Use passkeys where individual services offer them, then choose a credential manager around the devices your household uses and the access it needs to share. A built-in manager can suit a household centred on one compatible ecosystem; a third-party family plan is more useful when people need separate private accounts and selected shared logins across mixed devices. Consider a hardware security key for particular accounts only after checking service and device compatibility and arranging a backup way in.
Built-in management may suit people who mainly use compatible Apple devices or access their accounts through Android and Chrome with the same Google Account. Apple Support describes syncing passwords and passkeys across approved Apple devices; Google Help describes access on devices signed into the same Google Account. Check each household member’s devices before relying on either arrangement for shared access.
When people use different devices or browsers, a third-party manager with separate private accounts and selectively shared credentials may be easier to organise. The National Cyber Security Centre points to third-party managers for people with a complex mix of devices and browsers; 1Password Support and Bitwarden describe family sharing through vaults or collections.
Recovery arrangements matter when one person manages important household accounts. Apple Support documents a recovery-contact route for iCloud Keychain, while 1Password Support describes family-organiser recovery and Bitwarden describes emergency access. Check what authority each trusted person receives and keep a separate route into each important service.
Start with the accounts and devices everyone uses, then decide which logins should be shared and how access would continue if a device or account owner became unavailable. A hardware key is an additional decision for selected compatible accounts, not a substitute for planning how the household manages its other credentials.
| Concern | What to check | Who this matters to |
|---|---|---|
| Service and device compatibility | Check passkey availability for each important service and whether your chosen manager works with the devices and browsers used to sign in. | If my household switches between devices, I need to know that each important login will still work. Around 31% of consumers put compatibility and straightforward access first. |
| Controlled sharing | Look for separate private accounts and a way to share only selected household logins; check who can change a shared credential. | When several people need a joint login, I want them to access it without seeing my personal accounts. Roughly 25% of consumers make limited sharing their primary concern. |
| Recovery and continuity | Check recovery-contact or organiser options, the scope of emergency access and the backup methods accepted by each important service. | If the person managing our accounts loses a device or becomes unavailable, we need a planned way back in. About 25% of consumers prioritise recovery and continuity. |
| Physical authentication | Confirm FIDO2/WebAuthn security-key support, a compatible USB or NFC connection and an accepted backup authenticator. | For selected important accounts, I may want a physical authenticator I can keep separately from my everyday device. Around 19% of consumers put this need first. |
The National Cyber Security Centre recommends passkeys where available, but the individual service must offer them and the intended device and manager must be able to use them.
Check the security settings of your important accounts before changing managers or buying a hardware key. Keep the password and two-step verification arrangements you still need for services without passkeys.
Sharing a credential gives others access to that account. Apple Support also states that members of an Apple shared group can change shared passwords and passkeys.
Keep personal email and other private logins out of general household sharing. Give each person their own account where possible, and share only the specific household credentials they need.
Bitwarden says its takeover option replaces the previous primary password and removes existing two-step login methods. That is a different level of access from viewing stored credentials.
Choose the access level and trusted contact deliberately, review any waiting-period setting and agree in advance when the arrangement should be used.
If a migration creates a plaintext export, that file can expose multiple credentials at once. An import can also need checking: Google Help warns that some app and site names may move into an unexpected field.
Check the export and import formats, use an encrypted route where available, verify important entries in the destination and securely delete any temporary plaintext file.
Apple Passwords and iCloud Keychain are a built-in route for households using compatible Apple devices and Apple Accounts.
Google Password Manager is a built-in route for passwords and passkeys saved to a Google Account.
1Password Families is a third-party option for separate family members who also need selected shared vaults.
Bitwarden Families combines separate accounts with shared collections and an emergency-access option.
Yubico provides hardware security keys for accounts and devices that support the required FIDO2/WebAuthn sign-in route.
Use a passkey where the individual service offers one and your devices and credential manager support it; do not assume every account can move at once. For other services, the National Cyber Security Centre advises using strong, manager-generated passwords and two-step verification on important accounts where available.
It may meet the needs of a household using compatible Apple devices that only wants to share selected credentials. Apple Support says shared-group members can change those passwords and passkeys, so check who should have access; a household using mixed devices should also check whether that arrangement works for every member.
Confirm which passwords, passkeys and shared items the export and destination import can handle before moving anything. Protect any export file, then check important entries after import rather than assuming every field transferred correctly; Google Help warns that some imported app and site names can appear in an unexpected field.
Set up the recovery routes accepted by your important services and credential manager while you still have access, and register a backup authenticator where supported. Keep recovery codes separately from the everyday device and check the authority granted to an emergency contact: Bitwarden says takeover access can replace the primary password and remove existing two-step login methods.