As we live more and more of our financial and personal lives online, we accumulate an endless series of passwords to protect our sensitive data. These days a password manager utility has become a necessity, not a luxury. Large Software Password Manager 1.0 ($29.95, direct) is an enthusiastic effort with many of the features of more-expensive tools. However, sites with even faintly nonstandard log-in styles throw it off, and its help system needs a rewrite.

Password Manager doesn't attempt to fill in Web forms with generalized personal information the way Identity Safe (the password manager in Norton Internet Security 2009), RoboForm 6, and 1-Click SignupShield Suite 5 do. Instead it focuses on the central task of collecting username and password pairs for your sensitive sites and serving them up as needed, so you don't have to rack your brain remembering them. As with DigitalPersona Personal 4.0 and Eikon To Go Digital Privacy Manager (as well as the three products previously mentioned), your saved accounts become links; clicking on them opens your default browser, navigates you to the site, and logs you in.

Since your passwords no longer have to be memorizable, you may choose to replace each with a strong password, something like "#IO4p@Ga." Like RoboForm and 1-Click, Password Manager can generate random passwords of a specified length. You can set it to include uppercase letters, lowercase letters, digits, and punctuation. That's important, because some sites impose specific requirements on passwords. RoboForm and 1-Click can guarantee that at least one character from each set will appear, but Password Manager just picks at random from all selected sets. It can't guarantee that your random password will contain all of the chosen types, which is an annoyance, as it may require you to keep regenerating passwords when it comes to stricter sites. It's not a huge fault, but since it should be child's play to fix, it's irritating that Large Software hasn't done it.

Flexible Password Capture

Flexibility is a key trait of Password Manager. To start, it offers many different ways to record username/password credentials for a given site. If you simply log in normally, the program usually captures your credentials and offers to save them. You can enter your credentials and click the "Link-It" icon that Password Manager adds to your browser's title bar. This lets you create the account without immediately logging in. You can get a similar effect by dragging a crosshair icon from the program's tray icon onto the window containing your credentials. If you wish, you can type in all details of an account without even visiting the site. There's even an option to import existing passwords from RoboForm, KeePass, or Firefox—that's a unique feature!

For more complex log-in forms, there's an advanced option that lets you record other fields besides username and password. It's slightly cumbersome: Password Manager has to load the page inside a window of its own before it can capture additional fields. DigitalPersona and Eikon let you grab additional fields directly from the browser, while RoboForm and 1-Click handle most additional fields automatically.

By default, a saved log-in account is applied to any log-in page in the domain. That's handy, because some sites have multiple entry points. If this becomes a problem for a specific site, Password Manager lets you restrict that account to a specific subdomain or to an individual log-in page. There's that flexibility again!

When you revisit a site that has exactly one set of stored credentials, the program's default action is to fill in those credentials, the same as Identity Safe and 1-Click. You can also fill in saved credentials by clicking the Link-It icon or by dragging the crosshair cursor onto the Web page. Of course, it's easiest just to choose the account from the program's menu, reached either from the tray icon or the Link-It icon. The menu does add multiple columns if needed to hold all of your log-ins. I wish it allowed organization of log-ins into submenus, the way RoboForm does.—Next: More Flexibility

More Flexibility

DigitalPersona and Eikon require a registered fingerprint to unlock your password. Password Manager doesn't have any biometric protection, but users can designate a USB- or Bluetooth-connected device to unlock the password database. With the device present, Password Manager is unlocked and available; remove the device and it locks automatically. I wish they offered full two-factor authentication—device and password—but in this version it's an either/or proposition.

There's also an option to save a portable copy of the program and database on a USB key or other removable drive. Do be sure to run it on your home computer at least once before heading out the door, as you'll need to reenter the registration code to activate the portable version. Now you can carry your passwords along and use them on other computers.

