A reputable, maintained password manager is generally a safer choice than reusing passwords or keeping them in unprotected files. Its main benefit is helping you use a different strong password for every account. It still needs a secure device, a well-protected account and a workable recovery plan. No password manager removes every risk.
This guide explains what protection you can reasonably expect, where it stops and what to check before trusting a service with your logins. Browser and device password managers can also be suitable; paying for a separate app is not automatically safer.
Why a Password Manager Usually Helps
When the same password protects several accounts, a leak from one service can expose the others. A manager makes separate passwords practical without requiring you to memorise them all. The UK National Cyber Security Centre supports password managers, including built-in options on your own devices.
Useful features include generating passwords, storing them in a protected vault and filling them on matching sites. Your habits matter: importing an old reused password does not improve it. You still need to change that password on the actual service and save the new one.
What Encryption and “Zero Knowledge” Mean
Encryption turns stored information into data that needs the right key to read. In an end-to-end encrypted service, protection is designed to start on your device rather than relying only on the provider’s server security. The exact key handling, recovery arrangements and treatment of metadata differ by product.
“Zero knowledge” is a description of a design claim, not a guarantee against every attack. Read what the provider actually encrypts and what happens during sharing, recovery and sign-in. An encryption algorithm name alone does not explain the security of the whole system.
For example, 1Password documents a Secret Key used alongside the account password. That is a product-specific design; it should not be assumed to apply to every password manager. Nor is that Secret Key, by itself, a replacement for a forgotten account password.
Where Protection Can Fail
Putting credentials in one vault concentrates sensitive information. The practical response is to protect the vault and understand its limits, rather than return to password reuse.
A Compromised Device or Unlocked Vault
Someone who controls your device may be able to read information while you use it, capture credentials or access an unlocked session. Biometric unlock can reduce typing, but it does not make an infected device safe. KeePass’s security documentation explains the limits of defending a password manager against specialised spyware on the same system.
Keep the operating system, browser and manager updated. Use a screen lock and sensible vault timeout. Avoid unlocking your vault on public computers or devices you do not trust.
Phishing and Autofill Mistakes
Domain matching can help you notice an impostor site when a saved login is not offered. It is not a promise that every phishing attempt will be blocked. Filling behaviour and matching rules vary, and attackers can also target your master password, recovery process or signed-in sessions.
If a login behaves unexpectedly, stop and reach the service through a known address or its official app. Do not paste a password into an unfamiliar page just because autofill refused to work.
Provider Breaches and Design Weaknesses
A server breach can have different consequences depending on what was taken and how the product works. Stolen encrypted vaults may be exposed to offline guessing; account MFA does not necessarily protect a copied vault file. Provider-side flaws can also undermine intended protections.
In February 2026, ETH Zurich reported password-manager research using a malicious-server model. Researchers examined what could happen if a server behaved dishonestly, rather than demonstrating that every customer’s account had been breached. The findings show why broad security slogans are insufficient.
Read the research alongside the provider’s response and current remediation information. Bitwarden published its response to that work. An old finding does not establish the current condition of every product version, and a vendor response is not a substitute for independent evidence.
Protect the Account and Plan for Recovery
- Use a long, unique master password or passphrase where your manager requires one. Do not reuse your email password.
- Enable the strongest practical supported sign-in protection. Keep its recovery information somewhere you can reach without opening the locked vault.
- Secure the email account used for recovery and keep recovery contact details current.
- Check the difference between locking the vault, logging out and signing in on a new device.
- Keep any emergency kit or recovery key in a protected place separate from your everyday device.
MFA helps protect account sign-in, but it is not a second encryption layer around every exported file or unlocked vault. Bitwarden’s two-step login FAQ distinguishes a new login from simply unlocking a device that is already signed in.
Recovery options vary. A trusted contact, recovery code, account password and encryption key can serve different purposes. Bitwarden’s forgotten-password guidance illustrates why you should understand your own account’s recovery routes before relying on them. Do not test recovery by deleting your only working access. See what to do if you forget your master password and how to arrange emergency access for the practical differences.
Choose a Storage Model You Can Maintain
- Built-in browser or device manager: convenient if its device support and account recovery fit your needs. Check actual compatibility rather than assuming all built-in tools are confined to one browser.
- Dedicated synced manager: useful for mixed devices and selected sharing features. Compare supported platforms, recovery, security documentation and permissions.
- Local vault: offers more control over where the database lives. You take responsibility for protected backups, compatible apps and any synchronisation you add.
Do not choose solely by “free” versus “paid”. Check whether the features you need are included, whether updates are maintained and whether the vendor explains security incidents clearly. Look at an audit’s date and scope; one audit does not certify every future version.
For a household, also decide who can access shared items and what happens when someone loses a device. Follow our family password manager setup guide and safe family-sharing checklist to put those decisions into practice. Our family password-manager comparison covers product choices. If you are already changing providers, follow our password-manager switching checklist before deleting your old vault.
Frequently Asked Questions
Can a password manager be hacked?
Yes. Risks include provider vulnerabilities, stolen encrypted data, phishing and compromised devices. Encryption and account protection reduce risk but do not guarantee that every attack will fail.
Is a browser password manager unsafe?
Not inherently. A maintained built-in manager on your own secured device can be appropriate. Check compatibility, recovery and sharing needs before deciding whether a dedicated app offers a useful improvement.
Does MFA protect an exported password file?
Do not assume so. A plaintext export can be read without your account MFA. Prefer a supported direct transfer or compatible encrypted export, and remove temporary plaintext files after verifying the move.
Share this article
Stuart Kerr Spindlow is Impulsec’s Publisher, Chief Editor and Lead Reviewer. He writes and maintains coverage of consumer cybersecurity and digital-safety software, with a focus on practical suitability, limitations and the evidence behind product claims. Read Stuart’s full profile.