I like this password manager's simplicity, but not its buried flaws

The satan is within the particulars, and particularly so for password managers. Services value their salt must nail the foremost fundamentals. Good safety and a pleasant interface are non-negotiable minimums. And on this entrance, RoboForm ticks these containers.

How an organization delivers its expertise separates the sector, although. Feature lists add only a portion of weight to the scales; execution serves as counterbalance. And value is yet one more issue within the combine.

RoboForm stakes its place on the lighter finish of the size—fewer options with equally decrease value. And its excessive polish initially makes it a great match for anybody in search of a easy, seamless expertise. But when you poke at it, flaws seem, together with people who quietly undermine RoboForm’s safety.

Read on to study extra, then see our roundup of the best password managers for comparability.

RoboForm in short

• Cost: $30 per 12 months (annual charge)
• Family plan accessible? Yes ($48 per 12 months, annual charge)
• Browsers: Chrome, Firefox, Edge
• Apps: Windows, Mac, Android, iOS
• Passwordless login: Yes
• Passkeys supported: Yes
• 2FA TOTP supported: Yes
• Account restoration attainable? Yes

What are RoboForm’s plans and options?

RoboForm presents Free, Premium, or Family plans, with heavy restrictions on its free tier.

The Free plan is healthier regarded as an ongoing restricted trial for RoboForm—although whenever you first join, you’ll get an precise 30-day trial of Premium. Making the downgrade after that first month all of the extra painful due to that preliminary style of the full-fat expertise.

To its credit score, RoboForm permits limitless saving of passwords and passkeys on the free plan, an rising rarity amongst password managers. It additionally checks knowledge leaks to your passwords and helps extra superior types of two-factor authentication for login, together with {hardware} keys (e.g., YubiKey). But you’re restricted to only one gadget to be used, with no internet entry.

Subscribing to the Premium tier opens up RoboForm’s full function set, together with its single standout function. Its “local-only” mode is a rarity amongst password providers nowadays, as most rivals have moved away from supporting offline apps. Your vault and your backups get saved solely to your gadget.

The remaining Premium options are extra ordinary. You can entry your knowledge from a limiteless variety of gadgets (and the net), generate one-time (TOTP) codes for two-factor authentication on different providers, arrange emergency entry for others to your account, and securely share gadgets. RoboForm may even monitor knowledge breaches for as much as 5 e mail addresses. Email help across the clock (24/7) turns into accessible, too.

RoboForm platform help

RoboForm helps a number of platforms. In addition to browser extensions for Chrome, Firefox, and Edge, you may also obtain and set up apps for Windows, Mac, iOS, and Android. 

Your first publicity might be by way of the browser extension when you join on the web site—the join kind pushes you to obtain it. To join through Windows app, you’ll must obtain and set up it first. You should obtain an app for offline entry.

How does RoboForm carry out?

For this evaluation, I used RoboForm’s desktop app for Windows 11, browser extensions for Chrome and Firefox in Windows 11, and the Android app. I additionally seemed briefly on the iOS app.

RoboForm sign-up

RoboForm’s sign-up course of is fluid and quick—so long as you observe the standard movement. Most individuals will create an account through the use of the web site, which factors you to the browser extension. Install that and fill out the shape, and also you’re off to the races virtually immediately. You can generate a passkey throughout account creation, too. Combined with RoboForm mechanically enabling two-factor authentication to your account (through e mail), new customers begin with a powerful stage of safety and comfort out the gate. The solely lacking piece? Passwordless-only login isn’t an choice.

PCWorld

For superior customers, the sign-up course of feels extra convoluted. Download the Windows app as your place to begin, and RoboForm will first push you to the browser extension for account creation or register. (On my check PC, which has a number of browsers put in, I had totally different home windows popping into focus to auto-load tabs.) You even have to attend to allow safer types of two-factor authentication—to activate an authenticator app, passkey, or SMS, it’s a must to dig into the settings. Most disappointing, you may’t begin out the gate with local-only entry.

The overwhelming majority of RoboForm customers will choose the simplicity of the conventional sign-up course of. But for anybody hoping to dive straight into RoboForm’s most unusual function, the local-only knowledge expertise isn’t seamless.

Is it straightforward to import passwords into RoboForm?

