A password manager is one of those things that sounds like a luxury until the day someone gets into your Gmail and works their way through every account tied to it. And since most people reuse the same two or three passwords everywhere, that day tends to be expensive.
The problem on a budget phone is that some of these apps are genuinely heavy. Install the wrong one on a 2GB device and it lags every time you tap a login field, which means you stop using it within a week. So the picks below are all chosen for actually running well on modest hardware.
What Matters on a Cheap Phone
Four things, really.
Install size and memory use. Under 20MB is comfortable. Anything much heavier will fight for RAM with everything else you have open.
Offline access. Your passwords should open whether or not you have data left. Every app here works offline.
Autofill that works. If you have to open the app, search, copy and paste every single time, you’ll abandon it. Android’s autofill framework handles this properly, and all of these plug into it.
A free plan you can live on. Paying $3 a month for a password manager is a hard sell when the phone itself cost ₦100,000. Most people never need to upgrade, and the free tiers below are genuinely usable rather than crippled trials.
One more thing worth knowing in 2026: passkeys. They replace passwords entirely on sites that support them, using your fingerprint or screen lock instead. Bitwarden, Proton Pass and Google’s built-in manager all store them now, so you’re not locking yourself out of that shift by choosing a free option.
Start Here: Google Password Manager
Before installing anything, know that Android already has one built in. It lives inside Google Play Services, so it adds nothing to your storage, uses no extra memory, and works with autofill out of the box.
Find it at Settings, Google, Autofill, Google Password Manager. It stores passwords and passkeys, warns you about reused and breached ones, and syncs to Chrome on any other device you sign into.
The trade-off is that everything is tied to your Google account, so if you lose access to that, you lose the vault with it. It’s also awkward to use outside Chrome. But on a phone that’s genuinely struggling for space, it’s the right answer, and it’s infinitely better than reusing one password everywhere.
Since your Google account becomes the single point of failure here, make sure you can recover it. Our guide on what to do when Gmail asks for a recovery number you no longer own covers that.
1. Bitwarden
The safe recommendation for most people, and the one you’ll see suggested more than any other.
It’s open source, independently audited, and around 15MB installed. The free plan gives you unlimited passwords across unlimited devices, passkey storage, secure notes and Android autofill, which is unusually generous for something that costs nothing.
Two things to know about the current free tier. Built-in TOTP codes, file attachments and emergency access moved to the paid plan at the start of 2026, so the free version is passwords and passkeys rather than everything. And Premium pricing changed during 2026, so check their site for the current figure rather than relying on the $10 a year most articles still quote. For 2FA codes you’re better off with a separate app anyway, which is covered further down.
You can also self-host it if you know what you’re doing. Most people won’t, and don’t need to.
Best for: almost everyone. Start here unless you have a specific reason not to.
2. Proton Pass
Built by the Proton Mail team in Switzerland, and its free tier is arguably the strongest in the category right now.
You get unlimited passwords, unlimited devices and unlimited passkeys for free, plus ten hide-my-email aliases, which no other major manager bundles at zero cost. Those aliases are genuinely useful. You give a site a throwaway address that forwards to your real inbox, and if that site later starts spamming you or gets breached, you kill the alias instead of your email.
Same zero-knowledge, open-source, audited approach as Bitwarden. The app is a little more polished and a little heavier, though still comfortable on modest hardware. Paid plans start around $2 to $3 a month if you ever want more aliases.
Best for: anyone who wants the best free plan available, or who cares about keeping their real email address off random websites.
3. KeePassDX
Under 10MB, completely offline, and it doesn’t even request internet permission. Your vault is a file you own, in the standard KeePass format, stored wherever you decide.
There’s no account to create, no company holding your data, and nothing to sync unless you set it up yourself by putting the file in Google Drive or Dropbox. Encryption is AES or ChaCha20, and it’s open source and free with no paid tier at all.
The interface shows its age, and if you lose that file without a backup, the passwords are gone permanently. There’s no support line to call. That’s the deal you’re accepting in exchange for total control.
Best for: people who want their data on their own device and nowhere else, and who will actually keep backups.
4. Enpass
A middle ground between the cloud services and fully manual KeePass. Your vault stays local by default, and you choose whether to sync it through your own Google Drive, Dropbox or an SD card. There’s no Enpass account to create.
