RoboForm review: A simple password manager with buried flaws | usagoldmines.com

The devil is in the details, and especially so for password managers. Services worth their salt have to nail the major basics. Good security and a friendly interface are non-negotiable minimums. And on this front, RoboForm ticks those boxes.

How a company delivers its experience separates the field, though. Feature lists add just a portion of weight to the scales; execution serves as counterbalance. And cost is yet another factor in the mix.

RoboForm stakes its position on the lighter end of the scale—fewer features with equally lower cost. And its high polish initially makes it an ideal fit for anyone seeking a simple, seamless experience. But if you poke at it, flaws appear, including those that quietly undermine RoboForm’s security.

Read on to learn more, then see our roundup of the best password managers for comparison.

RoboForm in brief

• Cost: $30 per year (annual rate)
• Family plan available? Yes ($48 per year, annual rate)
• Browsers: Chrome, Firefox, Edge
• Apps: Windows, Mac, Android, iOS
• Passwordless login: Yes
• Passkeys supported: Yes
• 2FA TOTP supported: Yes
• Account recovery possible? Yes

What are RoboForm’s plans and features?

RoboForm / PCWorld

RoboForm offers Free, Premium, or Family plans, with heavy restrictions on its free tier.

The Free plan is better thought of as an ongoing limited trial for RoboForm—though when you first sign up, you’ll get an actual 30-day trial of Premium. Making the downgrade after that first month all the more painful because of that initial taste of the full-fat experience.

To its credit, RoboForm allows unlimited saving of passwords and passkeys on the free plan, an increasing rarity among password managers. It also checks data leaks for your passwords and supports more advanced forms of two-factor authentication for login, including hardware keys (e.g., YubiKey). But you’re limited to just one device for use, with no web access.

Subscribing to the Premium tier opens up RoboForm’s full feature set, including its single standout feature. Its “local-only” mode is a rarity among password services these days, as most rivals have moved away from supporting offline apps. Your vault and your backups get saved only to your device.

The remaining Premium features are more usual. You can access your data from an unlimited number of devices (and the web), generate one-time (TOTP) codes for two-factor authentication on other services, set up emergency access for others to your account, and securely share items. RoboForm will also monitor data breaches for up to five email addresses. Email support around the clock (24/7) becomes available, too.

RoboForm platform support

RoboForm supports multiple platforms. In addition to browser extensions for Chrome, Firefox, and Edge, you can also download and install apps for Windows, Mac, iOS, and Android. 

Your first exposure will be through the browser extension if you sign up on the website—the sign up form pushes you to download it. To sign up via Windows app, you’ll have to download and install it first. You must download an app for offline access.

How does RoboForm perform?

For this review, I used RoboForm’s desktop app for Windows 11, browser extensions for Chrome and Firefox in Windows 11, and the Android app. I also looked briefly at the iOS app.

RoboForm sign-up

RoboForm’s sign-up process is fluid and fast—as long as you follow the typical flow. Most people will create an account by using the website, which points you to the browser extension. Install that and fill out the form, and you’re off to the races almost instantly. You can generate a passkey during account creation, too. Combined with RoboForm automatically enabling two-factor authentication for your account (via email), new users start with a strong level of security and convenience out the gate. The only missing piece? Passwordless-only login isn’t an option.

PCWorld

For advanced users, the sign-up process feels more convoluted. Download the Windows app as your starting point, and RoboForm will first push you to the browser extension for account creation or sign in. (On my test PC, which has several browsers installed, I had different windows popping into focus to auto-load tabs.) You also have to wait to enable more secure forms of two-factor authentication—to activate an authenticator app, passkey, or SMS, you have to dig into the settings. Most disappointing, you can’t start out the gate with local-only access.

The vast majority of RoboForm users will prefer the simplicity of the normal sign-up process. But for anyone hoping to dive straight into RoboForm’s most unique feature, the local-only data experience isn’t seamless.

