Back in the days before television, entertainers traveled from village to village bringing the townspeople unusual experiences.
Animals they'd never seen before, perhaps, or the strongest man around, or a mentalist who could remember absolutely anything.
That mentalist, now retired, doesn't need a password manager, but everyone else does.
For proper security, you must use a different strong password for every website, and nobody but a circus freak can remember those unaided.
Password Boss takes on the job of remembering and supplying all your passwords, and syncs them across your Windows, Android, and iOS devices.
New since my last review is macOS support.
In addition to handling all expected password management tasks, Password Boss comes with secure sharing, password inheritance, and other advanced features.
Like Keeper, Dashlane, and others, Password Boss is free to use on a single device.
In the modern multi-device world, that's a strong limitation, enough that I don't review this product as a free password manager.
Password Boss' premium edition, reviewed here, costs $29.99 per year, the same as Keeper and Sticky Password Premium.
Dashlane is quite a bit higher, at $59.99 per year, and LastPass recently went up to $36 per year.
You can also get a five-license Password Boss family pack for $69.99 per year.
The program's main window has a left-rail menu of important functions, with the rest of the space devoted to displaying your saved passwords, either as a list or as tiles.
You can choose to order the list alphabetically or by several date possibilities such as date last used or date of creation.
If you've chosen to organize your passwords into folders, you can select a tree-like folder display.
Don't miss the standard Windows menu across the top—this is where you find functions like backup and import/export.
Getting Started
Password Boss downloads and installs very quickly.
With the product installed, you enter an email address and a master password to create your account.
Password Boss requires that the master contain at least eight characters, using all four character types.
To me, that's not enough.
I recommend using mnemonic techniques to create a master password that's long, but memorable.
You can enter your license key or continue installing the free edition.
Note that even free users get 30 days of full premium features.
Like Keeper, RememBear Premium, LogMeOnce, and some other competitors, Password Boss goes to great lengths to get you started successfully.
Its onboarding process starts by asking for simple address information, which feeds into the form-filling system.
A series of tips explains features, such as password capture and replay, secure sharing, and inheritance, and helps you install the browser extension.
The first time you start Password Boss during each session, it displays a list of five important steps: Create an account; Save a password; Save a secure note; Create your identity; and Setup emergency access.
You can un-check a box to get rid of this reminder, but I suggest you get rid of it the better way, by accomplishing all five steps.
As part of the syncing process, Password Boss keeps an encrypted cloud backup of your data.
In an unusual move, it lets you choose to store that backup in any of eleven server locations: US East, US West, Frankfurt, Ireland, London, Montreal, Singapore, Sydney, Tokyo, Seoul, and Sao Paulo.
London and Montreal are new since my last review.
No matter what the location, Password Boss can't access your encrypted data even if enjoined to do so by the government.
However, if you're paranoid about security, you might consider selecting a server in a country subject to the EU's General Data Protection Regulation (GDPR).
Import and Export
Getting all of your passwords safely recorded in a password manager can be a chore, as can switching to a different password manager.
LastPass and 1Password both support import from more than 30 competing products, for example.
Password Boss doesn't offer as much help for those jumping ship from another product.
It can import from LastPass, Dashlane, and RoboForm Everywhere, as well as a handful of other competitors.
You can move over from almost any competing product using a properly-formed CSV, but it's always easier when your new password manager directly supports import from the old one.
Password Boss can also import passwords from your browsers, where they're stored less securely.
Specifically, it imports from Chrome, Edge, Firefox, Internet Explorer, and Opera (but not Safari).
Don't forget to delete passwords from the browser and turn off its password capture features.
New since my last review, Password Boss can export your password collection to a PDF or text file.
Don't leave those files lying around; they expose all your passwords.
Print the list and put it in a lockbox, or encrypt the file, then securely delete the plain-text original.
You can also export to the program's own encrypted proprietary format.
Password Capture and Replay
During the initial onboarding process, Password Boss helps you install its browser extension, which it calls a Browser Button, in your default browser.
If you launch a browser that lacks the extension, Password Boss offers to install it.
You can also click Browser Buttons from the menu and install it for all your browsers.
Password Boss supports Chrome, Internet Explorer, Firefox, Edge, Opera, Safari (on Mac), and (unusually) Vivaldi.
As expected, when you log in to a secure site Password Boss offers to save your credentials.
At this time, you can give the entry a friendly name, or assign it to an existing folder.
Like LastPass Premium, RoboForm, and Sticky Password, Password Boss lets you nest folders.
It also rates the strength of the captured password.
If you have any trouble with the password capture process, Password Boss offers another way to get your credentials recorded.
When you click the Password Boss owl icon in a username or password field, it offers to either save your login data or create a new password.
After you submit your credentials, it both saves them and logs you in.
Keeper Password Manager & Digital Vault works in much the same way, except that you always need to click its icon.
When you revisit a site for which you've saved credentials, Password Boss automatically fills in those credentials and logs you in.
I found that when I tried to log out of a site, Password Boss logged me back in immediately.
The only way I could enter a second login for the same site was to go into the main program, edit the saved item, and disable Autofill.
Once I managed to create multiple logins for a single site, I found that clicking the owl icon brings up a menu of available logins.
I ran into a couple snags in testing.
On the EventBrite site, Password Boss didn't capture my login, and when I tried the manual process it seemed to get stuck.
No matter how many times I clicked Save, the floating window didn't go away.
Later, I learned that every click on the Save button created an entry for EventBrite.
Password Boss also didn't capture the login for my local library—understandable given that the page uses totally non-standard field names.
I checked in with tech support.
