VPN vs Antivirus vs Password Manager: Do You Need All 3?
Affiliate disclosure: This article contains affiliate links. If you click a link and make a purchase, we may earn a commission at no extra cost to you. Our editorial recommendations are never influenced by commissions — read our full disclosure policy.
You need all three only if you face all three threats they cover. A password manager protects your accounts from reused and weak passwords; antivirus protects your device from malicious software; a VPN protects your traffic on networks you do not control. If you must choose, start with a password manager plus two-factor authentication — both can be free and protect the accounts that matter most — then make sure antivirus is switched on (Windows and macOS include built-in protection), and add a VPN when you regularly use public Wi-Fi or want to hide your browsing from your network provider.
What each tool protects — and what it does not
| Password manager | Antivirus | VPN | |
|---|---|---|---|
| Main job | Unique, strong passwords for every site; breach alerts | Detects and blocks malicious files and behaviour; often blocks bad websites | Encrypts traffic between you and the VPN server; hides your IP address from sites |
| Helps against phishing? | Yes — it will not autofill on a look-alike domain | Partly — if the site is known to be malicious | No |
| Helps against leaked passwords? | Yes — a leak at one site stays at that site | No | No |
| Helps against malware? | No — malware on a device can read what you unlock | Yes | No |
| Helps on public Wi-Fi? | No | No | Yes |
| Free option | Yes, e.g. Bitwarden Free | Built into Windows (Microsoft Defender) and macOS | Yes, e.g. Proton VPN Free |
The gap each leaves on its own
Only a password manager: your accounts are well protected, but malware on the device could capture what you unlock, and your traffic on open networks is visible to the network operator.
Only antivirus: your device is protected, but reused passwords still fall the next time a site you use is breached, and a convincing phishing page still gets whatever you type.
Only a VPN: your traffic is encrypted on the way to the VPN server, but it does nothing about malware or weak passwords — and the VPN provider itself can see your traffic, so choose one with an audited no-logs policy.
Priority order on a budget
First — a password manager. The UK National Cyber Security Centre recommends one because it lets you use unique passwords everywhere without remembering them. Bitwarden's free plan, for example, covers unlimited passwords on unlimited devices; its Premium plan was listed at $19.80 a year when we checked. NordPass is another option. Our why you need a password manager guide includes a 30-minute setup.
Second — two-factor authentication. Free and built into most major services. CISA, the US cybersecurity agency, says users who enable it are "significantly less likely to get hacked". See two-factor authentication explained.
Third — antivirus, properly configured. On Windows, Microsoft Defender is built in; turn on Controlled folder access (off by default) for ransomware protection. A paid suite such as Bitdefender adds broader web protection and multi-device management. Our guide on whether you need antivirus helps you decide.
Fourth — a VPN, if your situation calls for it. Most useful if you often use hotel, café or airport Wi-Fi, travel, or want to keep your browsing from your internet provider. Proton VPN's free plan has no data limit for one device; paid services such as NordVPN add more devices, locations and speed. Read is a free VPN safe? before picking a free one.
Which do you need? Four common situations
| You are… | Essential | Worth adding |
|---|---|---|
| Working from home on your own network | Password manager, 2FA, built-in antivirus on | Backups for ransomware recovery |
| Often on public Wi-Fi or travelling | Password manager, 2FA, VPN | Paid antivirus with web protection |
| Managing a family's devices | Password manager with sharing, 2FA on main accounts | A suite covering several platforms and parental controls |
| Running a small business | Password manager for the team, 2FA everywhere, antivirus on every device | Central management; VPN for staff on the move |
Working out the real cost
Prices on all three categories change frequently and differ by country, plan length and first-year discount. To compare honestly, write down the renewal price — not just the introductory one — for each tool you are considering, and check whether a bundle includes tools you would otherwise pay for. Free tiers (Bitwarden Free, built-in antivirus, Proton VPN Free) mean a basic stack can cost nothing.
Frequently asked questions
Do I need a VPN if I have antivirus?
They do different jobs. Antivirus protects your device from malicious software; a VPN encrypts your traffic on the network. If you rarely use networks you do not trust, a VPN is lower priority than a password manager and 2FA.
Does a VPN protect against viruses?
No. A VPN encrypts traffic between you and the VPN server; it does not scan files or stop malware running on your device.
Is a password manager more important than antivirus?
For most people's accounts, yes: it stops one leaked password unlocking others and helps you avoid phishing pages. Antivirus remains important for the device, and both Windows and macOS include built-in protection you should keep switched on.
Can I get all three for free?
Yes, in basic form: Bitwarden's free plan, the antivirus built into Windows or macOS, and Proton VPN's free plan. Paid tiers add sharing, more devices, broader web protection and faster VPN servers.
Related
Set the whole thing up in order with the complete security stack setup, or see the tools we use ourselves in our actual security stack. The cybersecurity checklist covers the rest of the basics.
Sources checked 16 October 2026: NCSC, password managers guidance; CISA, cisa.gov/mfa; bitwarden.com/pricing; protonvpn.com/free-vpn; Microsoft Learn, "Configure controlled folder access". Editorial content.
Covered in this guide
Written by Thomas Lovas Lokoy, Co-founder & Editor — researched and drafted with AI assistance, then read, fact-checked and approved by Thomas before publishing · Editorial policy · Disclosure · Last updated: 16 October 2026
