The question shows up in every security Q&A: "Isn't putting all your passwords in one place just creating a single point of failure? If the password manager gets hacked, don't you lose everything?"
It's a reasonable fear. It's also a question where the honest answer is more nuanced than either "yes, you're doomed" or "no, it's perfectly safe."
Password managers can be attacked. They have been attacked. They will be attacked again. But the ways they get attacked are specific and predictable, and understanding them helps you choose a tool and use it in a way that minimizes real risk.
The Attack That Most People Fear (And Why It's Rare)
The fear: an attacker breaks into the password manager's servers, decrypts everyone's vault, and steals all the passwords.
The reality: this is the hardest attack to pull off, and it has never fully succeeded.
Here's why. A properly designed password manager uses zero-knowledge encryption. Your master password never leaves your device. The server stores your vault as ciphertext — scrambled data that can only be decrypted with a key derived from your master password. The vendor doesn't have that key. The attacker who steals the server data doesn't have that key either.
The LastPass breach in December 2022 is the closest this attack has come to succeeding. Attackers stole encrypted vault data for millions of users. But the vaults were encrypted with keys derived from each user's master password. LastPass used PBKDF2 for key derivation, and for users with weak master passwords and low iteration counts, the attacker could brute-force the master password offline and decrypt the vault.
So the attack didn't break the encryption. It exploited weak user passwords combined with outdated key derivation. The encryption held. The human element failed.
This is the key insight: the attack that people fear — "they decrypted all the vaults" — has not happened. The attacks that have happened exploit weak master passwords, poor key derivation, or metadata that isn't encrypted. The encryption itself has held.
The Attacks That Actually Happen
Let's look at the real attacks, not the hypothetical ones.
### 1. Vendor Infrastructure Breach
This is the LastPass scenario. Attackers breach the vendor's servers and steal encrypted vaults and metadata. The vaults are encrypted, but the metadata — email addresses, billing information, password hints — may not be.
**How bad is it?** Depends on your master password strength and the vendor's key derivation. If your master password is strong (20+ characters of random characters) and the vendor uses Argon2id, your vault is effectively safe even if the attacker has a copy. If your master password is "Fluffy2019!" and the vendor uses PBKDF2 with 1,000 iterations, your vault can be cracked.
**How to protect yourself:** Use a strong master password. Choose a manager with modern key derivation (Argon2id). Check whether the vendor has had breaches and how they responded. Understanding encryption standards helps you evaluate this.
### 2. Malware on Your Device
An attacker gets malware onto your computer. They log your keystrokes, capture your screen, or steal the decrypted vault from memory while the password manager is unlocked.
**How bad is it?** Very. If an attacker has malware on your device, they can capture your master password as you type it and then access your vault directly. No encryption helps here because the attack happens after decryption.
**How to protect yourself:** This is the attack that offline password managers don't solve either. The protection is device security, not password manager choice. Run antivirus software. Keep your OS updated. Don't install software from untrusted sources. Use a hardware security key for two-factor authentication on your most important accounts so that even if passwords are stolen, attackers can't use them without the physical key.
### 3. Phishing the Master Password
An attacker sends you a convincing email: "Your password manager subscription has expired. Log in to update your payment method." You click the link, land on a fake login page, and enter your master password.
**How bad is it?** Catastrophic. The attacker now has your master password. If they also have access to your synced vault (through a cloud-based manager), they can decrypt everything.
**How to protect yourself:** Be suspicious of any email asking you to log into your password manager. Access the manager directly through the app or extension, never through an email link. Enable two-factor authentication on your password manager account if the tool supports it — then even a stolen master password isn't enough.
### 4. Browser Manager Credential Exposure
If you use a browser-based password manager, the protection of your saved passwords depends on your OS login. On a shared computer, anyone who can log in can view your saved passwords in the browser settings.
**How bad is it?** Moderate to high depending on who has access. On a personal laptop that only you use, this is low risk. On a shared family computer or a work laptop, it's a real problem.
**How to protect yourself:** Use a dedicated password manager with a master password rather than relying on browser autofill. If you must use a browser manager, enable Firefox's Primary Password or use a separate OS user account for each person.
### 5. Supply Chain Attacks on the Manager Software
An attacker compromises the password manager's update infrastructure and pushes a malicious update that steals master passwords before they're used for encryption.
**How bad is it?** Theoretically catastrophic, but extremely rare. This happened with the Kaseya VSA attack in 2021 (a different type of management software, not a password manager) and the SolarWinds attack in 2020. No major password manager has suffered a confirmed supply chain attack, but the risk exists.
**How to protect yourself:** Choose open-source managers where updates can be independently verified. Pay attention to security advisories from the vendor. Consider offline managers where you control update timing and can review changes before applying them.
Is Local Password Storage More Secure?
A common question: if I use an offline password manager with local storage, am I safer?
The answer is: safer from vendor breaches, yes. Safer from malware and phishing, no.
Local storage eliminates the vendor infrastructure attack surface. There's no server to breach. There's no metadata to steal. There's no central target. The attacker would need to target you individually, which is far harder for most attackers.
But local storage doesn't protect against malware on your device, phishing of your master password, or physical theft of your device. Those attacks work the same way regardless of whether your vault is local or cloud-synced.
The net effect: local storage reduces your attack surface from "vendor + your device" to "just your device." That's a meaningful reduction, especially if you're concerned about vendor breaches. But it's not a complete solution.
How Secure Is Your Password Manager, Really?
Here's a framework for assessing the real security of any password manager:
**Encryption:** Is it AES-256 with Argon2id key derivation? If it's PBKDF2, are the iterations at least 600,000? Weak key derivation is the most common real-world vulnerability.
**Architecture:** Is it zero-knowledge? Does the vendor hold your encryption key, or do you? Zero-knowledge means a vendor breach can't decrypt your vault even if the encrypted data is stolen.
**Account surface:** Does the tool require an account? An account means metadata exists — email, billing, usage data. No-account managers eliminate this surface entirely.
**Your master password:** Is it strong? A 20-character random master password defeats brute-force attacks even if your encrypted vault is stolen. A weak master password undermines every other security measure.
**Your device:** Is it clean? Malware on your device bypasses all encryption. Device security is the foundation that password manager security is built on.
The Bottom Line
Can a password manager be hacked? Yes. Has it been hacked? Yes, in specific ways that exploited specific weaknesses. Does that mean you shouldn't use one? No.
The alternative to a password manager is reusing passwords, writing them down in a notebook, or using a spreadsheet. All of those have worse security properties than even a breached password manager. The LastPass breach was bad. Reusing "Summer2024!" across forty accounts is worse.
The right question isn't "can it be hacked?" The right question is "have I chosen a tool with strong encryption, modern key derivation, and an architecture that minimizes the damage if a breach happens?" Combined with a strong master password and a clean device, a good password manager reduces your risk dramatically compared to any alternative.
Use one. Use it well. And understand the risks so you can make informed choices about which one and how.