Is it easy to import passwords into RoboForm?

RoboForm allows you to import passwords from your browser or another service, with good accuracy—and instant flagging of common weak passwords. For my sample set of imported passwords (about two dozen), saved to CSV, the data came through intact. RoboForm also immediately marked entries with bad passwords like “password” and “123456” with red warning symbols.

For direct importing, RoboForm can pull from LastPass, Bitwarden, Dashlane, 1Password, Keeper, NordPass, True Key, Enpass, Kaspersky, Proton Pass, and Myki. For all other services and apps, you can export to CSV and then import that file into RoboForm.

How easy is RoboForm’s interface to use?

Within the browser extension and mobile app, the layout of entries and settings feels intuitive. The look on Android may feel a bit plain, however.

PCWorld

In the browser extension, categories for your stored data and often-used features like a password generator and sharing options live in a left sidebar. The main window shows your saved entries for passwords and other items. You can access other settings in a drop-down menu by clicking on your account info in the upper-right of the screen.

The mobile apps take a similar approach, but with a top navigation bar under a search bar, and the entries within the main portion of the screen. Settings live within a three-dot menu at the top of the screen. Everything feels straightforward.

For both of these interfaces, capturing and filling in passwords for login pages and apps works well. Clicking on an entry will initiate the entire login process for many sites—no further input needed from you. It feels very smooth.

PCWorld

Power users will again run into minor headaches, however. For starters, RoboForm won’t allow the creation of manual entries for passwords without complete data. You must enter data into each field to save. For users who want to store a password without tying it to a website or user ID (without having to fill in extra nonsense or placeholder text), the option doesn’t exist.

The Windows app also feels more convoluted to use. RoboForm acknowledges that the user interface is more dated, which is fine—the layout is still clear. But the required tie-in with the browser extension feels cumbersome. Its one-click login won’t work unless the browser extension is installed, for example. You also can’t change any options for the Windows app.

And for local-only storage of your data, you’ll have to first change your sync settings before adding any data to your vault, if you truly want to keep everything offline from the start. Making the switch isn’t intuitive either. You have to uncheck the setting for automatic sync, which then opens a dialog box stating that you can manually synchronize with RoboForm’s servers. I disliked this approach; it could be much clearer. I would prefer a sync option for “Local storage only” and a message box that explains where the data is stored and how backups work. Such info would be more helpful to both less experienced and advanced users.

How well does RoboForm manage passwords and passkeys?

During daily use, RoboForm matches its best rivals in behavior. It smoothly fills in saved passwords and passkeys on recognized sites. For logins not yet saved, it asks to capture the details after you fill them in. You can also choose between two levels of autofill (automatic or suggested), or disable it all together. Creating logins feels slightly more manual but still is a smooth process.

By default, RoboForm generates passwords of 22 characters long, with a maximum of 512 characters. That maximum length is definitely among the highest available for creation, though at this point in time, just a wee bit of overkill. (Many sites that don’t offer two-factor authentication—one of the main reasons to use a very long password—have far shorter password length limitations.)

PCWorld

For organization, RoboForm offers folders for you to sort your entries into. Doing so from the browser extension and web interface requires first selecting All from the left navbar, then clicking on the plus symbol. In contrast to other features, the Windows app is the most straightforward for finding the option to make new folders. (The icon is visible at all times.)

How easy is it to share passwords in RoboForm?

You can share individual items and whole folders with other RoboForm users. Accessing the Sharing Center hub will show the items you’ve shared (if you’re a paid subscriber), as well as those that have been shared with you (all users).

If you share an entry or folder with another user who hasn’t yet signed up for RoboForm, you’ll be notified that they will be required to create an account. Accepting these terms will send an invite to the email you’ve entered. Users signing up for RoboForm to see your shared entries must verify their email addresses before they’ll see the items. But confusingly, they can accept the pending shares before verification.

