiting period if something happens to you.
- Email aliases, generating a unique address per signup so a leak or spam trail can’t be tied back to your main inbox.
- An independent audit of the vault itself. Standalone managers commission and publish these — our Bitwarden review cites a 2025 Cure53 penetration test and source-code audit plus a separate cryptography review by ETH Zurich’s Applied Cryptography Group.[8] The browser makers don’t publish an equivalent audit of their password store as a standalone target.
For the wider case that a password manager is a privacy layer in its own right — what reuse and phishing actually cost, and where the tool stops — see Password Manager: Another Layer of Privacy.
When the built-in manager is genuinely fine
It’s a real option, not a trap, if all of the following are true:
- You use one browser, on one operating system’s ecosystem, and don’t expect that to change.
- You don’t need to share passwords with anyone, or manage a family’s logins.
- On Chrome, you’ve turned on on-device encryption and stored your recovery options somewhere safe.
- You treat it as better than reuse — which it firmly is — rather than as a full privacy tool.
That’s a meaningful number of people, and for them “just use Chrome’s” is a defensible answer.
Reach for a standalone manager when you want to
- One vault that’s the same across every browser and OS you touch.
- Zero-knowledge by default, with a master password separate from your Google or Apple account.
- A local vault that stays encrypted and locked even against something running as your user.
- Sharing, family plans, emergency access, or email aliases — features the browser model doesn’t include.
Picking one
This link earns us nothing — no tracking, just the review.
Best free option. Fully open source, a free tier with no meaningful limits, and self-hostable if you want to run your own server. Full write-up in our Bitwarden review.
This link earns us nothing — no tracking, just the review.
Built by a privacy-first team. Swiss jurisdiction, a non-profit ownership structure, and it encrypts more of your vault than most — every field plus the metadata, so Proton can’t even see which services you hold accounts with. Details in our Proton Pass review.
Summary
Chrome’s password manager does the one thing that matters most — a unique password per account — plus domain-checked autofill, breach alerts, and passkeys, for free. Where it doesn’t reach: its encryption is tied to your Google Account unless you opt into on-device encryption, its local store on Windows still sits behind DPAPI that malware routinely defeats, and it’s locked to one browser and one OS. It also has no secure sharing, family plans, emergency access, email aliases, or published audit of the vault itself. If you’re a single-browser, single-ecosystem user who doesn’t share passwords, the built-in tool is a reasonable choice. If any of that isn’t you, start with the password managers we’ve reviewed.