RoboForm means that you can import passwords out of your browser or one other service, with good accuracy—and immediate flagging of widespread weak passwords. For my pattern set of imported passwords (about two dozen), saved to CSV, the info got here by way of intact. RoboForm additionally instantly marked entries with bad passwords like “password” and “123456” with crimson warning symbols.

For direct importing, RoboForm can pull from FinalPass, Bitwarden, Dashlane, 1Password, Keeper, NordPass, True Key, Enpass, Kaspersky, Proton Pass, and Myki. For all different providers and apps, you may export to CSV after which import that file into RoboForm.

How straightforward is RoboForm’s interface to make use of?

Within the browser extension and cellular app, the structure of entries and settings feels intuitive. The look on Android might really feel a bit plain, nonetheless.

PCWorld

In the browser extension, classes to your saved knowledge and often-used options like a password generator and sharing choices stay in a left sidebar. The important window reveals your saved entries for passwords and different gadgets. You can entry different settings in a drop-down menu by clicking in your account data within the upper-right of the display screen.

The cellular apps take an analogous method, however with a prime navigation bar below a search bar, and the entries inside the primary portion of the display screen. Settings stay inside a three-dot menu on the prime of the display screen. Everything feels simple.

For each of those interfaces, capturing and filling in passwords for login pages and apps works properly. Clicking on an entry will provoke all the login course of for a lot of websites—no additional enter wanted from you. It feels very easy.

PCWorld

Power customers will once more run into minor complications, nonetheless. For starters, RoboForm gained’t permit the creation of handbook entries for passwords with out full knowledge. You should enter knowledge into every discipline to save lots of. For customers who need to retailer a password with out tying it to an internet site or consumer ID (with out having to fill in further nonsense or placeholder textual content), the choice doesn’t exist.

The Windows app additionally feels extra convoluted to make use of. RoboForm acknowledges that the consumer interface is extra dated, which is okay—the structure continues to be clear. But the required tie-in with the browser extension feels cumbersome. Its one-click login gained’t work except the browser extension is put in, for instance. You can also’t change any choices for the Windows app.

And for local-only storage of your knowledge, you’ll must first change your sync settings earlier than including any knowledge to your vault, when you actually need to hold all the pieces offline from the beginning. Making the change isn’t intuitive both. You must uncheck the setting for computerized sync, which then opens a dialog field stating that you would be able to manually synchronize with RoboForm’s servers. I disliked this method; it may very well be a lot clearer. I would like a sync choice for “Local storage only” and a message field that explains the place the info is saved and the way backups work. Such data could be extra useful to each much less skilled and superior customers.

How properly does RoboForm handle passwords and passkeys?

During each day use, RoboForm matches its greatest rivals in conduct. It easily fills in saved passwords and passkeys on acknowledged websites. For logins not but saved, it asks to seize the main points after you fill them in. You also can select between two ranges of autofill (computerized or prompt), or disable all of it collectively. Creating logins feels barely extra handbook however nonetheless is a easy course of.

By default, RoboForm generates passwords of 22 characters lengthy, with a most of 512 characters. That most size is certainly among the many highest accessible for creation, although at this time limit, only a wee little bit of overkill. (Many websites that don’t provide two-factor authentication—one of many important causes to make use of a really lengthy password—have far shorter password size limitations.)

PCWorld

For group, RoboForm presents folders so that you can type your entries into. Doing so from the browser extension and internet interface requires first choosing All from the left navbar, then clicking on the plus image. In distinction to different options, the Windows app is probably the most simple for locating the choice to make new folders. (The icon is seen always.)

How straightforward is it to share passwords in RoboForm?

You can share particular person gadgets and entire folders with different RoboForm customers. Accessing the Sharing Center hub will present the gadgets you’ve shared (when you’re a paid subscriber), in addition to these which were shared with you (all customers).

If you share an entry or folder with one other consumer who hasn’t but signed up for RoboForm, you’ll be notified that they are going to be required to create an account. Accepting these phrases will ship an invitation to the e-mail you’ve entered. Users signing up for RoboForm to see your shared entries should confirm their e mail addresses earlier than they’ll see the gadgets. But confusingly, they will settle for the pending shares earlier than verification.

PCWorld

(Tip: If the individual you’ve shared with can’t see any of these entries, and may’t recall in the event that they carried out e mail verification but, have them create a login after which attempt to share it with you to set off the verification course of.)

