RoboForm Review: Form Master Turned Security Pro

12/5/2022 - Correction: An earlier version of this article stated that RoboForm only worked on mobile from within RoboForm's browser. While you can use RoboForm's browser, it is not required to use the password manager on mobile.

Are you using a browser to save your passwords? It’s not as safe as you think. An independent password manager, such as RoboForm, is a more secure way to keep your login information safe from hackers.

RoboForm started out as form-filling software and later grew into a full-fledged password manager with both free and paid plans for individuals and families. It has strong encryption and a robust, secure password generator to make your online presence safer. It works great on a computer, but the mobile experience is still a little clunky.

When you first sign up, you’ll be given a free trial of the company's premium Everywhere Plan. This perk is unlisted, but is needed to set up your mobile device without having to start from scratch.

There’s no need to whip out your credit card, unless you want to enter its info in the secure vault — you’ll only be asked to pay for the premium level once your free trial runs out. You can also keep using RoboForm’s free level as long as you like.

RoboForm Specifications

Price and Coverage with RoboForm

RoboForm has three plans: Free, Everywhere, and Everywhere Family.

The Free level is for one user, with limited features to keep your online presence safe and secure. It saves unlimited passwords locally, but does not allow you to sync them across multiple devices, such as your phone and PC.

RoboForm logs you into websites with one click from its app and captures passwords while you surf the web. It also has an import and export feature, so you can import your passwords from browsers and other password managers you might have used before.

You can save your credit card information with RoboForm so you don’t have to stop and fetch your wallet while shopping. Need to save other types of text information, such as Wi-Fi passwords or software license keys? RoboForm includes a safe notes feature for securely storing random bits of information.

The best part of RoboForm is the random password generator, which is easy to access from your browser toolbar. The password generator’s default passwords have 16 characters with upper and lowercase letters, numbers, and symbols.

The Everywhere level costs $23.88 per year, with discounts if you purchase three or five years in advance. This level does everything the free level does, plus syncs your data across all of your devices. This level also adds two-factor authentication (2FA) for extra security, and has an emergency access feature that lets you designate someone who will be able to access your account if anything happens to you.

The Everywhere Family level costs $47.75 per year with discounts if you buy three or five years in advance. It does everything the individual Everywhere plan does for up to five users.

Setting Up RoboForm

I clicked the button to sign up for a free plan on my desktop while using Google Chrome and was immediately sent to the Chrome Web Store. Clicking “New to RoboForm” asked me to sign up with an email and create a master password. A little note at the bottom said “memorize your Master Password” because RoboForm cannot recover your master password if you happen to forget it.

The start page popped up a welcome message and a video tutorial. After I watched the video, it walked me through the set-up steps for both manually entering passwords and bulk importing them from my browser.

Downloading passwords from Chrome was actually kind of a chore. I had to go into settings, find the passwords, click some dots, export them as a CSV file and save them to my desktop. Then I could import them into RoboForm.

I ran into Windows Security at this point, which needed me to sign in to my Windows Account before releasing the CSV file.

Instructions for downloading from another password manager were similar, with directions on how to log back into an old manager and vague directions on how to export a CSV file.

Filling out Forms with RoboForm

RoboForm started as a form management system, so it shouldn’t surprise you to learn that form entry is one of its strongest features. You’ll need to create a new identity to fill out forms, which you can access on the left side menu.

The initial form has a lot of blanks to fill out — it’s incredibly thorough. Title, full name, suffix, job title, four slots for phone numbers and a fax, email, Skype, sex, age, birthday, birthplace, income, social security number, driver’s license, and a note section. You don’t need to fill out all the slots to use this form — how often do you really need to fill out your driver’s license number?

Once you complete the ID form you can add your address, credit cards, bank account, work place information, your passport, and even information about your car.

You can have more than one person on your list, but this is not a great place to save your mom’s shipping information so you can send her birthday flowers. Entries for people and addresses are separate. If you want to enter more than one address you can’t label it; instead RoboForm leads with the zip code.

Password Generator Built into RoboForm

The best part of any password manager is its ability to generate robust, secure, unhackable passwords … and also remember them for you. RoboForm features a random password generator that generates a 16-character password made up of upper and lowercase letters, digits, and symbols. 

RoboForm’s password generator is particularly detailed, which is useful for when you come across a form that wants a robust password but has a bunch of arbitrary constraints. You can limit generated passwords to hexadecimal characters, choose to exclude characters with similar appearances, and even pick which special characters to include.

Using RoboForm on a Desktop

There are two ways to access RoboForm from your computer: Through a browser extension, or through the web. They look a bit different, so we’ll look at both. I tested this with a Chrome extension, which you can open by clicking the puzzle piece in the top right corner of the Chrome browser.

This opens a dropdown menu with nearly all the features of RoboForm. You can see the sites where it’s saved passwords, a place for domain logins, and your ID for filling out forms. A slot machine icon in the upper right is the password generator for quick copy and paste passwords. The Home icon will open the full app.

