Is a password manager safe? What it protects
A password manager is safer than reusing passwords or keeping them in a spreadsheet, because each account gets its own long password and the vault is encrypted on your device. The risk does not vanish: it moves to the vault, the password that opens it, and the company that runs the service, which is why the provider’s design, audits, and track record matter.
Is a password manager safe to use?
Yes, for almost everyone, and certainly compared with what most people do instead: the same password on many sites, a spreadsheet, or a notebook by the keyboard. That is the conclusion behind our guide to choosing where to keep your passwords, and it matches official advice: the UK’s National Cyber Security Centre recommends password managers in its guidance for individuals, and NIST tells online services that they must allow them.
What changes is where the risk sits. Instead of dozens of weak points, you have one strong one: the vault, the password and second factor that open it, and the company that runs the service. This page explains how each of these is protected and how to judge a provider.
What the encryption protects
The main password managers describe the same principle: your vault is encrypted on your device with a key derived from your master password, and only the encrypted data is stored on their servers. Most call this “zero knowledge,” meaning that the provider cannot read your passwords. That is the providers’ own description; you cannot check it yourself, which is why audits and open code matter.
The technical details differ, according to each provider’s documentation checked on November 10, 2026:
- Bitwarden uses AES-256 encryption and lets you choose how the key is derived from your master password (PBKDF2 or Argon2id).
- 1Password combines your account password with a separate 128-bit Secret Key to derive the encryption key.
- Proton Pass uses AES-GCM 256-bit encryption and says it also encrypts the vault’s metadata.
- NordPass uses a different algorithm, XChaCha20, with a 256-bit key.
Encryption does not protect against everything. Malware on your computer can read what you type or what the manager fills in, and a fake login page can still trick you into typing a password yourself. If your password manager does not offer to fill in a login on a page that looks familiar, treat it as a warning: the address may not be the real one.
What the incidents showed
Three incidents come up whenever people ask whether password managers are safe. Here is what the providers themselves said.
LastPass, 2022. LastPass reported two linked incidents: in August 2022, part of its source code was stolen, and later that year an attacker copied backups of customer data, including encrypted vaults. According to LastPass’s notice of the incident, the stolen vaults contained website addresses that were not encrypted, while usernames, passwords, and secure notes were encrypted. The practical lesson: the strength of each customer’s master password became the last line of defense, and LastPass advised customers to take further steps in a March 2023 update.
Bitwarden, April 2026. On April 22, 2026, a malicious version of Bitwarden’s command-line tool, published to the npm software registry, was available for about 90 minutes as part of a wider supply-chain incident. Bitwarden stated that it found no evidence that user vault data was accessed. The incident concerned a developer tool, not the apps most people use.
1Password, 2023. In September 2023, 1Password detected suspicious activity on its internal Okta instance, linked to a breach at Okta’s support system. It concluded that no user data was accessed.
How to judge a provider
Before trusting a company with every password you have, check four things on its own website. The table summarizes what we found.
| Provider | Source code | Published security audits |
|---|---|---|
| Bitwarden | Open source | Yearly list of reports, including a 2025 cryptography review by ETH Zurich |
| Proton Pass | Open source (all apps) | Cure53 in 2023, Recurity Labs in 2026 |
| 1Password | Not open source | Penetration test reports available through its Trust Center since November 3, 2025 |
| Dashlane | Client code “source available” | Annual penetration tests, results shared through its Trust Center |
| Keeper, LastPass, NordPass | Not described as open source | Certifications such as SOC 2 and ISO 27001; reports not published on the pages we read |
Open code and public audit reports do not make a product safe by themselves, but they let independent experts check the providers’ claims. Bitwarden’s audit page is a good example of what to look for.
Protecting the vault itself
Whichever provider you choose, the vault is only as strong as what protects it:
- A long master password used nowhere else. It is one of the few passwords you must remember.
- A second factor on the password manager account. The NCSC recommends it explicitly.
- A recovery plan. Write down the recovery code or emergency kit your provider gives you and keep it offline. Some providers, such as Keeper, cannot help you if you lose it.
- Your own devices only. The NCSC considers saving passwords in a browser safe on your own devices, never on a shared or public computer.
One national difference is worth knowing. The Canadian Centre for Cyber Security advises against storing the passwords of sensitive accounts, such as banking and email, in a password manager, and recommends a stand-alone manager with zero-knowledge encryption for the rest. Readers in Canada who follow that advice keep those two passwords in their heads.
The password you still have to remember
The master password deserves the most care of all. Our page on building a password you can actually remember shows what current guidance recommends and how to create one in two minutes.
Comparing the providers on the criteria that matter
Safety is one criterion among several: price, sharing, and platforms matter too. We set out the leading apps side by side, including those that pay no commission to anyone.