RoboForm password manager review

RoboForm is one of the oldest password managers out there, and after 20 years remains a solid competitor in the market. 

RoboForm has raised its yearly subscription price since we last reviewed the service, to $24/year from $20/year, but other password managers have too, and RoboForm remains one of the cheaper paid options among the best password managers.

The standalone desktop app remains a poor experience on RoboForm, but the website interface, mobile apps and browser extensions have gone through a significant redesign that gives the service a much more modern feel. RoboForm still remains among the best at form-filling. 

Overall, RoboForm's paid plan is no-nonsense and effective and will manage your passwords and personal information without much flash or fuss. It doesn't offer much more than the Bitwarden free tier, and you can get newer features with the Keeper paid plan, but RoboForm is a dependable option that shouldn't disappoint you.

Roboform: Costs and what's covered

RoboForm offers a free tier and a paid subscription called RoboForm Everywhere. The latter is one of the cheaper paid offerings among password managers at $23.88 per year for a single user. You can bring down that cost by 10% with a three-year plan ($64.44) or by 16% with a five-year plan ($99.50).

A family of up to five users can be covered for $47.75 a year. Again, you can save 10% with a three-year plan ($128.85) or 16% with a five-year plan ($199.00). At the time of this writing, Tom's Guide readers got a 30% discount off the one-year individual and family plans.

RoboForm has a reasonably good free tier, with the ability to save unlimited passwords, generate strong passwords, autofill web forms, audit your passwords and be alerted of compromised ones, send passwords securely, receive emergency access to another RoboForm user's account, log in to desktop applications and manage bookmarks. 

The biggest advantage of paid accounts is the ability to sync your passwords and other items across all of your devices, which is crucial for most users.

Additional perks for paying users include cloud backup, a secured shared folder, two-factor authentication (2FA) support, the ability to grant emergency access to another RoboForm user, web access to your data and priority 24/7 support. In January 2022, it added a 2FA authenticator/code generator to its desktop apps, and that feature is coming soon to the RoboForm mobile apps.

RoboForm still offers a local-only storage option, a valuable option for users who don't wish to, or are not allowed to, store their data in the cloud. Enabling it simply requires turning off automatic sync. Just be aware that the mobile apps lack the ability to turn off automatic syncing.

Support for Windows goes all the way back to Vista. The Windows universal installer will add browser extensions to Microsoft Internet Explorer, Mozilla Firefox, Google Chrome, Microsoft Edge, Opera and Windows applications, and updated versions of the browser extensions were rolled out in March 2021.

Mac users must be running macOS 10.13 High Sierra or later, and the Mac installer includes browser extensions for Apple Safari, Google Chrome and Mozilla Firefox.

RoboForm offers similarly extensive support on mobile, going all the way back to iOS 13 and Android devices running Android 5 Lollipop. Linux users have standalone extensions available for Mozilla Firefox and Google Chrome. Chrome OS is supported via the Google Chrome browser extension. 

For this review, I used RoboForm on a 2017 MacBook Pro 15 running Windows 10 and macOS 10.14 Mojave, an iPhone 7 Plus, and a Google Pixel 3. Google Chrome was my primary browser across all platforms but testing on macOS and iOS was also done with Safari.

RoboForm: Setup

To get started, just navigate to the RoboForm downloads page. It will recognize the device that you are browsing from and recommend the correct version. The universal installer for macOS and Windows will also install the full-featured browser extensions for all supported browsers. 

Now you need to create your account, which requires just an email address and a master password. RoboForm requires that the master password be at least 8 characters long with a minimum of 4 non-numeric characters. As with most password managers, there is no way to recover this master password if you lose it.

If you were already using some other method of password management, either in your browser or with another stand-alone password manager, you should import your data.

RoboForm supports imports from 1Password, Dashlane, LastPass, NIS, Xmarks, KeePass, Keeper, Enpass, Password Boss, Zoho Vault, True Key and Sticky Password, as well as generic CSV files. It will also import from any browser that supports the RoboForm extension on that platform, including on Chrome OS and Linux.

Finally, you can install RoboForm on the rest of your devices and your data will immediately sync between them as soon as you enter your RoboForm master password. 

RoboForm on the desktop

RoboForm gives you four different ways to access your account on the desktop: the standalone app, the browser extension, the menu bar and the website. The functionality is largely the same among the four, which is an improvement; the last time I reviewed RoboForm, the website was a read-only experience.

The standalone desktop app has the worst user interface and user experience of the four. There is nothing to it visually, with just the eight sections of the app displayed in the left column. 

If you click on a section, you get two additional columns with the relevant data to the right. The Security Center is the lone exception, as it has a slightly more modern tabbed interface. 

