| Situation | What the evidence shows | Planning use |
|---|---|---|
| Provider breach (LastPass) | An unknown threat actor accessed cloud-based storage and encrypted password vaults | Pair any cloud-synced manager with a strong master password that is unique to the vault. |
| Provider-side encryption | AES 256-bit encryption with zero-knowledge architecture, so providers cannot access your passwords | Prefer managers that describe both the cipher and the zero-knowledge design. |
| Manager account compromised | Everything stored in the manager is exposed | Treat the manager login as your most valuable account. |
| Autofill on a non-matching site | Managers will not fill passwords on sites that do not match the stored credentials | Pause and check the address when autofill does not appear. |
| Browser password saving next to a manager | Password Boss advises disabling the browser’s save-password option when using a manager | Turn browser saving off once your logins live in the manager. |
| Browser-only storage | Browsers often lack the more robust security measures found in dedicated managers | Keep important accounts in a dedicated manager. |
These behaviours come from SBS CyberSecurity’s review of password manager security and Password Boss’s pros and cons of using a password manager.
Is it safe to use a password manager? Yes for most people, provided the master password is strong and a second factor protects the vault. Breaches have happened, and they show exactly where the remaining risk sits.
This guide sits within our wider advice on how to protect yourself from hackers, and it focuses on the decisions that change your exposure rather than on a product ranking.
What breaches show about the real risk
The clearest test of a password manager’s safety is what happened when providers were actually attacked. SBS CyberSecurity describes the LastPass incident as a security breach in which customer information was accessed, and in which an unknown threat actor reached the company’s cloud-based storage environment and encrypted password vaults.
LastPass: encrypted vaults reached
The word that matters in that account is encrypted. Someone who copies an encrypted vault holds scrambled data, not a readable list of logins, so the outcome depends on how well the vault is encrypted and how strong the master password is. Hexnode’s explainer puts the dependency bluntly: if the master password is weak, the vault becomes a fancy box with a paper lock. The practical consequence is that a cloud-synced manager moves some risk onto the provider’s servers, and your master password decides how much of that risk lands on you.
NortonLifeLock: pressure on the login
In January 2023, NortonLifeLock reported a credential stuffing attack, according to SBS CyberSecurity. That is a different failure from a stolen vault, because the pressure falls on the manager account’s login rather than on stored data. Password Boss notes that attackers know a compromised manager exposes everything stored in it, which is why the manager login deserves stronger protection than any single website account.
Weighing the two cases
Both incidents point the same way. The danger is concentrated in a few things you control: the master password and the extra protection on the manager account. That concentration is the real trade-off of using a manager, and it explains why the following sections spend their time on those controls.
Master password: the single point of failure
Everything in the vault sits behind the master password, so its strength is the biggest lever you have. Hexnode’s overview states that vault security falls to master password strength, and Silverback Consulting advises avoiding personal information such as birthdays or names.
The same dependency cuts the other way. Password Boss points out that users who lose their master password could lose access to all of their passwords at once. A good master password therefore has two jobs: it must resist guessing, and you must be able to recall it reliably. Our guide on how to create a strong password covers methods that balance both.
Browser password saving versus a dedicated manager
Browser password managers are the weaker choice. Saving logins in the browser is convenient, but the evidence favours dedicated tools for anything that matters.
- Fewer protections. SBS CyberSecurity says browsers often lack the more robust security measures found in dedicated password managers. Silverback Consulting names end-to-end encryption and dark web monitoring among the features browser storage lacks.
- A more obvious target. Password Boss describes the browser password vault as often an obvious and easy-to-hack target, in contrast with a dedicated manager’s vault.
- A sensible dividing line. If you keep any logins in the browser at all, limit them to accounts whose loss would cost you little, and keep email, banking and the manager’s own login in the dedicated vault.
Locking down your vault
A strong master password handles the stolen-vault case, and the controls below cover the rest of the surface.
- Add two-factor authentication. Silverback Consulting recommends combining the master password with a second authentication factor, and Hexnode notes that reputable managers support multi-factor authentication. The second factor gives the manager login a layer of protection beyond the master password alone.
- Let the vault lock itself. Hexnode says reputable managers lock automatically after inactivity. Leave that behaviour switched on so an unattended device does not leave the vault open.
How the encryption model works
Hexnode defines a password manager as an encrypted digital vault that stores logins behind a master password. Reputable products encrypt that vault with AES 256 bit encryption, a method SBS CyberSecurity calls among the strongest available. Cipher strength is only part of the model, though. The other part is who holds the key.
Zero-knowledge and end-to-end encryption
Hexnode says most reputable password managers use zero-knowledge architecture, and SBS CyberSecurity explains that this ensures even the service providers cannot access your passwords. Silverback Consulting describes the same end-to-end idea in plain terms: only you have the decryption key. The consequence is that provider staff, or an intruder who reaches the provider’s servers, still face encrypted data they cannot read without your key. That is why the LastPass incident turned on the strength of encrypted vaults rather than on a list of exposed passwords.
What cloud storage adds
Zero-knowledge does not remove every exposure. SBS CyberSecurity lists storage of sensitive data on external servers as a potential vulnerability if the provider’s own security fails. Set against browser storage, the comparison is straightforward: a dedicated manager combines AES 256-bit encryption with a key only you hold, while browser storage lacks end-to-end encryption. A cloud-synced vault carries server-side exposure, but its contents stay protected by the encryption and your master password.
Choosing a manager that fits
- Zero-knowledge design. Check that the provider describes zero-knowledge architecture, since that is what keeps stored passwords out of the provider’s reach.
- Open-source code. Silverback Consulting cites Bitwarden and KeePass as open-source examples. Open code lets outside experts inspect how the software works, which suits readers who prefer transparency over marketing claims.
- Ease of use. A manager you find confusing is one you may abandon. Readers who want a simpler setup can start with our comparison, Best Password Managers For Seniors: Simple, Secure, And Easy To Use In 2026 – Cubeguard.
Frequently asked questions
Can a phishing page imitate my password manager?
Yes. Silverback Consulting warns that phishing scams can target password manager users by mimicking the software’s interface. A second factor on the manager account means a stolen master password alone is not enough to get in.
What if I forget my master password?
You could lose access to all of your saved logins at once, according to Password Boss. Choose a master password you can recall reliably before you move your accounts into the vault.
What counts as a second factor for my vault?
Silverback Consulting gives a smartphone app or a biometric login as examples of a second authentication factor that can be combined with your master password.
