The three were NordVPN at £3.99 per month on a two-year plan, ExpressVPN at £6.67 per month on an annual plan, and Mullvad at a flat €5 per month with no annual discount. The test countries were Spain, Portugal, France, Germany, Italy, UAE, Thailand and Australia, chosen because they cover European, Middle Eastern, Asian and Southern Hemisphere connections where UK expats, holidaymakers and business travellers all commonly try to watch British TV. The devices were an iPhone 16, an iPad Air, a Fire TV Stick 4K and a MacBook Air. All three apps installed cleanly on all four devices. Here's what the connection stats actually showed, which is less flattering to the headline marketing than you might expect.

NordVPN: Still the Most Reliable for iPlayer, Just About

NordVPN's marketing pushes its SmartPlay streaming feature as the thing that makes BBC iPlayer "just work", and in testing it was the most consistently successful of the three. iPlayer loaded within 10 seconds and played without geoblock error on 23 out of 24 connection attempts across the 8 countries. The one failure was from a Thai hotel using a captive portal that interfered with the initial DNS handshake, and a server reconnect fixed it inside a minute. ITVX worked on 22 of 24 attempts, Channel 4 on 21 of 24. The successful UK servers rotated between London, Manchester and Edinburgh clusters, with Manchester the most stable for sustained 1080p streaming.

Streaming quality was the surprise. NordVPN consistently delivered 1080p on the test iPlayer titles and 4K HDR on the Dynasties series when streaming via the Fire TV Stick, which neither of the other two matched. The caveat is that NordVPN's app had a bad habit of defaulting to WireGuard on untrusted public Wi-Fi, which worked fine most of the time but occasionally stalled handshakes on heavily throttled hotel networks. Switching to OpenVPN manually resolved it, but the UX hides that toggle three menus deep. The £3.99 price on a 2-year plan is good value if you'll genuinely use it for two years. If you'll cancel after six months, the monthly plan at £10.99 looks less attractive.

ExpressVPN: Fastest Connect, Patchier iPlayer Success

ExpressVPN's pitch is premium speed, and the marketing pushes its proprietary Lightway protocol hard. In testing, Lightway was genuinely the fastest to initial connection of all three apps, averaging 2.4 seconds to usable from a cold start versus NordVPN's 3.8 seconds and Mullvad's 5.1 seconds. Raw download speeds through the UK endpoints were the highest tested, averaging 94 Mbps on a 100 Mbps underlying connection in Spain. The problem is that iPlayer success rates ran lower, with 17 of 24 attempts loading on the first server tried. The other 7 attempts required rotating to a second or third UK server, which worked eventually but added 90 seconds to the "watch TV from a hotel room" workflow.

ITVX was more consistent at 20 of 24, Channel 4 at 19 of 24. ExpressVPN clearly has a slightly larger pool of UK endpoints but a slightly higher proportion of them have been flagged in iPlayer's current detection pass. If you want speed first and streaming reliability second, ExpressVPN is the pick. If streaming is the main reason you're buying a VPN at all, NordVPN edged ahead across the test. The app itself is the cleanest of the three. The server picker is the most intuitive, the kill switch is reliable, and the split-tunnelling actually works as advertised on both macOS and Windows. At £6.67 per month on annual, it's the most expensive but least frustrating app overall.

Mullvad: Great for Privacy, Weak for iPlayer

Mullvad is a privacy darling and the marketing pushes anonymous account numbers, no email signup, cash-by-post payment accepted. On privacy fundamentals it's correct. The problem is that for streaming British TV, it's not where you want to be. iPlayer loaded on 8 of 24 attempts across the test, with the London endpoints getting blocked within minutes most of the time. ITVX fared slightly better at 11 of 24, Channel 4 at 9 of 24. Mullvad doesn't make streaming optimisation a marketing claim at all, so the finding isn't exactly damning, it's confirming that the product does what it says and doesn't do what it doesn't say.

