RoboForm overview: A easy password supervisor with buried flaws

The satan is within the particulars, and particularly so for password managers. Providers value their salt must nail the main fundamentals. Good safety and a pleasant interface are non-negotiable minimums. And on this entrance, RoboForm ticks these packing containers.

How an organization delivers its expertise separates the sector, although. Characteristic lists add only a portion of weight to the scales; execution serves as counterbalance. And value is one more issue within the combine.

RoboForm stakes its place on the lighter finish of the size—fewer options with equally decrease price. And its excessive polish initially makes it a great match for anybody looking for a easy, seamless expertise. However should you poke at it, flaws seem, together with those who quietly undermine RoboForm’s safety.

Learn on to study extra, then see our roundup of the most effective password managers for comparability.

RoboForm in short

• Value: $30 per yr (annual charge)
• Household plan accessible? Sure ($48 per yr, annual charge)
• Browsers: Chrome, Firefox, Edge
• Apps: Home windows, Mac, Android, iOS
• Passwordless login: Sure
• Passkeys supported: Sure
• 2FA TOTP supported: Sure
• Account restoration doable? Sure

What are RoboForm’s plans and options?

RoboForm affords Free, Premium, or Household plans, with heavy restrictions on its free tier.

The Free plan is healthier regarded as an ongoing restricted trial for RoboForm—although whenever you first join, you’ll get an precise 30-day trial of Premium. Making the downgrade after that first month all of the extra painful due to that preliminary style of the full-fat expertise.

To its credit score, RoboForm permits limitless saving of passwords and passkeys on the free plan, an rising rarity amongst password managers. It additionally checks information leaks on your passwords and helps extra superior types of two-factor authentication for login, together with {hardware} keys (e.g., YubiKey). However you’re restricted to only one machine to be used, with no internet entry.

Subscribing to the Premium tier opens up RoboForm’s full function set, together with its single standout function. Its “local-only” mode is a rarity amongst password companies today, as most rivals have moved away from supporting offline apps. Your vault and your backups get saved solely to your machine.

The remaining Premium options are extra standard. You may entry your information from a limiteless variety of units (and the net), generate one-time (TOTP) codes for two-factor authentication on different companies, arrange emergency entry for others to your account, and securely share gadgets. RoboForm may also monitor information breaches for as much as 5 electronic mail addresses. E-mail help across the clock (24/7) turns into accessible, too.

RoboForm platform help

RoboForm helps a number of platforms. Along with browser extensions for Chrome, Firefox, and Edge, you may also obtain and set up apps for Home windows, Mac, iOS, and Android. 

Your first publicity can be by way of the browser extension should you join on the web site—the join type pushes you to obtain it. To enroll by way of Home windows app, you’ll must obtain and set up it first. You could obtain an app for offline entry.

How does RoboForm carry out?

For this overview, I used RoboForm’s desktop app for Home windows 11, browser extensions for Chrome and Firefox in Home windows 11, and the Android app. I additionally appeared briefly on the iOS app.

RoboForm sign-up

RoboForm’s sign-up course of is fluid and quick—so long as you comply with the standard circulate. Most individuals will create an account through the use of the web site, which factors you to the browser extension. Set up that and fill out the shape, and also you’re off to the races nearly immediately. You may generate a passkey throughout account creation, too. Mixed with RoboForm mechanically enabling two-factor authentication on your account (by way of electronic mail), new customers begin with a robust degree of safety and comfort out the gate. The one lacking piece? Passwordless-only login isn’t an choice.

PCWorld

For superior customers, the sign-up course of feels extra convoluted. Obtain the Home windows app as your place to begin, and RoboForm will first push you to the browser extension for account creation or check in. (On my check PC, which has a number of browsers put in, I had completely different home windows popping into focus to auto-load tabs.) You even have to attend to allow safer types of two-factor authentication—to activate an authenticator app, passkey, or SMS, it’s important to dig into the settings. Most disappointing, you may’t begin out the gate with local-only entry.

The overwhelming majority of RoboForm customers will want the simplicity of the traditional sign-up course of. However for anybody hoping to dive straight into RoboForm’s most unusual function, the local-only information expertise isn’t seamless.

Is it simple to import passwords into RoboForm?

