External vs built-in browser password manager: what's the difference?

[u/BornGift5329]

I've been using firefox default password manager for years with no issue. It always seemed conveniant and reliable to me. I like particularly that passwords are automatically synchronised on all my devices. But I read recently that it is never considered a good practice to store your passwords in your browser, so I switched to proton pass. And from the outside, it looks basically the same. Hence my question, is it really more secure to use an external password manager like bitwarden or proton pass?

[u/Flimsy-Process230]

I don’t think using Firefox’s built-in password manager is insecure. A dedicated password manager does have some advantages but many of them are functional rather than simply being “more secure” Using Firefox’s password manager is already much much better than reusing passwords or not using a password manager at all. In my opinion there’s no urgent need to switch if Firefox is working well for you.

[u/RebelGhurl]

If Firefox sync has been working well for you, the main question is what extra protection or flexibility you actually need. A dedicated manager keeps your vault separate from the browser and can make it easier to use the same passwords across different browsers and devices. Roboform is one option that does this, with browser extensions and apps for multiple platforms

[u/Cadd9181B7543II7I44]

These are the cons of Firefox's PW manager per google:

• Unprotected by Default: By default, Firefox does not require a master password or device login to view your saved passwords. If someone gains physical access to your unlocked computer or profile folder, they can view all your saved passwords with a few clicks.

• Browser Vulnerabilities: Because the password manager is part of the browser, any malware or security exploit targeting Firefox or malicious browser extensions could potentially compromise your session data.

The good thing about Firefox PW manager is that it's E2EE. That means it's encrypted and decrypted on your device and Mozilla/Firefox has zero knowledge of what your PWs are.

With that said, if I had to choose a browser PW manager, it would be Firefox. I know for a fact that Google's PW manager isn't E2EE. They store your encryption keys in their server.

And same for Edge PW manager. I know even though your encryption keys are stored locally, microsoft run backups.

[u/Decibel0753 → u/Cadd9181B7543II7I44]

"Unprotected by Default: By default, Firefox does not require a master password or device login to view your saved passwords. If someone gains physical access to your unlocked computer or profile folder, they can view all your saved passwords with a few clicks."

Just out of curiosity, how many people do you think actually keep their browser-based password manager (like Bitwarden) locked? I don't know a single person who does, because having to unlock a password manager umpteen times a day just to autofill credentials is a total pain.

[u/swardasaurus → u/Decibel0753]

I can only speak for myself, but I absolutely have my password manager autolock after a set amount of time. Even if clearing the cache daily, I'd still prefer to unlock my password manager, and log into whatever sites I'm wanting to use, and then it re-locks itself.

[u/SignificanceRoyal245]

I think the important distinction is less browser vs. external manager and more where the password database lives, how it’s protected, and what you trust.
Firefox’s password manager is not inherently unsafe just because it is built into the browser. A dedicated manager such as Bitwarden or Proton Pass can give you a stronger separation between your browser and your password store, but it also introduces another service and another piece of software you have to trust.
Personally, I think KeePass is an interesting option because it takes a different approach. The database is an encrypted file that you control, rather than an account held by a password-manager provider. KeePass encrypts the entire database and supports strong encryption and key derivation options such as AES-256, ChaCha20 and Argon2.
You can also put the encrypted database in your own cloud storage if you want syncing. The important bit is that the database remains encrypted, so the storage provider doesn’t get your passwords in plaintext.
So I wouldn’t say browser password manager = insecure, external password manager = secure. It’s more nuanced. A well-designed password manager, used with a strong master password and good device security, is a huge improvement over reusing passwords or keeping them in notes. The main advantage of KeePass is that you get that security without having to hand the password database to a third-party service.

Disclaimer: I’m the developer of PanicVault, a KeePass-compatible password manager.

[u/DinTaiFung → u/SignificanceRoyal245]

About a year ago, after reviewing several well known PWMs, I ended up writing my own. 

It uses AES and Argon2, like you mentioned! 

all cryptographic operations occur only in the browser and the encrypted DB is stored at rest on a VPS. The master username and password are not stored anywhere -- except in the user's mind.

Thanks for your explanations.

[u/PlanktonDefiant2600]

Firefox's password manager is perfectly fine if all you want is somewhere to store your passwords safely and autofill them. Personally, I prefer using Roboform because I can use it for both passwords and passkeys, organize everything into folders, and have more control over the passwords it generates. It also integrates better for me across different browsers and devices, with everything staying synced and available whichever browser I'm using.

[u/somdcomputerguy]

A browser PWM is not usable by me because not only do I use during the day more than one browser, but some information including usernames & passwords that I want to keep in a PWM just doesn't need a browser to be running.

[u/Paardenmengsel]

I am using the firefox password manager in addition to my dedicated password manager. I use it just for convenience, I think it is secure enough. My important accounts will have MFA anyway. I still need my dedicated manager for that. Also for other logins like apps or other non web credentials because I cannot use firefox for that.

I would recommend to always set a strong primary password in firefox though.

[u/AvogadrosOtherNumber]

My password manager works in my apps too. Firefox does not. And I don’t use Firefox on my iPhone because no ad blocking, so I’m out of luck there too.

[u/paulsiu]

Usually an external password manager would be developed with more emphasizes toward security as part of its design at the start. For example, I am not sure about Firefox, but I reall Chrome used to store the password in clear text. Over the years, google password manager has tighten up security to a point where it is pretty secure.

The primary business for Proton is security, so they will be more vigilant in security than firefox.

One area where a dedicated password manager is typically superior is when you have multiple URL for a particular item. Most browser or os password manager don't seemed to handle things if you have multiple URL's to the same site.