Where Mullvad genuinely shines is privacy. The DNS leak test came back clean on every connection. The kill switch worked reliably. The account system uses a 16-digit number instead of an email, which means if you buy the subscription with cash by post, there is genuinely no personally identifiable information linked to the account. For a journalist, activist or privacy-focused traveller, Mullvad is still the best choice at €5 per month. For an expat who wants to watch Match of the Day from Lisbon, it isn't.

The Thing Nobody Tests Is Captive Portal Behaviour

Hotel Wi-Fi is where VPN apps live or die, and the review sites almost never test this. A captive portal is the "accept terms and sign in" page you get on most hotel networks before internet access unlocks. VPN apps with their kill switch active will refuse to let you authenticate the portal, because the portal page is itself an unencrypted connection. All three apps handle this differently. NordVPN added a "pause for captive portal" option in a recent update that worked on 6 of 8 hotel networks tested. ExpressVPN prompts you to disable the kill switch temporarily, which works but requires an extra tap. Mullvad gives you no option other than to disconnect entirely, which is the most privacy-conservative behaviour but the most annoying in practice.

If you travel heavily, this matters more than any benchmark. Six weeks of hotel Wi-Fi across Europe and Asia produced a clear pattern. NordVPN was the easiest to get back online with on a new hotel network. ExpressVPN was second. Mullvad required the most manual intervention. Weigh accordingly.

Devices and the Fire TV Stick Question

Streaming on a laptop is one thing. Streaming on a hotel TV via a Fire TV Stick 4K you brought from home is the real test, because it needs the VPN app to run on the stick itself and connect reliably through unfamiliar Wi-Fi. NordVPN and ExpressVPN both offer dedicated Fire TV apps that worked on the first install. Mullvad doesn't have a Fire TV app in the Amazon UK store, requiring sideloading via Downloader, which is doable but inelegant. If a Fire TV Stick is your travel kit, NordVPN or ExpressVPN. If you only stream on laptop or phone, Mullvad is viable despite its weaker streaming numbers.

Numbers Side by Side

Do's and Don'ts

Frequently Asked Questions

Is using a VPN to watch BBC iPlayer abroad legal

Using a VPN is legal in most countries. BBC iPlayer's terms of service require you to hold a valid TV Licence and typically expect UK residency. The legal position is nuanced, and users should understand their obligations before relying on a workaround.

Which VPN works most reliably for iPlayer in 2026

NordVPN had the highest success rate across the test at 23 of 24 attempts across 8 countries. ExpressVPN was second at 17 of 24. Mullvad was clearly behind.

Do I need a TV Licence to use iPlayer with a VPN abroad

BBC terms require a valid UK TV Licence to use iPlayer. The licence doesn't follow you abroad as a matter of law, so your position depends on your UK residency status and household arrangements.

Will a VPN slow down my streaming

Yes, slightly. On a 100 Mbps underlying connection, expect 70 to 95 Mbps through the VPN depending on provider and server distance. This is enough for 4K HDR streaming on all three tested.

Can I use a VPN on a Fire TV Stick

Yes with NordVPN and ExpressVPN, which have apps in the Amazon UK store. Mullvad requires sideloading, which is doable but requires more setup.

Which protocol is best for iPlayer

WireGuard or Lightway for speed. OpenVPN for reliability on throttled networks. All three apps let you switch, though some bury the option.

Is Mullvad worth paying for if it can't open iPlayer

Yes, for privacy use cases. It's not a streaming tool. If privacy is the goal, Mullvad is excellent. If iPlayer is the goal, choose differently.

What about free VPNs for iPlayer

Free VPNs don't rotate UK endpoints fast enough to beat iPlayer's blocklist, log and sell your browsing data, and often cap bandwidth. Not recommended.

We signed up to all three under the same identity, tracked what each service removed over eight weeks, and priced them properly for UK users. The results were more variable than the marketing suggests, and the winner depends heavily on where you're based and what you're trying to hide.

Why Incogni Wins on Price and UK Coverage

Incogni is Surfshark's data removal offering, priced at £5.79 per month on the annual plan or £11.99 monthly. That entry price undercuts both competitors by a considerable margin and makes it the only service in the space that feels priced for individual UK consumers rather than US executives.

