Google Password Manager is already switched on for most people in New Zealand. It is built into Chrome and Android, it fills logins without being asked, and it costs nothing. The real question is not whether to use it but whether it is enough on its own.
What it does well
- It is already there. The manager most people actually use is the one that needs no setup, and that beats a better product nobody installs.
- Password Checkup flags passwords that have appeared in known breaches, been reused across sites, or are simply weak.
- Passkeys sync across Windows, macOS, Linux, Android and ChromeOS, protected by a PIN — which puts it ahead of several paid managers.
- On-device encryption can be turned on so that Google itself cannot read your saved passwords.
The on-device encryption catch
Turning on on-device encryption is a one-way decision: it cannot be switched off afterwards, and if you lose the key — your Google password plus your device screen locks — the saved passwords and passkeys are gone for good. That is the correct trade-off for privacy, but understand it before you flip the switch, and make sure your Google account recovery options are current first.
Where it falls short
| Limitation | Why it matters |
|---|---|
| Everything is tied to one Google account | Losing that account loses your logins as well as your email. It also makes Google’s own account security the ceiling on everything. |
| Weak outside Google’s ecosystem | Support in Safari and Firefox is limited compared with a dedicated manager’s extensions. |
| Passwords only | No secure notes, documents, recovery codes or card details in the way dedicated managers offer. |
| Sharing is limited | Dedicated managers offer proper shared vaults for a household or a business. |
| No emergency access | There is no built-in way for a partner or executor to reach your logins. |
Who should use what
Google Password Manager is enough if you live in Chrome and Android, you want something free, and your requirement is unique passwords plus breach warnings. That already puts you ahead of most people.
Move to a dedicated manager if you use Apple and Windows devices together, share logins with a partner or a team, want to store recovery codes and documents in the same vault, or want the vault separated from your email account. Bitwarden’s free plan covers unlimited logins on unlimited devices — our Bitwarden review covers it — and the password manager guide for New Zealand compares the paid options.
Moving your passwords out
Chrome exports saved passwords to a CSV file, and every major manager imports that file. Two rules: do the export on a device only you use, and delete the CSV immediately afterwards — it is a plain text list of every login you own. Once the import is verified, turn off Chrome’s offer to save passwords so you are not maintaining two sets.
Secure the Google account first
Whatever you decide, the Google account itself deserves your strongest protection, because it can reset most other things you own. Add a passkey or an authenticator app rather than relying on SMS codes — our authenticator app guide and passkey guide cover both — and run a breach check on the password protecting it.
Disclaimer
General information only. Features change with Chrome and Android updates; Google’s support pages document the current behaviour, particularly for on-device encryption, which cannot be reversed.
Reference sources
Frequently asked questions
Is Google Password Manager safe?
Yes, with the caveat that its security is bounded by your Google account’s security. Add a passkey or authenticator app to that account, and consider on-device encryption so Google cannot read the vault.
Is it good enough, or do I need a paid manager?
For Chrome and Android users who want unique passwords and breach alerts, it is enough. Move to a dedicated manager if you mix Apple and Windows devices, share logins, or want notes and documents in the vault.
What is on-device encryption and should I turn it on?
It encrypts your passwords so only your devices can read them. It cannot be turned off later, and losing the key loses the passwords, so update your account recovery options before enabling it.
Does Google Password Manager support passkeys?
Yes, and they sync across Windows, macOS, Linux, Android and ChromeOS with a PIN.
How do I export my passwords from Chrome?
Through the password settings, which produce a CSV file that other managers import. Do it on a private device and delete the file straight afterwards — it is unencrypted.
What happens to my passwords if I lose my Google account?
You lose access to them along with the account, which is the strongest argument for either a separate manager or very robust Google account recovery settings.