RoboForm means that you can import passwords out of your browser or one other service, with good accuracy—and on the spot flagging of frequent weak passwords. For my pattern set of imported passwords (about two dozen), saved to CSV, the information got here by way of intact. RoboForm additionally instantly marked entries with unhealthy passwords like “password” and “123456” with pink warning symbols.

For direct importing, RoboForm can pull from LastPass, Bitwarden, Dashlane, 1Password, Keeper, NordPass, True Key, Enpass, Kaspersky, Proton Cross, and Myki. For all different companies and apps, you may export to CSV after which import that file into RoboForm.

How simple is RoboForm’s interface to make use of?

Inside the browser extension and cellular app, the structure of entries and settings feels intuitive. The look on Android might really feel a bit plain, nonetheless.

PCWorld

Within the browser extension, classes on your saved information and often-used options like a password generator and sharing choices dwell in a left sidebar. The primary window reveals your saved entries for passwords and different gadgets. You may entry different settings in a drop-down menu by clicking in your account information within the upper-right of the display.

The cellular apps take an identical method, however with a high navigation bar beneath a search bar, and the entries inside the principle portion of the display. Settings dwell inside a three-dot menu on the high of the display. Every thing feels simple.

For each of those interfaces, capturing and filling in passwords for login pages and apps works properly. Clicking on an entry will provoke your complete login course of for a lot of websites—no additional enter wanted from you. It feels very easy.

PCWorld

Energy customers will once more run into minor complications, nonetheless. For starters, RoboForm received’t permit the creation of guide entries for passwords with out full information. You could enter information into every subject to save lots of. For customers who wish to retailer a password with out tying it to a web site or person ID (with out having to fill in further nonsense or placeholder textual content), the choice doesn’t exist.

The Home windows app additionally feels extra convoluted to make use of. RoboForm acknowledges that the person interface is extra dated, which is ok—the structure remains to be clear. However the required tie-in with the browser extension feels cumbersome. Its one-click login received’t work until the browser extension is put in, for instance. You can also’t change any choices for the Home windows app.

And for local-only storage of your information, you’ll must first change your sync settings earlier than including any information to your vault, should you really wish to maintain the whole lot offline from the beginning. Making the swap isn’t intuitive both. You must uncheck the setting for computerized sync, which then opens a dialog field stating you can manually synchronize with RoboForm’s servers. I disliked this method; it might be a lot clearer. I would favor a sync choice for “Native storage solely” and a message field that explains the place the information is saved and the way backups work. Such information can be extra useful to each much less skilled and superior customers.

How properly does RoboForm handle passwords and passkeys?

Throughout every day use, RoboForm matches its greatest rivals in habits. It easily fills in saved passwords and passkeys on acknowledged websites. For logins not but saved, it asks to seize the main points after you fill them in. It’s also possible to select between two ranges of autofill (computerized or steered), or disable all of it collectively. Creating logins feels barely extra guide however nonetheless is a easy course of.

By default, RoboForm generates passwords of twenty-two characters lengthy, with a most of 512 characters. That most size is certainly among the many highest accessible for creation, although at this cut-off date, only a wee little bit of overkill. (Many websites that don’t supply two-factor authentication—one of many essential causes to make use of a really lengthy password—have far shorter password size limitations.)

PCWorld

For group, RoboForm affords folders so that you can kind your entries into. Doing so from the browser extension and internet interface requires first choosing All from the left navbar, then clicking on the plus image. In distinction to different options, the Home windows app is essentially the most simple for locating the choice to make new folders. (The icon is seen always.)

How simple is it to share passwords in RoboForm?

You may share particular person gadgets and complete folders with different RoboForm customers. Accessing the Sharing Middle hub will present the gadgets you’ve shared (should you’re a paid subscriber), in addition to these which were shared with you (all customers).

For those who share an entry or folder with one other person who hasn’t but signed up for RoboForm, you’ll be notified that they are going to be required to create an account. Accepting these phrases will ship an invitation to the e-mail you’ve entered. Customers signing up for RoboForm to see your shared entries should confirm their electronic mail addresses earlier than they’ll see the gadgets. However confusingly, they will settle for the pending shares earlier than verification.