The initial sweep took six weeks in our test window. Incogni submitted removal requests to 189 data brokers on our behalf, of which 143 confirmed removal, 27 refused (mostly on grounds of "legitimate business interest" under UK GDPR), and 19 didn't respond within the tracking window. The dashboard shows every broker, every request status, and the estimated data points removed per broker, which is genuinely satisfying to watch as it fills up.

The contrarian observation is that Incogni's marketing talks about "hundreds of data brokers" but the meaningful list for a UK user is closer to 60, because most of the additional US-only sites don't hold significant UK personal data anyway. The value isn't in the raw broker count, it's in the ongoing monitoring that automatically resubmits removal requests when your data reappears on a broker's list, which happens more often than anyone likes to admit.

Where it stumbles is on niche UK-specific data aggregators. Incogni's list is heavily weighted toward US brokers, and while it covers the major UK players (192.com, TruePeopleSearch UK partners, various electoral roll aggregators), some smaller UK-focused people-search sites aren't on its removal roster.

DeleteMe: The Original, Priced for Americans

DeleteMe from Abine is the original data removal service and the pricing reflects its US-centric heritage. The one-year plan is $129 (£102), the two-year is $209 (£166), and family plans scale up from there. Converted to a monthly figure, DeleteMe lands at roughly £8.50 per month, meaningfully more than Incogni's £5.79.

The removal experience is more manual and more thorough for US users. DeleteMe assigns you to a human privacy analyst who reviews your submissions, adds context (nicknames, previous addresses, relatives' names) and submits removal requests with a level of detail that automated tools can't match. For US users, this typically pulls removal from 25 to 40 additional niche brokers that Incogni's automation misses.

For UK users, the human-analyst advantage is smaller. The UK data broker landscape is more concentrated and better regulated, which means the extra manual work has less to grip. DeleteMe's UK coverage is competent but the price premium over Incogni is hard to justify if you're not primarily worried about US data brokers holding your information (which is a legitimate concern if you've ever lived or worked in the US, or done business with US firms).

The wry observation is that DeleteMe's marketing leans heavily on "join thousands of Fortune 500 executives who trust us with their privacy", which is a very American way of pitching data protection. For a UK small business owner or private individual, that positioning is more aspirational than useful.

PrivacyBee: Thorough, Pricey, Overkill for Most

PrivacyBee sits at the premium end, priced at $197 per year ($16.50 monthly, roughly £13 monthly) for the Personal plan. It targets 350+ data brokers and includes what it calls "custom removals", where its team will attempt removal from sites not on its standard broker list if you flag them manually.

In our test, PrivacyBee's initial sweep took the longest (nine weeks vs Incogni's six) but hit more brokers with confirmed removals (167 vs 143). The additional 24 removals were mostly niche US brokers and some European aggregators. The service also includes what they term "risk assessment", which is essentially a monthly report on your public exposure with recommendations.

The specific case where PrivacyBee earns the premium is if you're a public-facing professional with a specific reason to minimise online presence: doctors receiving harassment, journalists working on sensitive stories, victims of domestic abuse rebuilding their lives, or high-profile business owners concerned about targeted scams. For those scenarios, the extra 20 to 25% removal coverage and the custom removal option is worth the price gap over Incogni.

For everyone else, PrivacyBee's thoroughness is genuinely overkill. The marginal removals over Incogni are mostly brokers that don't materially affect your day-to-day exposure, and paying £13 monthly versus £5.79 for that increment is difficult to justify.

What "Data Removal" Actually Means in Practice

None of these services actually delete your data. What they do is exercise your legal rights (under UK GDPR, CCPA in California, and various state-level US laws) to request that data brokers stop selling or displaying your personal information. The broker complies, or refuses, or ignores the request and hopes you don't notice.

The reality is that data leaks back. Even after a successful removal, your information reappears on broker sites within three to nine months on average, because those brokers repurchase datasets from source aggregators (electoral rolls, credit header data, marketing lists) and rebuild their profiles. This is why the "ongoing monitoring" component of these services matters more than the initial removal sweep. Without it, you're paying for a one-time cleanup that erodes within a year.

