Password Manager Security
Is It Safe to Put Everything in One Password Manager?
For most people, storing passwords in one reputable password manager is substantially safer than reusing memorable passwords or scattering them across browsers, notes, spreadsheets, and paper. The vault becomes a high-value target, but it also makes unique random passwords practical.
The honest answer is not “one vault has no risk.” It is that the alternatives usually create more frequent and less controllable failures.
Concentration risk is real
If an attacker obtains your unlocked vault, the impact can be severe. It may contain access to email, banking, cloud storage, tax records, social accounts, and recovery codes.
That makes four defenses especially important:
- A long, unique master passphrase
- Strong MFA on the password-manager account
- Secure, updated devices
- A provider whose server cannot decrypt the vault
NIST's password-manager FAQ describes the same tradeoff: compromise of the master secret could require replacing every vault password, but password managers enable strong unique credentials and many cloud systems are designed so the provider cannot access the vault. See the NIST Digital Identity Guidelines FAQ.
The alternative is usually password reuse
Without a manager, people tend to choose memorable passwords and reuse patterns. A breach at one site can then become a credential-stuffing attack against unrelated accounts.
NIST's current guidance says password managers increase the likelihood that users choose stronger passwords, particularly when generators are included, and requires covered verifiers to permit password managers and autofill. See NIST SP 800-63B.
The Federal Trade Commission also recommends using a reputable password manager and protecting its password carefully.
One vault changes the risk from many weak, repeated secrets to one heavily protected access path plus unique credentials for every destination.
Threats a password manager helps reduce
Credential stuffing
If every site has a unique random password, a breach at one service does not reveal a working password for another.
Guessable passwords
The generator can create long random credentials unconstrained by human memory.
Fake-domain autofill
A careful extension matches saved credentials to the destination domain. Refusing to fill on a lookalike domain can alert the user to phishing. This protection depends on correct implementation and can be defeated if the user manually copies credentials into the wrong site.
Insecure personal storage
Encrypted vaults are generally safer than plaintext documents, email drafts, browser notes, or screenshots.
Threats it does not eliminate
Compromised endpoint
Malware running with sufficient privilege may read plaintext after the vault is unlocked, capture keystrokes, modify pages, or steal session material.
Encryption at rest cannot protect data while an authorized device is actively displaying it.
Malicious or vulnerable extension
Browser extensions run close to sensitive web content. Keep the extension updated, install it only from an official source, and remove unnecessary extensions that expand the browser attack surface.
Phishing for the master password
Autofill protections help with saved site credentials, but the password manager's own login page can still be imitated. Verify the domain and avoid entering the master password after following an unsolicited message.
Weak master password
If an attacker steals encrypted vault material and verification data, a weak master password may be guessed offline. Argon2id and strong work factors increase the cost of guessing; they do not rescue Summer2026!.
Recovery abuse
Every recovery code, authorized device, organizer, or emergency contact creates another path that must be protected. See What Happens If You Forget Your Master Password?.
Should everything go in the same vault?
Not automatically.
It is reasonable to store:
- Unique site passwords
- Account usernames
- Recovery URLs and instructions
- Secure notes required for ordinary account use
- Random answers to legacy security questions
Use more caution with:
- The password manager's own recovery code
- The only copy of its master password
- Instructions needed after the vault becomes unavailable
- Cryptocurrency seed phrases controlling substantial value
- Complete identity-document collections
- Secrets governed by an employer or client
- Material that one emergency contact should never receive
The issue is not that a vault cannot encrypt these items. It is correlated failure: if the vault, master password, or recovery contact is compromised, every colocated secret may be exposed at once.
A tiered storage model
For many households, a sensible arrangement is:
Daily vault
Store ordinary logins and secure notes in the password manager.
Offline recovery packet
Store the password-manager recovery material, essential instructions, and location of estate documents in a physically secured place.
Specialized high-value storage
Use separate controls for cryptocurrency seed phrases, business signing keys, or other assets whose compromise would be catastrophic and irreversible.
Legal documents
Use wills, trusts, powers of attorney, and provider legacy tools to express authority and intent. A vault is not a substitute for them. See Password Manager vs. Digital Estate Plan.
How Lockstep reduces vault concentration risk
Lockstep encrypts vault fields on the client with a random AES-256-GCM vault key. The master password is used through a password-derivation process to create a separate key that wraps the vault key. The server stores encrypted records and the wrapped vault key, not the plaintext vault or unwrapped key.
New accounts use Argon2id with 64 MiB of memory, three passes, and one lane. The intent is to make offline password guessing materially more expensive while keeping legitimate unlocks practical.
That architecture reduces the consequence of a server database breach. It cannot prevent compromise of an unlocked endpoint, disclosure of the master password, or every implementation error. See Can a Password Manager Provider Read Your Passwords? for the complete boundary.
Practical safety checklist
- Use a long, unique master passphrase.
- Enable MFA for the password manager.
- Never reuse the master password anywhere else.
- Keep operating systems, browsers, and extensions updated.
- Remove unnecessary browser extensions.
- Lock the vault automatically after inactivity.
- Review authorized devices and revoke old ones.
- Maintain an external recovery plan.
- Test exports or backups before relying on them.
- Separate secrets when one compromise would be irreversible.
The bottom line
One password manager is a concentration of value, but password reuse is a concentration of vulnerability distributed across dozens of poorly defended sites.
For most people, a well-protected zero-knowledge vault with unique passwords, MFA, device hygiene, and an external recovery plan is the safer system. Do not confuse “safer” with “invulnerable,” and do not put the only key to the vault inside the vault itself.