When sharing folders, you’ve gotten the choice of three permission ranges: Log In Only, Read and Write, and Full Control. Choosing Read and Write permits others to edit the entries, whereas Full Control lets the opposite customers management permissions and sharing.

What else does RoboForm let me do?

Through Emergency Access, you may designate different RoboForm customers allowed to entry your saved credentials, notes, and identities. This function permits buddies, household, and/or different trusted people to make use of your accounts when you’re incapacitated, deceased, or in any other case unavailable.

If your emergency contact accepts the invitation, they will import your saved knowledge to their account after making a request. Anyone with speedy entry will immediately achieve entry. For different ready durations (starting from 12 hours to 30 days), you’ll obtain a notification permitting you to grant, deny, or wait on deciding your permission. If you don’t take motion, your contact will mechanically achieve entry to your vault.

You can change the size of the ready interval or revoke entry at any time. The latter choice retains the hyperlink between your account and theirs, however they’ll must request entry to your knowledge. You also can take away the emergency contact all collectively.

When I examined this function, permissions modified immediately. Request notifications had been inconsistent in timing for after they appeared, although largely immediate.

PCWorld

How is RoboForm’s safety and privateness?

RoboForm encrypts knowledge utilizing AES256 bit encryption with PBKDF2 SHA256, with a default of 100,000 iterations. This default makes RoboForm much less safe than well-liked rivals like Bitwarden and 1Password, which use 600,000 and 650,000 iterations (respectively)—a quantity primarily based on the Open Worldwide Application Security Project’s present suggestions. 

Even FinalPass now units its default to 600,000—a transfer it will definitely took after being lambasted for its low iterations. (This lapse in rising iterations on all accounts is probably going a powerful contributing issue to hackers efficiently breaking into consumer accounts after stealing FinalPass vault knowledge.)

A better variety of iterations will increase the problem for a hacker to crack the safety in your saved, encrypted passwords, ought to that knowledge ever get leaked or stolen. You ought to manually enhance this quantity increased, ideally to at the very least 600,000.

If for some motive you personal a tool so previous that it may’t decrypt your knowledge in a well timed trend, you may scale back the variety of iterations again down, however even a semi-modern PC or cellphone ought to have the ability to deal with this present commonplace.

PCWorld

Another oversight is the shortcoming to set an computerized interval for clearing your PC’s clipboard when you copy a password through the Windows app, a browser extension, or the net interface. Only the cellular apps allow you to select to clear the clipboard. (You can’t set the size of time, nonetheless.)

RoboForm shines a lot brighter relating to checking passwords for any apparent weak or compromised passwords. It immediately flagged the egregious examples I added to entries in my vault (e.g., password). The Data Breach Monitoring wasn’t as proficient in its screening—it flagged only some breaches for an e mail account that’s been a part of many extra leaks.

While barely disappointing, I by no means belief these two sorts of options utterly—the variety of knowledge leaks and breaches usually exceeds the power for a single service to precisely catch each susceptible password or service, a lot much less shortly. But RoboForm is a good addition to an total community of various providers and strategies that hold you apprised about compromised data.

Is RoboForm value it?

For individuals who need to by no means take into consideration on-line safety, RoboForm can present an especially seamless expertise. Its interface has considerate polish, clearly designed to take the burden off individuals who discover password administration cumbersome.

But you may’t utterly shut off your mind and lean on RoboForm. I dislike that each one customers ought to instantly modify their encryption iteration settings upon account creation—somebody who hates excited about password safety gained’t know to verify this setting, a lot much less make the change reflexively. I’ve an analogous opinion concerning the lack of clipboard clearing when you ever copy a password inside Windows—individuals in search of a easy expertise gained’t suppose to manually clear their clipboards.

Meanwhile, superior customers ought to look elsewhere for a greater expertise. The interface on PC can change into virtually complicated when you use the desktop app, given the bouncing between this system and the browser extension. The local-only expertise feels equally clumsy, too.

For its worth, RoboForm may very well be the appropriate match when you like its straightforward interface and may accommodate its weaknesses. However, you could possibly additionally pay about the identical for a rival that has plans with richer options, much less hidden clunkiness, and stronger safety out the gate.