PCWorld

(Tip: If the individual you’ve shared with can’t see any of these entries, and might’t recall in the event that they carried out electronic mail verification but, have them create a login after which attempt to share it with you to set off the verification course of.)

When sharing folders, you’ve the choice of three permission ranges: Log In Solely, Learn and Write, and Full Management. Selecting Learn and Write permits others to edit the entries, whereas Full Management lets the opposite customers management permissions and sharing.

What else does RoboForm let me do?

By Emergency Entry, you may designate different RoboForm customers allowed to entry your saved credentials, notes, and identities. This function permits mates, household, and/or different trusted people to make use of your accounts should you’re incapacitated, deceased, or in any other case unavailable.

In case your emergency contact accepts the invitation, they will import your saved information to their account after making a request. Anybody with fast entry will immediately acquire entry. For different ready durations (starting from 12 hours to 30 days), you’ll obtain a notification permitting you to grant, deny, or wait on deciding your permission. If you don’t take motion, your contact will mechanically acquire entry to your vault.

You may change the size of the ready interval or revoke entry at any time. The latter choice retains the hyperlink between your account and theirs, however they’ll must request entry to your information. It’s also possible to take away the emergency contact all collectively.

Once I examined this function, permissions modified immediately. Request notifications had been inconsistent in timing for once they appeared, although largely immediate.

PCWorld

How is RoboForm’s safety and privateness?

RoboForm encrypts information utilizing AES256 bit encryption with PBKDF2 SHA256, with a default of 100,000 iterations. This default makes RoboForm much less safe than in style rivals like Bitwarden and 1Password, which use 600,000 and 650,000 iterations (respectively)—a quantity primarily based on the Open Worldwide Software Safety Mission’s present suggestions. 

Even LastPass now units its default to 600,000—a transfer it will definitely took after being lambasted for its low iterations. (This lapse in rising iterations on all accounts is probably going a robust contributing issue to hackers efficiently breaking into person accounts after stealing LastPass vault information.)

The next variety of iterations will increase the problem for a hacker to crack the safety in your saved, encrypted passwords, ought to that information ever get leaked or stolen. You must manually improve this quantity increased, ideally to at the very least 600,000.

If for some motive you personal a tool so outdated that it could possibly’t decrypt your information in a well timed trend, you may cut back the variety of iterations again down, however even a semi-modern PC or telephone ought to have the ability to deal with this present normal.

PCWorld

One other oversight is the lack to set an computerized interval for clearing your PC’s clipboard should you copy a password by way of the Home windows app, a browser extension, or the net interface. Solely the cellular apps allow you to select to clear the clipboard. (You can’t set the size of time, nonetheless.)

RoboForm shines a lot brighter with regards to checking passwords for any apparent weak or compromised passwords. It immediately flagged the egregious examples I added to entries in my vault (e.g., password). The Knowledge Breach Monitoring wasn’t as proficient in its screening—it flagged just a few breaches for an electronic mail account that’s been a part of many extra leaks.

Whereas barely disappointing, I by no means belief these two forms of options utterly—the variety of information leaks and breaches typically exceeds the power for a single service to precisely catch each weak password or service, a lot much less shortly. However RoboForm is a good addition to an total community of various companies and strategies that maintain you apprised about compromised information.

Is RoboForm value it?

For individuals who wish to by no means take into consideration on-line safety, RoboForm can present an especially seamless expertise. Its interface has considerate polish, clearly designed to take the burden off individuals who discover password administration cumbersome.

However you may’t utterly shut off your mind and lean on RoboForm. I dislike that each one customers ought to instantly regulate their encryption iteration settings upon account creation—somebody who hates enthusiastic about password safety received’t know to test this setting, a lot much less make the change reflexively. I’ve an identical opinion in regards to the lack of clipboard clearing should you ever copy a password inside Home windows—individuals looking for a easy expertise received’t assume to manually clear their clipboards.

In the meantime, superior customers ought to look elsewhere for a greater expertise. The interface on PC can change into nearly complicated should you use the desktop app, given the bouncing between this system and the browser extension. The local-only expertise feels equally clumsy, too.

For its value, RoboForm might be the proper match should you like its simple interface and might accommodate its weaknesses. Nevertheless, you would additionally pay about the identical for a rival that has plans with richer options, much less hidden clunkiness, and stronger safety out the gate.