By default, automatic password capture is turned off in the portable version. If you choose to turn it on or to record passwords manually, the portable database can get out of sync with the database on your desktop. There's no simple sync operation, but you can export from the portable edition and import into the desktop copy. The resulting text-only INI file contains all your passwords in plain text, so be sure to delete it when done. And absolutely do not import the wrong INI file. Surprisingly, there's no sanity-check to validate that the file actually contains password data, so importing the wrong file can corrupt your database.

Database corruption is, fortunately, not permanent. Password Manager makes a backup every time you add, remove, or change an account entry. A handy restore page displays a calendar marking days on which a backup was made, and it's easy to restore the database to any earlier version. You'll want to clear out the oldest backups from time to time. This, too, is easy.

Where most products manage passwords in Internet Explorer and Firefox, Password Manager can add its Link-It button to over 20 other browsers. These include familiar ones like Opera and Netscape as well as less-known browsers like Znap Browser, Crazy Browser, and Enigma Browser. Plug-ins for automated password fill-in are available for Firefox, Netscape, Mozilla, SeaMonkey, and Flock. By default the database is encrypted using AES, but if you favor a different algorithm, there are seven other choices.

Password Manager includes a few additional features dedicated to preventing password theft. Keylogger programs can't capture automatically filled-in passwords since you don't type them. Password Manager offers a virtual keyboard so you can also enter the master password without typing. The app can optionally watch for global Windows hooks and other techniques used by simple keyloggers. And if the credentials you enter get redirected to a different domain, Password Manager pops up a "possible phishing" warning. You still need a full-fledged anti-malware solution, but these features can't hurt.—Next: Not So Flexible After All

Not So Flexible After All

I have over 200 log-ins stored in RoboForm, so the first thing I tried after installing Password Manager was the option to import those passwords. RoboForm's database format is proprietary, so there's no way to just read it. Password Manager cleverly rips the text from the print preview window of RoboForm's print feature.

I was disappointed to find that the import process pulled in only 80 of the 200 sets of stored credentials. It did incorporate RoboForm's submenus as name prefixes—for example, the "Gmail" item in the "E-mail" submenu became "E-mail\Gmail." But it completely failed to capture more than half of the log-ins.

I started manually logging in to the sites whose log-ins wouldn't import and found that Password Manager successfully captured quite a few of them. For sites with straightforward username and password fields, it did fine. But for any site using a different style, it flopped. For example, one site uses fields named "code" and "pin" for log-in, and Password Manager just can't swallow that. RoboForm, 1-click, Identity Safe, Eikon and DigitalPersona all handled this site and many others that use mildly nonstandard log-in styles.

Many banks are now using complex multipage log-in procedures to guard against hacking. 1-Click records and plays back all the pages. ID Vault 4.0 has its own database of log-in procedures for about 8,000 financial and shopping sites; it knows exactly what to do for those. RoboForm and Identity Safe generally can't manage multipage log-ins. Eikon and DigitalPersona are both flexible enough to capture the multiple pages separately. But Password Manager is completely unable to capture or autofill these complex log-ins. For all the flexibility in its user interface, it's too rigid about what passwords it can capture.

There's one more oddity that I have to mention. The help system was clearly written by someone for whom English is a second language. Articles like "the" are mostly missing, and you'll find plenty of peculiar constructions like "It is always appears…" and "If you registering new account…" Worse, the help system is poorly indexed, it has too few pages with too much text on each, and some important topics aren't covered at all. Out of 11 pages in the Settings dialog, the help covers just one, and its description doesn't match the actual page. There's no explanation of the account editing dialog, the portable edition, USB-based authorization—I could go on! There's really no excuse for releasing a product with a help system this dismal.

Large Software Password Manager has many good points. It handles the basic task of managing standard username/password log-in accounts just fine. But it lags seriously behind the competition in its ability to manage the numerous Web sites whose log-in systems aren't plain vanilla. And the help system is a mess. It's a decent one-point-oh release, but there's still lots of work to be done.

More Utility Reviews: