Quick Answer
A maintained password manager helps replace password reuse with unique credentials. Its protection depends on your device, account security and recovery arrangements. Choose a tool you can keep updated and recover; encryption, MFA and an audit do not protect every unlocked session or exported file.
This guide explains what protection you can reasonably expect, where it stops and what to check before trusting a service with your logins. Browser and device password managers can also be suitable; paying for a separate app is not automatically safer.
Why a Password Manager Usually Helps
When the same password protects several accounts, a leak from one service can expose the others. A manager makes separate passwords practical without requiring you to memorise them all. The UK National Cyber Security Centre supports password managers, including built-in options on your own devices.
Useful features include generating passwords, storing them in a protected vault and filling them on matching sites. Your habits matter: importing an old reused password does not improve it. You still need to change that password on the actual service and save the new one.
What Encryption and “Zero Knowledge” Mean
Encryption turns stored information into data that needs the right key to read. In an end-to-end encrypted service, protection is designed to start on your device rather than relying only on the provider’s server security. The exact key handling, recovery arrangements and treatment of metadata differ by product.
“Zero knowledge” is a description of a design claim, not a guarantee against every attack. Read what the provider actually encrypts and what happens during sharing, recovery and sign-in. An encryption algorithm name alone does not explain the security of the whole system.
For example, 1Password documents a Secret Key used alongside the account password. That is a product-specific design; it should not be assumed to apply to every password manager. Nor is that Secret Key, by itself, a replacement for a forgotten account password.
Where Protection Can Fail
Putting credentials in one vault concentrates sensitive information. The practical response is to protect the vault and understand its limits, rather than return to password reuse.
A Compromised Device or Unlocked Vault
Someone who controls your device may be able to read information while you use it, capture credentials or access an unlocked session. Biometric unlock can reduce typing, but it does not make an infected device safe. KeePass’s security documentation explains the limits of defending a password manager against specialised spyware on the same system.
Keep the operating system, browser and manager updated. Use a screen lock and sensible vault timeout. Avoid unlocking your vault on public computers or devices you do not trust.
Phishing and Autofill Mistakes
Domain matching can help you notice an impostor site when a saved login is not offered. It is not a promise that every phishing attempt will be blocked. Filling behaviour and matching rules vary, and attackers can also target your master password, recovery process or signed-in sessions.
If a login behaves unexpectedly, stop and reach the service through a known address or its official app. Do not paste a password into an unfamiliar page just because autofill refused to work.
Provider Breaches and Design Weaknesses
A server breach can have different consequences depending on what was taken and how the product works. Stolen encrypted vaults may be exposed to offline guessing; account MFA does not necessarily protect a copied vault file. Provider-side flaws can also undermine intended protections.
In February 2026, ETH Zurich reported password-manager research using a malicious-server model. Researchers examined what could happen if a server behaved dishonestly, rather than demonstrating that every customer’s account had been breached. The findings show why broad security slogans are insufficient.
Read the research alongside the provider’s response and current remediation information. Bitwarden’s response distinguishes resolved work, active remediation and accepted design decisions; that wording is not evidence that every finding in every version has been eliminated. Bitwarden published its response to that work. An old finding does not establish the current condition of every product version, and a vendor response is not a substitute for independent evidence.
Protect the Account and Plan for Recovery
- Use a long, unique master password or passphrase where your manager requires one. Do not reuse your email password.
- Enable the strongest practical supported sign-in protection. Keep its recovery information somewhere you can reach without opening the locked vault.
- Secure the email account used for recovery and keep recovery contact details current.
- Check the difference between locking the vault, logging out and signing in on a new device.
- Keep any emergency kit or recovery key in a protected place separate from your everyday device.
MFA helps protect account sign-in, but it is not a second encryption layer around every exported file or unlocked vault. Bitwarden’s two-step login FAQ distinguishes a new login from simply unlocking a device that is already signed in.
Recovery options vary. A trusted contact, recovery code, account password and encryption key can serve different purposes. Bitwarden’s forgotten-password guidance illustrates why you should understand your own account’s recovery routes before relying on them. Do not test recovery by deleting your only working access. See what to do if you forget your master password and how to arrange emergency access for the practical differences.
Choose a Storage Model You Can Maintain
- Built-in browser or device manager: convenient if its device support and account recovery fit your needs. Check actual compatibility rather than assuming all built-in tools are confined to one browser.
- Dedicated synced manager: useful for mixed devices and selected sharing features. Compare supported platforms, recovery, security documentation and permissions.
- Local vault: offers more control over where the database lives. You take responsibility for protected backups, compatible apps and any synchronisation you add.
Do not choose solely by “free” versus “paid”. Check whether the features you need are included, whether updates are maintained and whether the vendor explains security incidents clearly. Look at an audit’s date and scope; one audit does not certify every future version.
For a household, also decide who can access shared items and what happens when someone loses a device. Follow our family password manager setup guide and safe family-sharing checklist to put those decisions into practice. Our family password-manager comparison covers product choices. If you are already changing providers, follow our password-manager switching checklist before deleting your old vault.
