VPN vs password manager: which one you need first, and what neither will do

Tool reviews. Updated 2026-09-13. About 5 minutes to read.

Set up a password manager first and replace reused passwords, then add a trustworthy VPN if you need to hide browsing from your network or internet provider.

Some links on this page are affiliate links, and we may earn a commission at no extra cost to you.

For most people, a password manager comes first. Stolen and reused passwords are the most common way into accounts: Verizon's 2025 Data Breach Investigations Report found that compromised credentials were the initial access route in 22 percent of breaches it reviewed. A VPN does nothing about that. It solves a different problem: who can see which sites you connect to on the network you are using.

Both tools are useful and they do not overlap much. This guide explains what each actually protects, the gaps both leave, and how to decide what to set up this week.

What each tool actually does

A password manager creates a different strong password for every account, stores them in an encrypted vault, and fills them in only on the site where they were saved. It fixes password reuse, which is what lets one breach unlock many accounts, and it resists lookalike phishing pages because it will not autofill on the wrong domain.

A VPN sends your internet traffic through an encrypted tunnel to the VPN provider's server. Websites see the VPN's IP address instead of yours, and your internet provider or the Wi-Fi operator sees only that you are connected to a VPN. You are moving trust from your internet provider to the VPN company, which can see the same things your provider used to.

What a VPN does not protect you from

Phishing. A fake login page works just as well over a VPN.
Weak or reused passwords, and breaches at the companies that hold your data.
Tracking when you log in. Once you sign in to Google, Amazon or Facebook, they know who you are regardless of your IP address.
Cookies, tracking pixels and browser fingerprinting, which identify you without your IP address.
Malware and infostealers already on your device.
Data brokers and people search sites, which get your details from records and purchases, not your connection.

Most websites already use HTTPS, which encrypts the content of your traffic. On public Wi-Fi, a VPN mainly adds hiding which sites you visit from the network operator, rather than protecting passwords that HTTPS already encrypts.

What a password manager does not protect you from

Malware on your device that captures what you type or steals unlocked browser sessions.
Approving a fake sign in prompt or reading a one time code to a scammer.
A weak master password, or one reused elsewhere.
Accounts that still use SMS codes, which remain exposed to SIM swaps.
Anything about your network traffic, IP address or browsing history.

Which to set up first

You reuse passwords anywhere, or cannot remember which sites share a password: password manager first.
You have had an account taken over or your email appears in breaches: password manager first, plus two factor authentication.
You regularly use hotel, airport or cafe Wi-Fi for work: both, with the password manager first.
You want to hide browsing from your internet provider or a shared household network: VPN.
You travel to countries that block services you rely on: VPN, chosen carefully.
You want to avoid tracking by advertisers: neither on its own. Use tracker blocking and privacy settings, covered in our targeted ads guide.

Set up a password manager in an afternoon

Choose a reputable manager with independent security audits. Bitwarden and Proton Pass have free tiers, and paid options such as 1Password and Dashlane add family sharing and extras.
Create a long master passphrase of four or more random words, and turn on two factor authentication for the manager itself.
Import passwords saved in your browser, then turn off the browser's own password saving so you have one source of truth.
Change the password on your primary email account first, then banking, then shopping and social accounts.
Run the manager's security report and fix every reused or breached password over the following week.

Choosing a VPN without being sold a story

Look for WireGuard or OpenVPN protocols. Avoid PPTP, which is broken.
Prefer providers that publish independent audits of their no logs claims. A privacy policy alone is a promise, not proof.
Avoid free VPN apps from unknown developers. If you are not paying, the business model is often your data or ad injection.
Check for a kill switch that blocks traffic if the VPN drops.
Ignore claims of military grade encryption or total anonymity. No VPN makes you anonymous.
Prices change often and introductory discounts can renew at a much higher price, so check the provider's site before paying.

Bundles: when one subscription covering both makes sense

Security suites and privacy bundles often include both a VPN and a password manager. That can be good value if you would use both, but check the details. Bundled password managers sometimes lack family sharing, passkey support or easy export, and bundled VPNs may limit devices or locations.

Before committing, confirm you can export your passwords in a standard format. Your vault should never be locked to a subscription you might cancel.

Frequently asked questions

Does a VPN protect my passwords?

Only from someone watching the network, and HTTPS already does that for most sites. A VPN does not stop phishing, password reuse or breaches at the sites you use, which is how most passwords are actually stolen.

Does a password manager hide my IP address or browsing?

No. A password manager only stores and fills in credentials. Your internet provider and the sites you visit see the same traffic as before.

Is a VPN still necessary on public Wi-Fi in 2026?

It is less critical than it was, because most sites use HTTPS. It still hides which sites you visit from the network operator and protects apps that handle traffic poorly. Treat it as useful rather than essential, and never as a substitute for strong unique passwords.

Can a password manager itself be hacked?

Providers can be breached, as LastPass was in 2022 when encrypted vault backups were stolen. Well designed managers encrypt vaults with your master password, which the provider never has, so the strength of that password is what protects you. Choose an audited provider and a long, unique passphrase.

Which is more important for privacy, a VPN or a password manager?

For protecting accounts and personal data, the password manager, because credential theft is the leading cause of account takeover. For hiding browsing from your internet provider or local network, the VPN. Most people benefit from starting with the password manager.