It supports biometric unlock, Android autofill, passkeys and AES-256 encryption, in a package around 20MB.
The catch is the free mobile tier caps you at 25 stored items, which most people pass fairly quickly. Premium runs roughly $24 a year, or around $100 for a lifetime licence. That lifetime option is the real appeal, since you pay once and never think about a subscription again.
Best for: people who want local control without the rough edges of KeePass, and who prefer paying once to paying monthly.
5. Zoho Vault
Built for teams but free for personal use, and under 20MB. AES-256 encryption, browser and app autofill, one-click login and access logs showing what happened in your vault and when.
Where it earns its place is password sharing. If you run a small business and need to give a staff member access to the shop’s Instagram without handing over the actual password, Zoho Vault does that cleanly, and you can revoke it later.
Best for: small business owners and anyone who shares logins with a team.
6. NordPass
From the NordVPN people, and the heaviest app here at roughly 40MB installed. It runs acceptably on phones with about 1.5GB of RAM upward, but it’s the first one I’d skip if your device is right at the bottom of the range.
It uses XChaCha20 encryption rather than AES-256, which is a modern and well-regarded choice, and the interface is the slickest of the free options. Password health monitoring flags weak and reused entries.
The limitation that matters: the free plan only keeps you logged in on one device at a time. Fine if the phone is all you use, annoying the moment you add a laptop. Paid plans start around $2 a month.
Best for: existing NordVPN subscribers, and one-device users who want the nicest interface.
7. Aegis Authenticator, for Your 2FA Codes
Not a password manager, and that’s exactly the point.
Aegis stores your two-factor authentication codes. It’s open source, around 8MB, works entirely offline, encrypts its vault with AES-256, and locks behind your fingerprint or PIN. Unlike Google Authenticator, you can export and back up your codes, which matters enormously if your phone is lost or stolen.
Keeping codes here rather than inside your password vault is deliberate. If everything sits in one app, then one breach hands over both your password and your second factor at the same time, which rather defeats the purpose of having two.
Use it alongside whichever manager you pick, especially for your Gmail, bank and fintech logins.
Quick Comparison
| App | Approx. size | Free plan | Encryption | Sync |
|---|---|---|---|---|
| Google Password Manager | Built in | Unlimited | Google account | Automatic |
| Bitwarden | ~15MB | Unlimited passwords and devices | AES-256 | Yes |
| Proton Pass | ~25MB | Unlimited, plus 10 email aliases | Zero-knowledge | Yes |
| KeePassDX | ~10MB | Everything, no paid tier | AES / ChaCha20 | Manual |
| Enpass | ~20MB | 25 items | AES-256 | Your own cloud |
| Zoho Vault | ~20MB | Free for personal use | AES-256 | Yes |
| NordPass | ~40MB | One device at a time | XChaCha20 | Yes |
| Aegis (2FA) | ~8MB | Everything, free | AES-256 | Manual backup |
Sizes shift with updates, so treat those as a guide rather than exact figures.
Getting Set Up Without Losing Everything
The master password is the whole thing. Make it long rather than complicated, since a phrase of four or five unrelated words beats a short string of symbols you’ll forget. Write it down on paper and keep it somewhere safe at home. Most of these services genuinely cannot recover it for you, which is the point, and also the risk.
Turn on biometric unlock so you’re not typing that master password twenty times a day, and set auto-lock to a few minutes so the vault closes itself if you put the phone down.
Then export a backup and store it somewhere other than the phone. This is the step people skip, and it’s the one that saves you when the phone goes missing. Speaking of which, our guide on what to do when your phone is lost or stolen in Nigeria is worth reading before you need it.
Don’t try to move every account at once either. Do your email first, then your bank and fintech apps, then social media, then everything else as you happen to log into it. Trying to do all of it in one sitting is how people give up halfway.
And stop letting Chrome save passwords once your manager is set up, otherwise you end up with two half-complete sets and no idea which is current. A few broader phone security habits are worth pairing with this.
If you want one answer: install Bitwarden, add Aegis for your 2FA codes, and change your Gmail password first. That combination runs on almost any Android phone, costs nothing, and covers the accounts that matter most.