PCWorld

(Tip: If the person you’ve shared with can’t see any of those entries, and can’t recall if they performed email verification yet, have them create a login and then try to share it with you to trigger the verification process.)

When sharing folders, you have the option of three permission levels: Log In Only, Read and Write, and Full Control. Choosing Read and Write allows others to edit the entries, while Full Control lets the other users control permissions and sharing.

What else does RoboForm let me do?

Through Emergency Access, you can designate other RoboForm users allowed to access your saved credentials, notes, and identities. This feature allows friends, family, and/or other trusted individuals to use your accounts if you’re incapacitated, deceased, or otherwise unavailable.

If your emergency contact accepts the invitation, they can import your saved data to their account after making a request. Anyone with immediate access will instantly gain access. For other waiting periods (ranging from 12 hours to 30 days), you will receive a notification allowing you to grant, deny, or wait on deciding your permission. If you do not take action, your contact will automatically gain access to your vault.

You can change the length of the waiting period or revoke access at any time. The latter option keeps the link between your account and theirs, but they’ll have to request access to your data. You can also remove the emergency contact all together.

When I tested this feature, permissions changed instantly. Request notifications were inconsistent in timing for when they appeared, though mostly prompt.

PCWorld

How is RoboForm’s security and privacy?

RoboForm encrypts data using AES256 bit encryption with PBKDF2 SHA256, with a default of 100,000 iterations. This default makes RoboForm less secure than popular rivals like Bitwarden and 1Password, which use 600,000 and 650,000 iterations (respectively)—a number based on the Open Worldwide Application Security Project’s current recommendations. 

Even LastPass now sets its default to 600,000—a move it eventually took after being lambasted for its low iterations. (This lapse in increasing iterations on all accounts is likely a strong contributing factor to hackers successfully breaking into user accounts after stealing LastPass vault data.)

A higher number of iterations increases the difficulty for a hacker to crack the protection on your saved, encrypted passwords, should that data ever get leaked or stolen. You should manually increase this number higher, ideally to at least 600,000.

If for some reason you own a device so old that it can’t decrypt your data in a timely fashion, you can reduce the number of iterations back down, but even a semi-modern PC or phone should be able to handle this current standard.

PCWorld

Another oversight is the inability to set an automatic period for clearing your PC’s clipboard if you copy a password via the Windows app, a browser extension, or the web interface. Only the mobile apps let you choose to clear the clipboard. (You cannot set the length of time, however.)

RoboForm shines much brighter when it comes to checking passwords for any obvious weak or compromised passwords. It instantly flagged the egregious examples I added to entries in my vault (e.g., password). The Data Breach Monitoring wasn’t as proficient in its screening—it flagged only a few breaches for an email account that’s been part of many more leaks.

While slightly disappointing, I never trust these two types of features completely—the number of data leaks and breaches generally exceeds the ability for a single service to accurately catch every vulnerable password or service, much less quickly. But RoboForm is a decent addition to an overall network of different services and methods that keep you apprised about compromised info.

Is RoboForm worth it?

For people who want to never think about online security, RoboForm can provide an extremely seamless experience. Its interface has thoughtful polish, obviously designed to take the burden off people who find password management cumbersome.

But you can’t completely shut off your brain and lean on RoboForm. I dislike that all users should immediately adjust their encryption iteration settings upon account creation—someone who hates thinking about password security won’t know to check this setting, much less make the change reflexively. I have a similar opinion about the lack of clipboard clearing if you ever copy a password within Windows—people seeking a simple experience won’t think to manually clear their clipboards.

Meanwhile, advanced users should look elsewhere for a better experience. The interface on PC can become almost confusing if you use the desktop app, given the bouncing between the program and the browser extension. The local-only experience feels similarly clumsy, too.

For its price, RoboForm could be the right match if you like its easy interface and can accommodate its weaknesses. However, you could also pay about the same for a rival that has plans with richer features, less hidden clunkiness, and stronger security out the gate.