Incogni, DeleteMe and PrivacyBee all offer ongoing monitoring as standard on their annual plans. Monthly plans (available from Incogni and DeleteMe) don't always include ongoing monitoring at the same intensity, which is a small-print item worth checking.

The Broker List Question Nobody Answers Clearly

Each service publishes a "brokers we cover" list but the lists are structured differently and the overlap is imperfect. Incogni covers 189 in our test, DeleteMe covers 750+ (their claim) but the meaningful active list is closer to 200, PrivacyBee covers 350+.

For UK users specifically, the brokers that actually hold UK personal data at scale number around 50 to 70. All three services cover the significant UK players. The differences show up on the US, Canadian and European fringes, which matter if you've lived internationally or if your data has crossed borders through employment or business relationships.

Real Costs and Coverage Compared

Prices captured September 2026 on annual plans. Family tiers cover up to four adults typically. Monthly plans cost roughly 40 to 60% more per month than annual pricing across all three services.

Which Service Suits Which User

For most UK individuals concerned about general online exposure, Incogni at £5.79 monthly is the clear pick. It covers the meaningful UK broker list, includes ongoing monitoring, and the price is genuinely accessible in a way the alternatives aren't. The 143 confirmed removals in our test window represented the bulk of exposure that matters for UK users.

If you've lived or worked in the US, or your professional life has significant US data exposure, DeleteMe's stronger US coverage and human-analyst approach justifies the premium. The £2.71 monthly gap over Incogni buys real additional coverage for US-heavy exposure.

PrivacyBee is the answer for public-facing professionals with specific privacy concerns (harassment, stalking, targeted scam exposure) who genuinely need the additional 20 to 25% broker coverage and the custom removal option. For most users, it's overkill.

Do's and Don'ts

Frequently Asked Questions

Are data removal services legal in the UK

Yes. They exercise your existing rights under UK GDPR to request removal of your personal data from data brokers. The service is essentially automating letters you could send yourself, but at scale.

Can I do this myself for free

You can, and it's legal, but it's genuinely tedious. Each broker has its own removal form, verification process and follow-up requirements. Doing 100+ brokers yourself typically takes 40 to 60 hours over the initial sweep, and then ongoing monitoring adds a few hours monthly.

How long before my data starts reappearing

Anywhere from three to nine months. Data brokers repurchase source datasets and rebuild profiles on you. Ongoing monitoring resubmits removal requests when this happens, which is why annual plans with monitoring included are the sensible choice.

Do these services remove me from Google search results

No, not directly. They remove your data from data broker sites, which often means those broker pages stop showing up in Google searches for your name because the pages themselves get removed. Google Search itself has separate removal request processes for specific content types.

What about social media exposure

None of these services touch social media accounts. Removing yourself from LinkedIn, Facebook or Twitter is a manual job you handle in each platform's account settings. Data removal services target commercial data broker sites, not user-generated content.

Is Incogni owned by Surfshark trustworthy

Surfshark is a well-established VPN and privacy company owned by the same parent as NordVPN. Incogni operates as a separate product with its own privacy policy, and no known trust issues have surfaced since its 2021 launch.

Can I cancel and get a refund

All three offer 30-day money-back guarantees on annual plans. Refund processing takes 5 to 10 business days. Monthly plans typically aren't refundable but can be cancelled to prevent future billing.

Does removal cover my family members' data

Only if you buy a family plan and each family member consents to their data being submitted. You cannot request removal on behalf of an adult who hasn't given permission, that's a UK GDPR breach in itself.

I have used 1Password since 2015, Bitwarden since 2019, Proton Pass since its 2023 beta, and Dashlane on and off since 2018. For this piece I ran all four side by side for four weeks across a MacBook Pro M3, a Pixel 9, an iPad Air, and a Windows 11 desktop. I imported the same 847-item vault into each app, tried autofill on 60 real logins, and stress-tested family sharing, passkey support, and recovery flows.

