Password Managers Explained

What a password manager actually does

A password manager is software that generates, stores, and auto-fills passwords and other credentials. It keeps everything in an encrypted database — the vault — that is locked behind one master password. The design goal: you only need to remember one strong password (the master) while every other account gets a unique, randomly generated password you never need to recall.

The typical workflow: you visit a site, the manager detects the login form and fills it automatically. When you create a new account, the manager generates a strong random password and saves it alongside the site's URL and your username. Across devices, your encrypted vault syncs via the provider's servers (for cloud-based managers) or a file you manage yourself (for local managers).

How AES-256 encryption protects your vault

AES-256 (Advanced Encryption Standard with a 256-bit key) is the encryption standard used by governments, militaries and security agencies worldwide. It is considered computationally unbreakable with current and near-future hardware — brute-forcing a 256-bit key is far beyond any feasible computing effort.

In a password manager, your vault is encrypted with a key derived from your master password through a key derivation function (KDF) like PBKDF2, bcrypt, or Argon2. This derivation is intentionally slow (and, for Argon2, memory-intensive), making brute force attacks against the master password impractically slow even with the encrypted vault in hand. Bitwarden uses PBKDF2 with 600,000 iterations by default (Argon2id is available as an option); 1Password uses PBKDF2 with 650,000 iterations, combined with a randomly generated Secret Key.

Zero-knowledge architecture: why the company cannot read your passwords

Reputable password managers use a zero-knowledge architecture: the encryption and decryption happen on your device, not on the company's servers. The company's servers store an encrypted blob they cannot read. Your master password itself is never sent to the server. Even a malicious employee with full database access cannot decrypt your vault without your master password.

This architecture is why password manager companies can honestly say they do not know your passwords. It is also why forgetting your master password means losing access — there is no recovery email that lets the company reset it, because they typically do not hold the key.

What happened when LastPass was breached in 2022

The LastPass breach is the most instructive real-world test of password manager security. In 2022, attackers breached LastPass in two linked incidents and ultimately copied customer vault backups. Website URLs were stored unencrypted, while usernames and passwords were encrypted. For users with long, random master passwords, the encrypted data is practically uncrackable without the key. For users with weak master passwords or outdated settings (LastPass raised its default to 100,100 iterations in 2018, but some older accounts remained at 5,000 iterations or fewer — far below the 600,000 later recommended by OWASP), the breach was far more serious.

The lessons: a password manager is only as secure as your master password. Use 20+ characters, ideally a diceware passphrase. Verify your KDF settings are current (in Bitwarden: Settings → Security → Keys, then choose PBKDF2 with 600,000+ iterations or Argon2id). Enable multi-factor authentication on your password manager account.

Local vs cloud-synced: which type is right for you

Cloud-synced managers (Bitwarden, 1Password, Dashlane, Keeper) store your encrypted vault on the provider's servers and sync across all devices automatically. The vault never leaves your devices unencrypted. This is the most convenient option and appropriate for most users.

Local managers (KeePass, KeePassXC) store the vault as an encrypted file on your device. You manage syncing yourself — typically through a cloud storage service like Dropbox, iCloud, or a self-hosted server. This eliminates the third-party server as a potential breach target, at the cost of complexity. Appropriate for advanced users who are comfortable managing their own sync and backup.

Getting started: the practical path

Download Bitwarden (free, open-source, independently audited, available on all platforms). Create an account. Choose a master password of at least 20 characters — use a diceware passphrase you can memorise. Enable two-factor authentication on your Bitwarden account immediately. Install the browser extension. Go to your browser's saved passwords and export them; import the file into Bitwarden, then delete the export file. From this point, as you log in to sites over the coming weeks, Bitwarden will prompt to save or update credentials. Within a month, your vault covers most of your accounts. Then use this generator to replace any weak or reused passwords with new random ones, updating them one by one.