Make Autofill a Deliberate Choice
A password manager can help match a saved login to a website, but the matching rule matters. Bitwarden’s current documentation illustrates the distinction: Base domain can offer a login across subdomains; Host narrows the hostname, while Exact expects the saved URI to match precisely. Advanced prefix or regular-expression rules can accidentally broaden access. These are Bitwarden examples, not universal settings shared by every manager.
| What you notice | A safer next step | What it does not prove |
|---|---|---|
| The manager does not offer the login | Open the known official site and check the saved address before changing matching rules. | A missing suggestion alone does not prove phishing. |
| A login appears on a related subdomain | Check whether the chosen matching rule intentionally includes it. | A matching domain does not certify the page or device as safe. |
| An app asks for a familiar credential | Confirm the app’s publisher and trusted installation source. | A matching app identifier is not proof of an authentic app. |
Bitwarden also documents mobile limits: Android matching cannot rely on URI ports or paths, and iOS keyboard suggestions use base-domain matching. A stricter desktop rule therefore should not be assumed to behave identically on the phone. If a service changes its genuine sign-in address, verify that change independently and update the saved item, rather than weakening every item’s matching rule.
Prefer a deliberate selection when you are uncertain. If autofill refuses, copying the same password into the page can defeat the warning you hoped the manager would provide. On a shared computer, use your own separate device or profile where appropriate, and avoid leaving the vault unlocked for the next user. A saved login also does not protect an already signed-in browser session from someone using the same unlocked profile.
Check Your Setup Without Exposing the Vault
Use a non-sensitive test account you control to check the everyday workflow. Confirm that the correct browser profile and manager extension are active, that the intended item is offered on the real service, and that the vault locks when you expect. Inspect extension permissions and remove an obsolete or unfamiliar password-manager extension through the browser’s normal controls. Install replacements through a link from the provider’s genuine website, rather than a search advert or an unsolicited message.
For a recovery check, first identify the materials required for a new-device sign-in and where each is kept. Then confirm that a trusted device still opens the correct account and that the instructions are accessible separately. Do not sign out of every device, reset the account or delete the only vault copy merely to test a plan. A successful biometric unlock of an existing session does not demonstrate that you know the password needed on a new device.
If you discover a reused or exposed credential, change it on that service, save the new value, and verify the change before moving to the next important account. A vault-health warning is a prompt to investigate, not permission to submit an export or master password to a third-party checking tool. Review account recovery and active sessions alongside password changes when compromise is suspected.
For a household or workplace, agree who can help without handing everyone the master password. Shared items, account recovery and emergency access can have different permissions and waiting periods. Keep personal and employer-managed vaults separate where policy requires it, and ask the organisation’s administrator about managed recovery before changing those settings yourself.
Match the response to what was exposed
A password-manager scare can concern very different things: an unexpected login notification, a suspicious browser extension, a lost phone, or a provider advisory. Start by identifying which event actually occurred. Keep the notification or advisory and its date, then reach the provider through a known address. Do not type your master password into an emailed “security check” page or send an export to someone offering to inspect it.
If the concern is a device you no longer control, use a trusted device to review the manager’s documented lost-device and session controls. Separately review the services that were already signed in on the missing phone. Changing a vault password and revoking an email session solve different problems. Avoid promising that one account change erases every offline copy, browser cookie or secret already seen by another person.
If a plaintext export was exposed, account MFA does not turn that file into encrypted data. Identify what it contained and prioritise affected recovery email, financial and other important accounts for credential changes through their official sites. Update the vault after each successful change. Removing the file is useful housekeeping, but it is not evidence that every synced, backed-up or previously copied version has disappeared.
If the issue is a provider advisory, check the affected product, client version, configuration and recommended action. Distinguish a demonstrated research attack from confirmed theft of your particular account. Equally, do not dismiss a serious design finding merely because the provider uses end-to-end encryption. Update through the official distribution channel and follow the specific advisory; a wholesale migration without verifying the destination can create another access problem.
Make recovery usable without weakening it
Prepare a small access map: where the recovery instructions are, who is authorised to use them, and what can be reached without opening the vault. Record locations and roles rather than putting every secret in one note on the same phone. A household contact needs to understand whether they have everyday sharing access, an emergency request route or no access at all.
Check readiness without destroying your only working session. Read the provider’s current requirements, confirm recovery contact details and keep a protected copy of the relevant kit or code. Do not simulate a disaster by deleting the vault or removing your only factor. After a phone replacement or change of household responsibility, update the access map and review who can still reach shared items.
My recommendation for safer everyday use
Keep using unique credentials in a maintained manager that fits your devices and recovery needs. Protect the account, shorten avoidable unlocked access and handle exports as sensitive files. Resolve a specific security gap before buying another subscription or moving every login; the best setup is one you can maintain and recover.
Frequently Asked Questions
Can a password manager be hacked?
Yes. Risks include provider vulnerabilities, stolen encrypted data, phishing and compromised devices. Encryption and account protection reduce risk but do not guarantee that every attack will fail.
Is a browser password manager unsafe?
Not inherently. A maintained built-in manager on your own secured device can be appropriate. Check compatibility, recovery and sharing needs before deciding whether a dedicated app offers a useful improvement.
Does MFA protect an exported password file?
Do not assume so. A plaintext export can be read without your account MFA. Prefer a supported direct transfer or compatible encrypted export, and remove temporary plaintext files after verifying the move.
Should I weaken autofill matching when a login is missing?
First verify the website or app independently and inspect the saved address. Matching behaviour varies by manager and platform. Avoid broadening every item’s rules just to fix one genuine sign-in change, and do not paste a credential into an unfamiliar page.
Does biometric unlock prove that recovery will work?
No. Unlocking an existing trusted session can require different information from signing in on a new device. Check the provider’s recovery requirements and keep required materials accessible without deliberately removing your only working access.
Sources and Image Credits
Sources: NCSC password managers; 1Password Secret Key; KeePass security; ETH Zurich research, February 2026; Bitwarden research response; Bitwarden two-step login; Bitwarden autofill matching.
Illustrations: Impulsec.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.