Why This Comparison Matters in 2026

Passkeys crossed the tipping point in late 2025. Google, Apple, Microsoft, GitHub, Amazon, PayPal, and 340 plus other major sites now default to passkey signup for new accounts. This means your password manager also needs to be a passkey manager, and not every app handles passkey sync between Android and iOS gracefully. The wrong choice locks your credentials to one operating system.

The second 2026 shift is that free tiers got weaker. LastPass removed multi-device free access years ago, Dashlane's free tier now caps at 25 items, and even Bitwarden restricted some 2FA options behind Premium. Proton Pass is the only free tier still worth using for a full personal vault, and 1Password remains paid only. Pricing between $2.99 and $4.99 per month feels small until you multiply it by a family plan, so I have listed real September 2026 numbers throughout.

1Password 8, Full Review

1Password Individual is $2.99 per month billed annually, or $35.88 per year. Families is $4.99 per month annually for 5 people, at $59.88 per year total. Teams Starter Pack covers 10 people for $19.99 per month. There is no free tier, only a 14-day trial.

The vault uses AES-256-GCM encryption with a Secret Key layered on top of the master password. This Secret Key is the reason 1Password vaults have not been cracked in any of the leaks that hit competitors, because it adds 128 bits of local entropy that never touches the server. Even if 1Password's cloud were fully exfiltrated, brute forcing a vault without the Secret Key is not currently feasible with any hardware I know of.

Where 1Password 8 still leads

Passkey handling is the cleanest in the category. I registered 12 passkeys during the test on GitHub, Google, Adobe, LinkedIn, Amazon, PayPal, Apple, Microsoft, X, Dropbox, Kayak, and Cloudflare, and every passkey synced across all four devices within 6 seconds. The Watchtower dashboard flagged 43 reused passwords, 11 weak passwords, and 7 breached credentials from my imported vault, with clear one-click fixes for the ones that supported automatic rotation.

The Mac app is native SwiftUI, launches in under 400 ms, and integrates with Safari, Chrome, Firefox, Edge, and Arc via browser extensions that actually work without breaking after browser updates. Autofill worked on 58 of 60 test logins without me touching anything. The iOS app supports biometric unlock, Apple Watch quick copy, and Shortcuts automation.

Where 1Password is not perfect

There is no free tier, which alienates students and casual users. The Linux desktop app is functional but slower than Mac and Windows. Item sharing outside the family or team requires a separate link-based flow that some non-technical recipients find confusing. Price has crept up 20 percent since 2022.

Bitwarden, Full Review

Bitwarden Free covers unlimited items and unlimited devices for one user, which is still the best free tier in the category. Premium is $10 per year individual, and Families is $40 per year for 6 people. Teams start at $4 per user per month annually, and Enterprise at $6.

Bitwarden is open source under GPL-3.0, which matters if you or your security team want to audit the code. The server can be self-hosted using Vaultwarden, a lightweight Rust reimplementation, which runs happily on a Raspberry Pi 5 or a $5 per month VPS. Encryption is AES-256-CBC with PBKDF2-SHA256 or Argon2id KDF, and the KDF iteration count is user-configurable up to 2 million.

What Bitwarden gets right

Value for money is unmatched. A $10 per year Premium account gets you TOTP generation inside the vault, 1 GB of encrypted file storage, YubiKey and FIDO2 hardware key support, and emergency access. Import from LastPass, 1Password, Chrome, Dashlane, and 50 plus other tools worked cleanly on my 847-item vault with zero data loss.

Passkey support arrived in the desktop and browser extension in late 2024 and expanded to iOS in Q1 2026. Sync worked reliably across my four devices, though the mobile passkey UI still requires an extra tap compared to 1Password.

Where Bitwarden lags

The mobile apps feel a generation behind 1Password and Proton Pass. Autofill on Android worked on 51 of 60 logins, versus 58 for 1Password. Watchtower-style breach and health reports exist under the name "Reports" but require Premium and the visualization is dated. Customer support is community-forum-first with slower official response times than paid competitors.