The standalone app is both sparse and often confusing, as there are few explanations for even the relatively limited features of the app. The ability to unlock the RoboForm desktop app using Touch ID on a Mac is nice (and you can also do this by double-clicking the side button on your Apple Watch), but until RoboForm modernizes the interface, you will be best served by ignoring the standalone app whenever possible and interacting with the service through any of the other three options.

The website interface is quite well done, with a modern interface at the top level that is far easier to use than the desktop app. All the important sections of the app are accessible here. While things get a little less pretty when you drill down — pop-up menus for adding new items look dated — everything worked as expected.

One thing you cannot do in the web app, or in the standalone app for that matter, is generate a new password. That must be done via the menu bar or browser extension, where it is prominently featured. The password generator works very well and offers extensive options to tweak the characteristics of the password, so I just don't understand why RoboForm fails to make it available everywhere.

Likewise, generation of one-time-use 2FA codes must be done in the RoboForm browser extension. 

Identities is where you add personal information used to auto-fill form fields. It includes fields that show RoboForm's age, such as "AOL Name" and "Pager," but the form-filling itself works well.

The Contacts section in RoboForm seems out of place, and it's so rudimentary that I can't imagine anyone using it. The Safenotes makes more sense, as many people would want some encrypted text, but turning this section into safe storage for any kind of file would vastly increase its utility.

Emergency Access lets you designate a friend or family member, using their email address, as someone who will be given access to your account in the event that you cannot access the account. You choose how long the Emergency Access contact needs to wait before getting access, and you can deny their access should you regain yours during that waiting period.

While the use case for Emergency Access is if you are either incapacitated or dead, it is also a potential lifesaver should you forget your master password. Emergency Access was at one time obscured in the RoboForm interface, with the menu bar being the only way to access it, but has since been brought into the browser extensions and been added to the primary navigation bar. 

Security Center is the final section. It audits the security level of your passwords and singles out any reused passwords. In May 2021, it began importing lists of compromised passwords from Have I Been Pwned, a non-profit online tracker of passwords and email addresses exposed in data breaches.

Next to every compromised password, RoboForm provides a link to the website in question so that you can quickly log in and change the password. 

RoboForm calculates password strength using the open-source tool Zxcvbn, which detracts points for dictionary entries, common names and common passwords. This is different from the quotas for lowercase letters, uppercase letters, digits and symbols (LUDS) that most password-strength estimators rely on. RoboForm claims Zxcvbn offers a more accurate depiction of how hard it would be to crack a given password.

RoboForm mobile apps

RoboForm has massively overhauled its mobile apps since the last time I reviewed them, and the apps now have a clean, modern look. Virtually everything from the desktop interface has made its way to mobile, and form-filling is now supported on both iOS and Android, making for a much more complete experience.

The apps, which are nearly identical between iOS and Android, display the four main sections across the bottom of the screen with Start, ID, Browser and Tools.

By default, you launch into the pinned section of the Start screen. You can pin any item in your vault here by just long-pressing it and tapping "pin." The other three sections in Start are Logins, Safenotes and All.

Everything is displayed in a grid view, with logos for websites when available. You can switch to a list view that puts logos on the left and text to the right. Tapping on a login will log you into that site immediately. 

The next section is ID, which contains all the content you would find in Identities on the desktop. It displays full-width rectangular grids with distinct graphics for the data types. If you have multiple identities set up, you can switch between them by tapping the name at the top of this screen, and you can set up a new identity here as well.

RoboForm's mobile browser is perfectly adequate. It displays a little red dot over the Form Fill button in the bottom right if you have relevant stored information available for the page you are viewing. But there's no reason to use it unless you're using an older version of iOS or Android that doesn't support form-filling in all browsers.

The final section is Tools, which contains the Password Generator, Sharing Center, Security Center and Emergency Access. Everything is well laid out and the icons are nicely done. 

RoboForm: Security

Like most password managers, RoboForm uses AES-256 encryption to secure your data on its servers. Your data is never decrypted unless it's by your master password on your own devices.

RoboForm has expanded its support for two-factor authentication. While you still can't use dedicated hardware, like a YubiKey, RoboForm now supports TOTP-based mobile authenticator apps such as Authy, Google Authenticator and Microsoft Authenticator. It also now has an authenticator of its own built right into the desktop browser extensions.

You can opt to receive a one-time password via email or SMS, but those are considerably easier than authenticator apps for a hacker to attack.

RoboForm review: Bottom line

RoboForm may not be able to go toe-to-toe with the top password managers on features, but it is among the most affordable password-manager options and is certainly the strongest in the sub-$25 a year range. 

Particularly in light of the redesigned website and vastly improved mobile apps, I think RoboForm is a viable choice for budget-conscious buyers that aren't particularly swayed by the higher-end features offered by the likes of LastPass, Keeper or Dashlane.

Updated to add new placement of Emergency Access and password generator, greater importing capabilities, Apple Watch application unlocking, and Edge browser-extension features. This review was originally posted in July 2020.