The agent confirmed that EventBrite needs special handling, and that the login page had changed enough to require an update by Password Boss.
Fixing access took the agent just a few minutes.
As soon as my local program synced with the cloud, Password Boss worked on both problem sites.
Clicking the browser extension's toolbar button brings up a display of all your saved logins.
It's like a miniature version of the main window.
You can switch to folder view if you like, or type in the search box.
As with Sticky Password Premium and a few others, the list narrows to include matching entries with each letter you type.
My company contact flagged improved handling of password change operations as a new feature, and indeed, the process went very smoothly.
Password Boss also captures credentials when you sign up for a new account, with an option to generate a strong password automatically.
Password Generator
When you're signing up for a new account, or updating a weak password to a new, stronger one, Password Boss automatically offers its built-in random password generator.
New since my last review, you can also invoke the password generator any time you wish from the notification tray icon menu or the product's Tools menu.
I was pleased to see that it generates 20-character passwords by default, using all character types.
That 20 character default used to also be the maximum; now you can crank password length up to 40 if you wish.
Sticky Password and 1Password also default to 20 characters, and F-Secure Key goes for massive 32-character passwords by default.
At the other end of the spectrum, Trend Micro defaults to generating eight-character passwords, and Password Genie uses just 10.
If your password manager defaults to anything shorter than 16, crank up the length.
You don't have to remember them, so they might as well be long!
Two-Factor Authentication
One of the five recommended startup steps for Password Boss involves turning on two-factor authentication.
Without this feature, anybody who got hold of your master password could get full access to your account, and you really don't want that.
With two-factor authentication enabled, login requires both something you know (the master password) and, in this case, something you have (an authentication app).
Like many competing products, Password Boss relies on Google Authenticator for two-factor authentication.
You can also use a Google Authenticator work-alike, such as Duo Mobile or Twilio Authy.
Install the app on your smartphone, snap the QR code displayed by Password Boss, and you're ready to go.
Well, almost.
To keep you from getting locked out if you lose your mobile device, Password Boss prompts for an alternate phone number to receive an emergency key.
It also presents you with a one-time unlock code to disable two-factor; keep that code safe!
Now, after entering your master password, you'll also enter a six-digit code generated by the authenticator.
If you like, you can configure it to only require this second factor every 30 days on trusted devices.
Even if you don't choose two-factor authentication, adding a new device requires entry of a code sent to your email account.
The free Myki Password Manager & Authenticator deserves special mention.
Myki stores your passwords on your mobile device, not in the cloud, so by default it requires two factors.
If you don't have the device and either the security PIN or a registered fingerprint, you can't get in.
In addition, Myki serves as a Google Authenticator equivalent, automatically entering codes for sites that require them.
LastPass, an Editors' Choice for free password managers, offers several choices for two-factor authentication, ranging from Google Authenticator to a simple printed authentication grid.
Paying customers can authenticate with certain smart cards, or with a Yubikey.
Dashlane and Keeper, among others, support the more advanced FIDO U2F (Universal Two-Factor) standard, backed by Yubico, Google, and Microsoft, among others.
Clearly there are many options for two-factor authentication; any of them significantly increase your account's security.
Organizing Passwords
As I mentioned, you can assign a password to an existing folder at the time Password Boss captures it.
To create new folders, you must use the full Password Boss application.
You can create as many folders as you want, and, as with LastPass, RoboForm, and a few others, you can nest folders inside each other.
In addition, you can drag and drop items into folders, a handy feature.
Like Dashlane and LastPass, Password Boss offers two views of passwords.
The tile view packs the most items into one screenful, but the list view lets you see a bit more information about each saved item.
Security Dashboard
At the bottom of the password list, a prominent panel displays your security score.
If every password is strong and unique, you'll score 100 percent.
Any weak or duplicate passwords drag down that score, as will passwords that Password Boss considers to be old, meaning they haven't been changed for three months.
Clicking the security score brings up a full report, including duplicate, weak, old, and compromised passwords.
Dashlane, Keeper, LastPass, and a few others give you a full-scale actionable security report showing all passwords ordered by strength.
I prefer that to the Password Boss report, which only flags the weakest passwords.
Dashlane, LastPass, and LogMeOnce Password Management Suite Ultimate can automate the process of changing a site's password, going on line as your proxy, making the change, and recording the new password.
Keeper eschews this capability on the basis that it's not Zero Knowledge, but does make the manual update process smooth.
With Password Boss, when you click Update it simply displays instructions and offers assurance that it will record the update.
Password Boss now includes a full Security Dashboard, reached from the left-rail menu.
This page summarizes the security score report and displays a pie chart identifying the types of data you've stored with Password Boss.
More importantly, it includes buttons to scan the Dark Web for possible compromises.
Clicking for a password scan runs your passwords through the Have I Been Pwned website, to see if any of them have turned up in Dark Web data dumps.
Seeing bad passwords like 123456 flagged isn't meaningful, but if something like yo#edEQSY5KYrYx6 shows up, you've got trouble.
Password Boss can also scan the Dark Web to see if your email address turns up.
Note that any site, anywhere, might have a list that contains your email address, even if you never visited.
If you have an account at the compromised site, that's a bigger worry.
You can check as many email addresses as you like.
A few other password managers use this same site to check for compromise, among them Avira, 1Password, and SaferPass.
Personal Info Four Ways
Like many other password managers, Password Boss can fill in personal and financial data on web forms, saving you the aggravation of typing your details over and over.
This form-filling ability manifests as four items on the menu: Digital Wallet, Secure Notes, Personal Info, and Identities.
It's important to understand how these categories...