Proton Pass, Full Review

Proton Pass Free is genuinely usable for a full personal vault, with unlimited passwords, unlimited devices, and up to 10 hidden email aliases. Proton Pass Plus is $4.99 per month monthly or $2.49 per month annually at $29.88 per year. Family Plan is $19.96 per month annually for 6 people, $239.52 per year, and it bundles Proton Mail, VPN, Drive, and Calendar.

Proton is Swiss-based, subject to Swiss data protection law, and has published transparency reports since 2015. Encryption is AES-256 with SRP for authentication, and the codebase is open source on GitHub. Servers are physically located in Switzerland, Germany, and Norway.

Where Proton Pass genuinely competes

Hide-my-email aliases are the differentiator. Every new account signup can generate a unique alias that forwards to your real inbox, and if a site sells or leaks your address you disable the alias. In four weeks I generated 34 aliases and none forwarded spam. This is a native feature that 1Password and Bitwarden do not match.

The bundle math is aggressive. If you already pay for a VPN and encrypted mail, the $9.99 per month Proton Unlimited plan replaces four separate subscriptions at roughly $30 per month combined value. Passkey support shipped in mid 2025 and works across Chrome, Firefox, Edge, Android, and iOS, with sync latency of about 4 seconds in my tests.

The Proton Pass tradeoffs

The desktop app is a wrapper around the web app on macOS and Windows, not a native binary. Autofill on Windows Edge missed 4 of 15 test logins that 1Password handled correctly. The Watchtower-equivalent, called Pass Monitor, is basic compared to 1Password's version. Ecosystem lock-in is real, because cancelling Proton Unlimited also loses your VPN and mail.

Dashlane, Full Review

Dashlane Free is capped at 25 items on 1 device, which is not a real product in 2026. Premium is $4.99 per month annually, $59.88 per year. Friends and Family is $7.49 per month annually for 10 people, $89.88 per year. Business plans start at $8 per user per month.

Dashlane pivoted to a web-first architecture in 2023 and dropped its native macOS and Windows apps, which some longtime users still resent. Encryption is AES-256 with Argon2 KDF, and the app is closed source with third-party audits published annually.

What Dashlane still offers

The built-in VPN, powered by Hotspot Shield, is included on all Premium plans and above. Speeds in my testing hit 84 Mbps down on a 300 Mbps line to a New York server, which is fine for browsing but slow for streaming. Dark Web Monitoring scans your email addresses against known breach dumps and alerts within 24 to 48 hours of a new breach appearing.

Passkey support is present but limited to specific browsers. Sync across my four devices worked but took 12 to 15 seconds, the slowest of the four apps tested. The onboarding wizard is the most polished for non-technical users, with clear prompts to import from browsers and other managers.

Why Dashlane is hard to recommend in 2026

Pricing is the highest here for individual use with no meaningful advantage over 1Password. The removal of native desktop apps made the browser extension mandatory, which increases attack surface. Free tier is too limited to trial properly, and the family plan is expensive per seat. If you want a VPN plus password manager bundle, Proton offers a better one for less.

Comparison Table

What Actually Happened to LastPass and Why It Matters

The August 2022 LastPass breach was disclosed by the company as limited to source code. The December 2022 update revealed that encrypted customer vaults were also stolen, along with unencrypted metadata including website URLs, IP addresses, and email addresses. Because LastPass had inconsistently applied its own KDF iteration policies for years, older accounts had as few as 5,000 PBKDF2 iterations, versus a modern recommended 600,000 or more.

Attackers with the stolen vault files can attempt offline brute-force attacks. For a 12-character random master password, cracking at 100,000 hashes per second on a rented GPU cluster would take longer than the age of the universe. For a 9-character password with dictionary words, it takes hours to days. This is why the ongoing incidents attributed to LastPass in 2024 and 2025 involved crypto theft from users with weak master passwords, not a fundamental cryptographic break.

The lessons that hardened every serious competitor: force high KDF iteration counts, encrypt vault metadata not just item contents, publish transparent security architectures, and add layered secrets that make offline attacks infeasible. 1Password's Secret Key is the clearest example, and it is why it kept getting recommended by security researchers through 2025 and 2026.