The full app displays all of your saved credentials in huge tiles, small icons, or a list. Clicking on one of these icons will take you directly to the site and log you in.

When displayed as a list, RoboForm includes a column showing password strength so you can hone in on passwords that need to be upgraded first.

I decided to let RoboForm fix my Walmart login, which was flagged as weak. I went to Walmart’s login and selected “Create a new password”. RoboForm showed it was on task with a little green robot head by the password box. Clicking it gave me a randomly generated password. Done.

I tested RoboForm on a shopping trip to an online florist, but RoboForm was not able to fill out this login for me. I signed in with Google, changed the password to something secure suggested by RoboForm then logged out. When I came back, RoboForm still wasn’t able to find an email and password to get me in. So I logged in manually again.

After picking out some flowers, and entering my mom’s address by hand, RoboForm was able to complete the job by taking care of the billing address and credit card using the information I entered in the identity section of RoboForm.

Using RoboForm on Mobile

There was no obvious way to access a mobile download from the desktop version. I found a QR code for the app under a tab marked “Why RoboForm?” whose purpose seemed to be selling me on a product I had already downloaded.

Scanning the QR code with my iPhone took me to the App Store where I was prompted to download RoboForm. I was then asked me to sign into my account and verify my ID with a code sent to my email.

Since RoboForm automatically gave me a free trial of the premium level, it was able to sync my phone with the desktop version and pull all my passwords from there. If I continue on the free plan next month, I will lose the ability to sync across multiple platforms. This might not seem like a big limitation at first, but if you have multiple devices you probably switch between them more often than you think. Trying to keep your passwords updated without cross-platform syncing quickly becomes tedious, especially if they’re extra-secure generated passwords.

RoboForm is clunky on mobile, but it does manage to offer the same services as the desktop version. On both Android and iOS you’ll need to enable AutoFill inside the device’s settings menu. On iOS, you’ll also need to turn off Keychain, and in Chrome you need to uncheck Form Autofill.

To get the most out of RoboForm you can use it as your browser. If you'd rather use your phone's native browser you'll need to enable AutoFill in the setting app. For iOS, scroll down to the Passwords option, tap AutoFill Passwords, select ON and select RoboForm. Then uncheck Keychain. For Android users got to Settings > Integration > Accessibility and tap RoboForm. Then, in RoboForm's integration page, click Native Autofill and RoboForm.

Your saved RoboForm passwords act like bookmarks to their respective websites, and pressing these will take you to the site and automatically log you in if needed. When you have a form to fill out — for example, a shipping address or credit card information while you’re shopping online — a small autofill button on the corner of your screen will pull information from your RoboForm ID.

Security Center on RoboForm

RoboForm’s Security Center is a tool to evaluate the strength of your passwords and weed out the bad ones. You can access it from both the desktop and mobile versions of RoboForm.

You’ll see a Security Score at the top, though it seems a bit arbitrary. The score improves as you fix bad passwords and delete unneeded websites and redundant credentials. You can sort passwords by Compromised, Weak, and Reused.

I had hundreds of passwords turn up from my Google Chrome import – but many of them were bogus. I found logins for sites that didn’t exist anymore (e.g. that free blogging class I took in 2015), websites that had changed URLs, and some that were typos. It seems that Chrome remembered every time I typed my username wrong and saved the misspellings as potential “new” logins.

It’s a good idea to work on fixing compromised passwords first, and then move on to fix weak passwords and duplicates.

How Secure is RoboForm?

RoboForm keeps your data safe with AES-256 encryption and zero-knowledge technology — decryption is at the local level, right on your device. Your master password, which unlocks your personal decryption key, is never transmitted to RoboForm’s servers.

To protect you from brute force attacks, RoboForm uses AES-256 bit encryption with PBKDF2 SHA256. PBKDF2 is a key stretching algorithm used to hash passwords with a salt.

RoboForm offers two-factor authentication 2FA for paid users, via third-party authenticator apps such as Google Authenticator and Authy. RoboForm does not currently support advanced multi-factor authentication with a hardware key such as YubiKey.

Bottom Line

RoboForm is easy to use on desktop and oddly clunky on mobile, but it gets the job done. The free plan is yours for life and is enough to keep your web surfing trouble free, so long as you mainly stick to one device. For $24 a year, the premium Everywhere plan adds multi-device syncing, 2FA, and is cheaper than many of its competitors (LastPass, Keeper, and 1Password are all around $35 per year). RoboForm doesn’t offer some of the higher-end features such as extra storage and multi-factor authentication, but it does have a highly-customizable password generator and is great at filling out forms.

RoboForm’s zero-knowledge architecture means your data is encrypted right on your computer or phone. So even if there’s a data breach, crooks won’t be able to read your valuable information.