How Do Password Managers Work, and Are They Safe?

A password manager is an app that remembers your passwords for you. It saves each login in an encrypted vault, creates a strong, unique password for every new account, and fills your details in when you visit a site or open an app. You unlock it with one master password, a passkey or your phone's biometrics.

Good password managers are designed so that even the company that makes them cannot read your vault. That is the key to why they are safe, and it is worth understanding before you pick one.

Why you need one at all

Most account takeovers do not involve clever hacking. They happen because people reuse the same password on many sites. When one site is breached, criminals try those email and password pairs everywhere else, a technique known as credential stuffing.

The fix is simple in theory: use a different, long, random password for every account. In practice nobody can remember hundreds of random strings. A password manager does the remembering, so you only need one strong password.

How the vault is protected

Here is what happens behind the scenes in a well-designed password manager:

1. You create a master password. This is the one password you need to remember. It is never meant to be sent to the provider in a readable form.
2. Your device derives an encryption key. The app runs your master password through a slow key-derivation function such as PBKDF2 or Argon2. This turns it into a strong encryption key and makes guessing attacks slow and expensive.
3. Your vault is encrypted locally. Your logins, notes and cards are encrypted on your device, typically with AES-256 or a similar modern cipher, before anything is synced.
4. Only encrypted data is uploaded. The provider's servers store the scrambled vault so you can sync it across devices. Without your key, it is unreadable.
5. Decryption happens on your device. When you unlock the app, your device decrypts the vault in memory so you can use it.

Providers describe this as zero-knowledge or end-to-end encryption. The provider holds your data but has no knowledge of what is in it.

How the major providers describe their security

Every provider words this a little differently. Here is what each one says on its own site, in brief:

We summarize these claims from each provider's site; we do not audit them ourselves. 1Password's Secret Key is worth a special mention: because a random key created on your device is mixed into the encryption, someone who steals the encrypted vault cannot try to guess your password alone.

What "independently audited" means

Encryption is only as good as its implementation. That is why many providers hire outside security firms to review their apps and infrastructure, or publish their source code so anyone can inspect it.

When you compare products, look for:

• Published audit reports or summaries from named third-party firms.
• Open-source code, as with Bitwarden and Proton Pass, which lets independent researchers check how encryption is done.
• Certifications such as SOC 2 or ISO 27001, which focus on how a company manages security operationally.
• A bug bounty program, which pays researchers to report flaws responsibly.

None of these guarantees perfection, but a provider that is open about testing is easier to trust than one that says nothing.

Where the real risks are

The weak points in a password manager are usually not the encryption itself. They are:

• A weak or reused master password. If your master password is short or used elsewhere, an attacker with your encrypted vault has a much easier time guessing it. Use a long passphrase of several random words that you use nowhere else.
• No two-factor authentication. Turn on 2FA for your password manager account using an authenticator app, a hardware security key or a passkey. This stops someone who learns your master password from logging in on a new device.
• Malware on your device. If your computer is infected, malware could capture what you type or read the unlocked vault. Keep your system updated and consider reputable antivirus software.
• Phishing. Password managers help here, because autofill only works on the real website address. If your manager does not offer to fill a login, stop and check the URL.
• Losing access. Because providers cannot see your master password, they usually cannot reset it. Set up recovery options in advance, such as an emergency kit, recovery codes or a trusted emergency contact.

Are browser password managers good enough?

Chrome, Safari, Edge and Firefox all have built-in password managers, and Apple and Google sync passwords across their own devices. They are free and much better than reusing passwords.

A dedicated password manager is worth it when you use more than one browser or ecosystem, for example an iPhone with a Windows PC. Dedicated managers also add secure sharing with family, breach and weak-password reports, secure notes and cards, and passkeys that work on all your devices.

How to get started safely

1. Pick a reputable manager with zero-knowledge encryption and apps for all your devices. Our password manager rankings compare the main options.
2. Create a strong master password. A passphrase of several unrelated words is long and memorable.
3. Turn on two-factor authentication right away.
4. Save your recovery details somewhere safe and offline.
5. Import your existing passwords from your browser, then turn off the browser's own password saving to avoid confusion.
6. Run the security report. Most managers flag weak, reused or breached passwords. Change the most important ones first: email, banking and anything linked to payments.
7. Add passkeys where sites offer them. Our passkeys guide explains how.

The bottom line

A password manager is one of the most effective security upgrades you can make. The good ones encrypt your vault on your own device so the provider cannot read it, and they make it easy to use a unique password everywhere. Choose a provider that is open about its security, protect it with a strong master password and two-factor authentication, and you will be far safer than with passwords you have to remember. Not sure whether to pay? Read free vs paid password managers.