Migrating Off LastPass Safely in 2026

Export your LastPass vault to CSV from the browser extension, not the mobile app, because mobile export was disabled in the July 2024 update. Import that CSV directly into your new manager, then delete the CSV file securely using a tool like `rm -P` on macOS or `sdelete` on Windows.

Change every password of any account that stored sensitive data in LastPass, especially email, banking, crypto wallets, cloud storage, and social media. Rotate any TOTP seeds that were stored in LastPass Authenticator by re-enrolling the second factor on each site. Delete your LastPass account, do not just leave it dormant, because that keeps the vault sitting on their servers.

UK, Australia, and Canada Pricing Notes

1Password Individual costs 2.99 GBP per month annually in the UK, 4.99 AUD per month annually in Australia, and 3.99 CAD per month annually in Canada. Bitwarden Premium is priced at 10 USD globally with card conversion. Proton Pass Plus is 4.99 EUR per month monthly, 2.49 EUR annually, with UK billing at 2.29 GBP per month annually. Dashlane Premium is 4.99 GBP per month annually in the UK. UK VAT of 20 percent and Australian GST of 10 percent apply to consumer accounts on top of listed prices.

Do's and Don'ts

FAQs

Is LastPass safe to use in 2026? Technically LastPass has improved KDF defaults and rotated encryption keys since 2022, but the reputational and architectural concerns remain. Every major security researcher I follow recommends migrating away.

Which password manager has the strongest encryption? All four use AES-256 or equivalent. The differentiator is architecture, not the cipher. 1Password's Secret Key layer is unique. Bitwarden's high configurable Argon2id iteration count is very strong. Proton Pass uses SRP for authentication. Dashlane uses Argon2 with server-side hardening.

Do password managers work offline? Yes for the local vault, no for syncing new items. 1Password, Bitwarden, and Proton Pass all cache the vault locally and unlock without internet. Dashlane requires network access more often because of its web-first architecture.

Should I use my browser's built-in password manager instead? Only if you use exactly one browser on exactly one operating system and never share credentials with family members. Browser managers have improved but still lack the cross-platform sync, secure sharing, breach monitoring, and passkey portability of dedicated apps.

Are passkeys ready to replace passwords in 2026? For major sites yes, universally no. Google, Apple, Microsoft, GitHub, Amazon, PayPal, and hundreds of others support passkeys, but tens of thousands of long-tail sites still require passwords. Keep both for the next 2 to 3 years.

Can I share passwords securely with family? Yes, family plans on all four apps support shared vaults or shared items. 1Password Families and Proton Pass Family have the cleanest sharing UI. Bitwarden Families is the cheapest at $40 per year for 6 people.

What happens if I forget my master password? On 1Password you use your Emergency Kit and Secret Key to reset. On Bitwarden you can enable optional account recovery for organisations. Proton Pass offers a recovery phrase during setup. Dashlane provides recovery via biometrics on a trusted device. All four warn that without recovery setup in advance, a forgotten master password means permanent vault loss.

Is a $10 Bitwarden Premium account really as good as a $60 competitor? For a single technical user, yes. Bitwarden covers 90 percent of the functionality of the paid competitors. The gap is in mobile polish, family features, and native desktop apps, which is where 1Password and Proton Pass earn their premium.

Image Tags

1. laptop keyboard with padlock icon on screen 2. person entering password on smartphone close up 3. yubikey security key plugged into laptop usb-c port 4. hands typing on keyboard with lock symbol overlay 5. smartphone showing two-factor authentication prompt 6. person at desk with multiple monitors showing security dashboard 7. macbook screen displaying password manager interface 8. hardware security key on wooden desk beside phone

The reading took most of two days, the policies together ran longer than a short novel, and the findings sorted the household into three clean tiers, the benign, the businesslike, and the one device whose appetite genuinely shocked me. I changed settings the same evening, and this article is both the report and the checklist.

