Guide
Password manager first: why the order starts here
Disclosure: Kit & Key is an independent privacy-stack site. Some links on this page are affiliate links. If you buy through them, we may earn a commission. That does not change the price you pay. It does change which paid tools we can recommend with a straight face. Bitwarden is an unpaid control. We do not earn anything when we point you there. How we choose tools.
The order starts here because reused passwords are the real cafe and family failure mode. Not the splash page. Not a missing VPN on day one. The failure is typing the same client-portal password you use everywhere into a browser on a network you just joined. Or a teenager reusing the Amazon password on a game site. A password manager stops that. That is why every kit installs the manager first, antivirus second, and a VPN last. The freelancer stack inserts encrypted email before antivirus. The manager still comes first.
What a password manager does
It stores unique passwords. It fills them so you do not type them. It generates a new one when you change an account. You remember one unlock. Everything else stays unique, including the VPN you install later. That is the whole job. It is not antivirus. It is not a VPN. It does not make you anonymous. It will not save you from pasting a one-time code into a fake page. It will refuse to fill a password on the wrong domain, which is the help you actually get on cafe Wi-Fi.
Beginner comparison
This is not a ranked test. We did not crown a winner of speed runs or leak labs we did not run. Cafe default is 1Password. Proton Pass is the fork if you already want Proton. Bitwarden is the unpaid control. We do not earn a commission on Bitwarden.
| 1Password | Proton Pass | Bitwarden (unpaid) | |
|---|---|---|---|
| Price | Check current plan limits. | Check current plan limits. Pass Plus is not Mail Plus. | Free individual is real. Families was listed at $3.99 a month billed annually on Bitwarden’s pricing page (25 Aug 2026 research). Check current plan limits. |
| Sharing | Individual cannot share a live vault. A unique link is a copy of an item. Guests live on Families, Teams, or Business. Families is five people plus guests, unlimited devices, a Private vault and a Shared vault. Do not treat that as six people. Extra-seat price: check current plan limits. | Pass Plus can invite someone outside your plan to a shared vault. Family is not required for that one share. Proton Pass Family exists as a fork (Pass Plus for up to six users). | Premium does not share. Sharing needs an organization. Free org is two users and two collections. Families is six users. Bitwarden Send is a temporary link, not collection sharing. |
| Setup friction | Apps plus a browser extension. Travel-ready desktop workflow. Cafe default. | Fewer vendors if you already want Proton. Fine for a solo laptop and phone. | Plainer app. Strong free tier. You can self-host if that matters. |
| Recovery | Individual: recovery codes, if you generated them. No second organizer. Families: a family organizer can recover a member, not themselves. | Emergency Access is on paid Pass plans (Pass Plus, Pass Family, Unlimited). | Emergency access is on Premium and paid orgs. Account recovery (admin reset) is Enterprise, not Families. |
| Free tier | No lasting free plan in the docs we used. Check current plan limits. | Free exists. Proton’s docs describe up to two vaults and three people per vault on Free. | Bitwarden’s docs say the core manager is free: unlimited logins, any device, a generator. Sharing still needs an organization. |
According to 1Password, you need Families before you can share a vault with anyone. Guests (the official accountant example) are not an Individual feature.
Bitwarden’s docs say Premium does not include secure data sharing. A solo operator plus one bookkeeper is the Free organization, not Premium.
Proton Pass Family is a real SKU. Do not buy Pass Plus and expect Mail Plus. A Pass custom domain is alias forwarding, not a mailbox.
15-minute setup
Do this at home, on a network you already trust. Not the cafe.
- Pick one. Cafe and freelancer default is 1Password. Household default is 1Password Families. Already in Proton? Use Proton Pass (Pass Family if the house needs six Pass Plus seats). Want the unpaid control? Use Bitwarden.
- Create the account. For 1Password Individual, generate recovery codes and store them offline. For Families, make yourself the organizer. For Bitwarden, start a Free organization if a second person needs a live collection.
- Install the app on the laptop and the phone.
- Install the browser extension. Turn Autofill on.
- Save a unique password for email.
- Save a unique password for the VPN you will install next. Do not type a reused password into the VPN signup.
- Change the two or three reused logins you will actually open on cafe Wi-Fi: email if it is still reused, banking, one client tool. The rest can wait.
- If a household shares Wi-Fi, streaming, and school logins, put those in a Shared vault (1Password Families) or a shared vault / collection on Proton Pass Family or Bitwarden Families. Private stuff stays in a private vault.
- Stop. Antivirus is next. VPN is last. Freelancers add encrypted email before antivirus. Do not skip ahead to the tunnel.
Use this with a kit
This page does not replace a kit. It explains why the first tool is the first tool.
- Cafe Wi-Fi Privacy Kit for coffee-shop and hotel Wi-Fi. Print the public Wi-Fi checklist for cafe days.
- Family Privacy Kit for a household that shares logins and devices.
- Freelancer Privacy Stack for a solo operator with invoices.