"A password manager — if that one place is breached, isn't everything over?" Here's an honest answer to the most common worry, starting from how it works. No attack steps — only why it's safe and how to pick the right one for you.
What encryption protects and which risks remain
The fear is real: if that one place is breached, everything could leak. Zero-knowledge encryption addresses most of it.
The one practical rule that follows: make the master password long, unique, and never off your device. A weak one leaves room to brute-force a stolen vault offline over time. Gauge its strength with the password strength checker.
MFA helps prevent unauthorized account logins; it does not stop password guessing against stolen encrypted data. Device, browser, and app security are also necessary. The provider's threat model also addresses compromised devices and the delivery of the web client.
The three protections that actually help
There's more value here than "a vault you don't have to memorize."
The standout is phishing-resistant autofill. People struggle to spot a near-identical fake domain, but a manager won't fill unless the registered domain matches — so "huh, it won't fill" becomes your clue that the site is fake. Hand-copying from a spreadsheet has none of this.
Cloud vs local — choose by use
The products listed here use device-side encryption. Check each product and its settings for encrypted fields, recovery methods, and the security conditions for sync and backups. A major difference is who manages the sync.
Cloud (Bitwarden / 1Password)
- Auto-sync and sharing across all devices
- Backup and recovery paths are built in
- Contents stay encrypted (the provider can't read them)
- Low friction = easy to keep using — suits most people
Local (KeePass, etc.)
- You place the encrypted file (.kdbx) on Drive/etc. yourself
- For people who want zero provider involvement
- Sync and backup are your responsibility
- Offline-first, fully hands-on management
Both are built safe. Choose by what you'll keep using. A plain tool you use daily protects you more than a perfect one you abandon.
How to choose safely (checklist)
Zero-knowledge (device-side encryption)
MFA for the password manager account login
A recovery path exists
Covers every device you use
How to start and migrate
Pick one and install it
Make the master password long and unique
MFA for the password manager account, recovery email, and important accounts
Import existing passwords, then upgrade the weak ones first
Delete the plaintext copies for good
Move to passkeys where supported
Dedicated vs built-in vs browser storage
Besides cloud and local managers, there's a third option: the password store built into your OS or browser.
| Dedicated (cloud) | Dedicated (local) | OS built-in (iPhone Passwords app, Google Password Manager) | |
|---|---|---|---|
| Cost | Free plan or paid | Free (KeePass etc.) | No extra cost |
| Devices | Works across Windows, Mac, iPhone and Android | You arrange sync | Mainly one vendor's devices and browser |
| Family or team sharing | Strong | Takes effort | Partial |
| Leak and reuse warnings | Yes (depends on product and plan) | Via plugins | Yes |
| Best for | Mixed platforms, sharing | People who want to manage sync themselves | Everything on one vendor's devices |
Built-in stores also give every service its own password if you use generation and autofill. Moving to a dedicated manager once you need to cross platforms is a perfectly fine order.
How to check your own settings
Don't stop at installing it. Check these settings once.
Check how your key is derived (KDF)
The heavier the key derivation function (KDF) that turns your master password into a key, the harder it is to brute-force stolen ciphertext. In Bitwarden, open the web app's "Settings" → "Security" → "Keys"; the default is PBKDF2 SHA-256 with 600,000 iterations, and Argon2id is also available. For older accounts, confirm the setting matches today's recommendation.
Keep recovery information outside the password manager
1Password uses a 34-character Secret Key in addition to your master password, printed on your Emergency Kit. In Bitwarden, write down your two-step login recovery code. Don't keep either only inside the vault; print it and store it in a fixed place at home.
Check MFA on the password manager itself
Prefer passkeys, a hardware key or an authenticator app over SMS (→ MFA guide).
Check the auto-lock timeout
Make sure the browser extension and apps lock after a period of inactivity or when the browser closes. Keep it short on a PC shared with family.
Common mistakes and how to fix them
- Using the same master password as another service: a leak there exposes the key to your vault. Your master password must not be used anywhere else.
- Keeping recovery codes or the Emergency Kit only inside the vault: you can't reach them when locked out. Keep a copy outside, such as on paper.
- Leaving browser password saving on after migrating: passwords end up split across two places and old ones linger. After migrating, turn off browser saving and delete what's stored there.
- Walking away with the vault unlocked: set a short auto-lock.
Real example: what stayed protected when a provider was breached
In December 2022, LastPass disclosed that an attacker had copied a backup of customer vault data. According to the company, website usernames, passwords, secure notes and form-fill data remained encrypted with 256-bit AES and could only be decrypted with a key derived from each user's master password.
The same notice also stated:
- Website URLs in the vault were in an unencrypted part of the data
- Account information was also copied: company names, end-user names, email addresses, billing addresses, phone numbers and the IP addresses customers connected from
- With the default settings (PBKDF2 at 100,100 iterations) and a strong master password, guessing it would be extremely difficult
The takeaway: zero-knowledge design protects the contents, but what ultimately counts is your master password's strength and your key-derivation setting. Also, knowing which sites you have accounts with can be used for phishing emails that impersonate them. If a provider discloses a breach, consider changing your master password and the passwords of your important accounts.
This site's view: protect the master password and vault MFA, and pick a tool you'll keep using
On this site we never keep secrets (passwords, keys, connection details) in plaintext — not in shared docs, not in code — and manage day-to-day logins in a password manager. Alongside a long, unique master password and appropriate encryption settings, we use MFA to prevent unauthorized logins. We separately check device and app updates, auto-lock, and recovery information storage. Choose a tool for both its security conditions and whether you can keep using it.
Read next
- Check for leaks: How to check if your password was leaked (Have I Been Pwned)
- Storage: Storing passwords safely (stop plaintext)
- How it works: how the service should store them (hashing + salt)
- Two-step: Multi-factor authentication (MFA) guide
- Passwordless: what a passkey is (migrate where supported)
- On the implementer's side: password reset design flaws — a strong password does not help if reset is the weak path
- Baseline: Security baseline checklist
- Tool: Password strength checker
- The data: how people actually store passwords (survey data)
- After a leak: how to clear browsing history, cookies and saved passwords (Chrome, Safari, Edge, Firefox)
Sources
- LastPass, "Notice of Recent Security Incident" (December 22, 2022): blog.lastpass.com
- Bitwarden Help, "Encryption Key Derivation": bitwarden.com
- Bitwarden, "Security Whitepaper", threat model: bitwarden.com
- 1Password Support, "About your Secret Key": support.1password.com
- NIST, "SP 800-63B-4" (August 2025), allowing password managers and paste: pages.nist.gov
Update history
- 2026-10-20: Qualified the guarantees about leaked encrypted data and clarified the distinction between MFA, resistance to decryption, and device security. This limited correction does not reverify all existing incident figures or product features.