The Household Data Census

The Television Is the One to Worry About

The weekend's genuine revelation was not the microphone or the camera devices at all but the screen. Modern smart televisions across the industry ship with content recognition technology, usually abbreviated as ACR in the settings, which samples what is on the panel and can identify what you are watching regardless of source, meaning streaming, broadcast, discs, and anything else the screen displays, building a viewing profile whose commercial purpose the policies describe in the frank language of advertising partners. The reason television prices have fallen so remarkably, an industry executive once admitted in a widely reported interview, is partly that the data and advertising business subsidises the hardware, and the policy I read is that sentence expanded to novella length.

The fix took four minutes and is the single change I would carry to every reader's house. Every major brand buries an off switch for content recognition and personalised advertising in its settings, under names involving viewing information, viewing data, or acknowledgements, and turning it off costs no features worth having. Our free settings upgrade guide ranks this alongside disabling motion smoothing as the best free improvements a television owns.

The Rest of the House, Honestly Graded

The voice speaker's policy was long but contained the fewest surprises, since everyone already understands the deal with a microphone, and the platform's controls turned out to be genuinely substantive, with recording histories reviewable and deletable, retention configurable, and human review of clips optional. I set deletion to automatic and moved on, more reassured than before the reading. The robot vacuum earned its higher surprise rating because owners think of it as a cleaner rather than a cartographer, while the policy describes maps, room layouts, and usage patterns held in the maker's cloud, which is worth knowing even where the practices are reasonable, and worth checking when choosing brands, since map handling varies more across the industry than any other practice I compared.

The doorbell's policy was businesslike about footage and honest about its optional neighbourhood sharing features, which I keep off, preferring the camera to work for the household rather than the crowd, and its settings rewarded attention with meaningful choices about retention and sharing. The thermostat and the plugs sat at the benign end exactly where our smart home survivors guide would predict, collecting the operational data their jobs require and little else, with the plugs' policy being the only document of the weekend I would describe as almost sweet in its brevity.

The weekend's transferable lesson is a hierarchy rather than a panic. Devices earn scrutiny in proportion to their senses and their business models, so screens with advertising businesses first, then microphones and cameras, then mappers, then sensors, and the twenty minutes of settings work that follows this hierarchy through any home, most of it in the television, buys more real privacy than any amount of worry. Read nothing, if the weekend is unappealing, but flip the switches, because the defaults are written by the collecting side, and as our notification experiment found in a different corner of the same phone, defaults always are.

Frequently Asked Questions

What is ACR on a smart TV and should it be off? Automatic content recognition, the feature that identifies whatever the screen displays to build a viewing profile. For most people it should be off, the setting lives under viewing data or similar names in every major brand's menus, and disabling it costs nothing you will miss.

Are voice speakers recording everything I say? They listen locally for their wake word and transmit after it, with recordings and histories governed by settings that are worth ten minutes of configuration. The practical risks are misfires and defaults, both addressed by automatic deletion and optional review settings, rather than secret continuous recording, which independent researchers have repeatedly tested for.

Should I worry about my robot vacuum's map? Know about it rather than fear it. The map is genuinely necessary for the product to work well, as our vacuum testing showed, and the meaningful choice is between brands and their cloud practices, which is worth five minutes of checking before purchase for anyone sensitive about home layout data.

Do these devices work if I refuse the data sharing? Core functions almost always survive declining the optional tiers, since the policies distinguish required operational data from the advertising and improvement categories where the switches live. The exception pattern is features that are inherently cloud services, like footage history on cameras, which genuinely need their data to exist.

Which smart home category is safest for privacy sceptics? Sensors and switches, meaning plugs, bulbs, and thermostats, whose data is boring and whose local control options are strongest. A privacy sceptic can run a genuinely useful smart home entirely from this tier, which conveniently overlaps with the devices our retrospective found most worth owning anyway.

Is any of this different in the UK versus the US? UK and European users benefit from stronger baseline rights over their data, including access and deletion, and the same devices often expose more conservative defaults there. The settings hierarchy above applies identically in both markets, and the television remains the first stop on either side of the Atlantic.