RoboForm review: A simple password manager with buried flaws

The devil is in the details, and especially so for password managers. Services worth their salt have to nail the major basics. Good security and a friendly interface are non-negotiable minimums. And on this front, RoboForm ticks those boxes.

How a company delivers its experience separates the field, though. Feature lists add just a portion of weight to the scales; execution serves as counterbalance. And cost is yet another factor in the mix.

RoboForm stakes its position on the lighter end of the scale—fewer features with equally lower cost. And its high polish initially makes it an ideal fit for anyone seeking a simple, seamless experience. But if you poke at it, flaws appear, including those that quietly undermine RoboForm’s security.

Read on to learn more, then see our roundup of the best password managers for comparison.

RoboForm in brief

• Cost: $30 per year (annual rate)
• Family plan available? Yes ($48 per year, annual rate)
• Browsers: Chrome, Firefox, Edge
• Apps: Windows, Mac, Android, iOS
• Passwordless login: Yes
• Passkeys supported: Yes
• 2FA TOTP supported: Yes
• Account recovery possible? Yes

What are RoboForm’s plans and features?

RoboForm / PCWorld

RoboForm offers Free, Premium, or Family plans, with heavy restrictions on its free tier.

The Free plan is better thought of as an ongoing limited trial for RoboForm—though when you first sign up, you’ll get an actual 30-day trial of Premium. Making the downgrade after that first month all the more painful because of that initial taste of the full-fat experience.

To its credit, RoboForm allows unlimited saving of passwords and passkeys on the free plan, an increasing rarity among password managers. It also checks data leaks for your passwords and supports more advanced forms of two-factor authentication for login, including hardware keys (e.g., YubiKey). But you’re limited to just one device for use, with no web access.

Subscribing to the Premium tier opens up RoboForm’s full feature set, including its single standout feature. Its “local-only” mode is a rarity among password services these days, as most rivals have moved away from supporting offline apps. Your vault and your backups get saved only to your device.

The remaining Premium features are more usual. You can access your data from an unlimited number of devices (and the web), generate one-time (TOTP) codes for two-factor authentication on other services, set up emergency access for others to your account, and securely share items. RoboForm will also monitor data breaches for up to five email addresses. Email support around the clock (24/7) becomes available, too.

RoboForm platform support

RoboForm supports multiple platforms. In addition to browser extensions for Chrome, Firefox, and Edge, you can also download and install apps for Windows, Mac, iOS, and Android. 

Your first exposure will be through the browser extension if you sign up on the website—the sign up form pushes you to download it. To sign up via Windows app, you’ll have to download and install it first. You must download an app for offline access.

How does RoboForm perform?

For this review, I used RoboForm’s desktop app for Windows 11, browser extensions for Chrome and Firefox in Windows 11, and the Android app. I also looked briefly at the iOS app.

RoboForm sign-up

RoboForm’s sign-up process is fluid and fast—as long as you follow the typical flow. Most people will create an account by using the website, which points you to the browser extension. Install that and fill out the form, and you’re off to the races almost instantly. You can generate a passkey during account creation, too. Combined with RoboForm automatically enabling two-factor authentication for your account (via email), new users start with a strong level of security and convenience out the gate. The only missing piece? Passwordless-only login isn’t an option.

PCWorld

For advanced users, the sign-up process feels more convoluted. Download the Windows app as your starting point, and RoboForm will first push you to the browser extension for account creation or sign in. (On my test PC, which has several browsers installed, I had different windows popping into focus to auto-load tabs.) You also have to wait to enable more secure forms of two-factor authentication—to activate an authenticator app, passkey, or SMS, you have to dig into the settings. Most disappointing, you can’t start out the gate with local-only access.

The vast majority of RoboForm users will prefer the simplicity of the normal sign-up process. But for anyone hoping to dive straight into RoboForm’s most unique feature, the local-only data experience isn’t seamless.

Is it easy to import passwords into RoboForm?

RoboForm allows you to import passwords from your browser or another service, with good accuracy—and instant flagging of common weak passwords. For my sample set of imported passwords (about two dozen), saved to CSV, the data came through intact. RoboForm also immediately marked entries with bad passwords like “password” and “123456” with red warning symbols.

For direct importing, RoboForm can pull from LastPass, Bitwarden, Dashlane, 1Password, Keeper, NordPass, True Key, Enpass, Kaspersky, Proton Pass, and Myki. For all other services and apps, you can export to CSV and then import that file into RoboForm.

How easy is RoboForm’s interface to use?

Within the browser extension and mobile app, the layout of entries and settings feels intuitive. The look on Android may feel a bit plain, however.

PCWorld

In the browser extension, categories for your stored data and often-used features like a password generator and sharing options live in a left sidebar. The main window shows your saved entries for passwords and other items. You can access other settings in a drop-down menu by clicking on your account info in the upper-right of the screen.

The mobile apps take a similar approach, but with a top navigation bar under a search bar, and the entries within the main portion of the screen. Settings live within a three-dot menu at the top of the screen. Everything feels straightforward.

For both of these interfaces, capturing and filling in passwords for login pages and apps works well. Clicking on an entry will initiate the entire login process for many sites—no further input needed from you. It feels very smooth.

PCWorld

Power users will again run into minor headaches, however. For starters, RoboForm won’t allow the creation of manual entries for passwords without complete data. You must enter data into each field to save. For users who want to store a password without tying it to a website or user ID (without having to fill in extra nonsense or placeholder text), the option doesn’t exist.

The Windows app also feels more convoluted to use. RoboForm acknowledges that the user interface is more dated, which is fine—the layout is still clear. But the required tie-in with the browser extension feels cumbersome. Its one-click login won’t work unless the browser extension is installed, for example. You also can’t change any options for the Windows app.

And for local-only storage of your data, you’ll have to first change your sync settings before adding any data to your vault, if you truly want to keep everything offline from the start. Making the switch isn’t intuitive either. You have to uncheck the setting for automatic sync, which then opens a dialog box stating that you can manually synchronize with RoboForm’s servers. I disliked this approach; it could be much clearer. I would prefer a sync option for “Local storage only” and a message box that explains where the data is stored and how backups work. Such info would be more helpful to both less experienced and advanced users.

How well does RoboForm manage passwords and passkeys?

During daily use, RoboForm matches its best rivals in behavior. It smoothly fills in saved passwords and passkeys on recognized sites. For logins not yet saved, it asks to capture the details after you fill them in. You can also choose between two levels of autofill (automatic or suggested), or disable it all together. Creating logins feels slightly more manual but still is a smooth process.

By default, RoboForm generates passwords of 22 characters long, with a maximum of 512 characters. That maximum length is definitely among the highest available for creation, though at this point in time, just a wee bit of overkill. (Many sites that don’t offer two-factor authentication—one of the main reasons to use a very long password—have far shorter password length limitations.)

PCWorld

For organization, RoboForm offers folders for you to sort your entries into. Doing so from the browser extension and web interface requires first selecting All from the left navbar, then clicking on the plus symbol. In contrast to other features, the Windows app is the most straightforward for finding the option to make new folders. (The icon is visible at all times.)