Is a password manager safe if the company gets hacked?
How the encryption actually works, what a real breach of a manager did and did not expose, the risk that is genuinely yours, and when a manager is still the right answer.
- Difficulty
- beginner
- Time
- 10 min
- Read
- 3 min
- Safety
- caution
Short answer
Yes, for almost everyone. A reputable manager encrypts the vault on your device with a key derived from your master password, and the provider never has that password — so a breach of their servers yields encrypted data rather than your passwords. The risk that remains is a weak master password, which is under your control. The alternative, reuse, is worse by a wide margin.
This is the most common objection to password managers, and it is a reasonable one: concentrating every password in one place looks like a single point of failure. It is worth understanding what is actually stored where, because the answer changes the calculation substantially.
Safety
Step by step
- Understand where the encryption happens.In a well-designed manager, the vault is encrypted and decrypted on your own device. The key is derived from your master password, which is never sent to the provider. What sits on their servers is a block of ciphertext they cannot read.
- Understand what a provider breach therefore yields.Encrypted vaults, plus whatever metadata the provider stored unencrypted — often the web addresses of the sites in the vault, and account email addresses. That metadata matters for targeted phishing, which is the practical consequence.
- See where the real risk sits.With the master password. A stolen encrypted vault can be attacked offline, without rate limits, for as long as the attacker likes. A short or reused master password will eventually fall; a long unique one will not.
- Make the master password properly strong.Four or five genuinely random unrelated words, chosen at random rather than composed into a phrase. Long, memorable, and used nowhere else, ever.
- Turn on two-factor authentication for the manager itself.It protects the account against someone signing in as you, which is a different attack from a server breach and a much more common one.
- Check the provider's design decisions, not its marketing.Look for zero-knowledge or end-to-end encryption described in technical terms, published independent security audits, and a clear account of what is and is not encrypted. Providers who have handled a breach transparently are a better sign than providers who have never mentioned security.
- Keep a recovery route on paper.Most managers cannot reset a forgotten master password by design. Write down the emergency kit or recovery code and keep it somewhere physical.
- Compare it with the actual alternative.Not a perfect system — reused passwords, browser-saved passwords, or a notebook. Against those, a manager wins clearly on every realistic threat.
Alternatives
- Your browser's built-in manager: Free, convenient and far better than reuse. Weaker if you use more than one browser or operating system, and it stores only passwords. Protect the account behind it properly.
- The operating system keychain: Apple and Google both offer good password and passkey storage tied to your account. Excellent within one ecosystem, awkward across two.
- An offline manager with a local file: The vault never leaves your devices, so there is no provider to breach. You take on syncing and backup yourself, and losing the file loses everything.
- Paper in a locked drawer: Immune to remote attack and genuinely used by many people safely at home. It does not sync, it cannot be searched, and it is a poor fit for anyone who signs in on the move.
Questions people ask
Has a major password manager actually been breached?
Yes — encrypted vaults have been taken from at least one large provider, along with some unencrypted metadata such as stored site addresses. The vaults themselves were encrypted, and the practical harm concentrated on users with weak master passwords and on targeted phishing using the metadata.
What if I am locked out because the service is down?
Reputable managers cache the vault locally so it works offline. Check that your chosen one does before relying on it.
Is it safer to use passkeys instead?
For accounts that support them, passkeys remove the shared secret entirely and are stronger. Most people will run both for years, and a manager that syncs passkeys handles them together.