I only have one afternoon to set this up with my parent, and they need something that will not require regular troubleshooting. I listed 17 logins and expected the setup process to be the difficult part, but the recovery and emergency access options seem more confusing than the daily use.
Do others see the same tradeoff with password managers for nontechnical parents? I am also unclear whether “account recovery” means they can regain access without me, or whether that weakens the security.
Don’t pick based on the recovery feature list. Pick based on whether your parent can unlock it, save a new login, and find an existing password without calling you.
“Account recovery” is annoyingly vague. Sometimes it means the company can reset access, which does change the security model. Sometimes it means a trusted person can request emergency access after a waiting period. In other cases, recovery is impossible unless you saved a recovery code or still have an unlocked device. Read the exact mechanism rather than treating “recovery available” as a simple yes or no.
Bitwarden is a reasonable free password manager to test for daily use. For a normal personal vault, though, the provider cannot simply reveal or reset a forgotten master password. Emergency access is a separate trusted-contact arrangement. That can be useful, but it needs to be configured and tested before anyone gets locked out.
For this situation, I would make a small paper recovery kit. Include the account email, master password, two-factor recovery code, and brief instructions saying which app to open. Store it somewhere physically secure that your parent already understands, such as a home safe. That may sound less sophisticated, but it is often safer than creating a complicated recovery chain nobody remembers six months later.
Use the afternoon to install the browser extension and phone app, move the most important accounts first, and practice one fake failure: log out, then have your parent get back in without prompts from you. Seventeen imported logins mean very little if the master password or two-factor setup causes the real lockout.
Don’t leave the browser’s built-in password saving turned on alongside Bitwarden. Competing save and autofill prompts will confuse a nontechnical user faster than the recovery setup. Move five frequently used accounts first, disable the browser’s password manager, and confirm your parent can handle those before migrating the remaining twelve.
Test recovery before migrating anything. With Bitwarden, set a memorable master passphrase, store a paper copy and the two-factor recovery code somewhere secure, then sign out and have your parent get back in without coaching. @adminmaster is right about disabling competing autofill, but a forgotten master password is the failure that can lock them out of all 17 accounts at once.
A password manager that works smoothly on your parent’s current phone can become a very different experience when that phone is replaced. I’d plan for the device-change case now, because that is when people discover they do not know the master password, cannot find the recovery code, or no longer have access to the email account needed for verification.
Bitwarden is reasonable, but I would keep the setup deliberately boring. Use a passphrase your parent can type, enable biometric access for everyday use, and make sure they understand that Face ID or a fingerprint does not replace the master password. They will still need that passphrase after some restarts, app changes, or when signing in on a new device. The paper kit suggested by @adminmaster should include the exact sign-in email too. People often have several addresses and guess the wrong one under pressure.
I would spend less time migrating all 17 logins and more time checking the surrounding accounts. Can your parent access the email tied to the vault without relying on a password stored only inside that same vault? If two-factor authentication uses their phone, what happens if the phone is lost? Avoid creating a loop where every recovery method depends on another thing they cannot open.
Before you leave, write a short replacement-phone checklist in plain language: install the app, enter this email, get the master passphrase from the secure location, then restore two-factor access if requested. You may never need it, but it is much easier to prepare while everything is working than during a rushed visit to a phone store.
A standalone password manager gives your parent a second system to understand before it solves the first one. If they live entirely on Apple devices, or entirely on Android and Chrome, the built-in manager may mean fewer prompts, fewer extensions, and fewer places to look. Those options already sync within their respective accounts and handle autofill.
Bitwarden makes more sense when they regularly cross between different browsers and device platforms, or when you specifically want the vault separate from their Apple or Google account. The tradeoff is more setup and another interface they must recognize.
I would compare the actual daily workflow rather than feature lists. Put two unimportant logins in each candidate, then ask your parent to sign in and save a changed password without help. Whichever system produces less hesitation is probably the better choice, even if it looks less impressive on paper.
The two-factor setup is more likely to lock your parent out than any forgotten master password, and half the thread is quietly walking past that.
Here’s the blunt version. @greenwolf9454 and @egor_bash are right that recovery is the real risk, but the recovery code they keep mentioning only matters because someone turned on two-factor in the first place. For a nontechnical parent with one shared afternoon of setup, I’d seriously ask whether you even need it. A long random-word master passphrase plus biometric unlock on the phone is already a big step up from reused passwords in the browser. Add an authenticator app on top and you now have a second thing that can break, a second recovery code to lose, and a whole new failure mode when the phone gets replaced. If you do keep it, use something that lets you print or copy the recovery code during setup and actually test it, don’t just trust that it’s ‘on.’
On the paper kit idea from @adminmaster, it’s fine, but be honest about what you’re doing. Writing the master password on paper means the vault is only as secure as that piece of paper. For most parents that’s a completely acceptable trade, home burglars aren’t usually after your dad’s utility login. Just don’t do the half version where you write the email and the recovery code but leave the master password ‘somewhere they’ll remember.’ They won’t.
The part nobody’s said out loud: the biggest hidden dependency is you. Every plan here assumes you’re reachable when something goes sideways. Think about the case where you’re not, either you’re traveling, unreachable, or gone. If the only person who understands the setup is the person who did the setup, the parent is stuck. So whatever you build, write it down in plain steps and put it where a sibling or spouse could follow it cold.
I wouldn’t drop the tool everyone’s naming, it’s a sensible pick and works fine across their phone and computer. I’d just keep the moving parts to the absolute minimum. Fewer switches to flip means fewer things that fail six months from now when neither of you remembers how it was set up.
And @ghostbadger50 has a point worth weighing seriously. If your parent lives entirely on an iPhone or entirely on Android, the built-in manager is one less app, one less login, one less interface to learn. A separate vault only earns its keep if they cross platforms or you specifically want it out of their Apple or Google account. Match it to how they actually use their devices, not to which option sounds more thorough.
Rename the 17 entries in plain English before you hand it over. Imports often leave people with duplicates, old usernames, and labels that are just website domains. “Electric bill” and “Main email” are much easier for a parent to find than whatever name the importer guessed. Delete obsolete entries and mark the few daily accounts as favorites.
Then test the annoying cases, not only a normal sign-in: a site with two accounts, a password-change page, and a login where autofill does not appear automatically. Those are the moments when users start saving another password in the browser or resetting a password that was already correct.
For a parent who stays in one device ecosystem, I agree with @ghostbadger50 that the built-in manager may be the least troublesome choice. If they use a mix of devices, Bitwarden is sensible, but keep its vault organized and its prompts predictable. The best recovery plan will not matter much if they cannot tell which of three nearly identical entries is current.
Autofill will eventually fail on some site, and that is where a “simple” manager can suddenly become a support call. Whatever you choose, teach your parent the fallback: open the vault, search for the account, reveal or copy the password, then paste it manually. Bitwarden is fine if they can do that without guidance, but if its separate app and extension feel confusing, the built-in Apple or Google manager is probably the better fit. A boring tool they can recover from when automation breaks beats a more capable tool they only understand when everything works.