Explainer · Security basics
Are password managers safe?
It's the right question to ask before trusting one tool with the keys to your whole life online. The honest answer: yes, a reputable one is far safer than what most people do now — but the LastPass breach showed why which one you choose matters. Here's how they work and what to watch.
Last updated: July 10, 2026 · Written by the Privacy Intact team; see how we review.
How a password manager actually protects you
A manager stores all your logins in an encrypted "vault." The crucial part is zero-knowledge encryption: your vault is locked and unlocked on your own device with your master password, and the company only ever holds the scrambled version. They can't read your passwords — and crucially, neither can an attacker who breaks into their servers, because what they'd steal is unreadable without your master password.
That's the whole security model in one sentence: the company stores your data but can never see it. It's why a good manager is trustworthy even though it holds so much.
"But isn't one vault a single point of failure?"
It's the most common worry, and it gets the risk backwards. For almost everyone, the real danger isn't a cracked vault — it's password reuse. Use the same password in ten places and a single leak hands an attacker all ten. That's how most people actually get compromised.
A manager's entire job is to kill reuse: every account gets its own long, random password that you never have to remember. Yes, you're concentrating risk into one vault — but it's a vault with zero-knowledge encryption and (with a strong master password) one that's far harder to crack than the weak, repeated passwords it replaces. The trade is overwhelmingly in your favour.
The LastPass lesson: which manager matters
Here's the honest caveat. LastPass, long a default pick, it suffered a major breach in 2022–2023 in which attackers stole encrypted copies of more than 25 million users' password vaults — and because many older vaults used weak password-strengthening settings and stored website addresses unencrypted, security researchers have since linked the stolen data to large-scale cryptocurrency theft. The encryption meant strong master passwords largely held — but weaker ones were exposed to brute-forcing, and the sheer scale was a wake-up call.
The takeaway isn't to distrust all managers — it's that a manager's engineering and track record are part of its security. Choose one that uses solid encryption defaults and hasn't handed its users' vaults to attackers. Our picks all clear that bar; LastPass is the one we steer people away from.
The real risks (and how to shut them down)
- A weak master password. Everything rests on it. Use a long passphrase of several random words, unique to your manager, and never write it in an email or note.
- No second factor. Turn on two-factor authentication for your manager, so a leaked master password alone can't open your vault.
- Phishing. A manager won't autofill on a fake domain — a quiet superpower — but if you manually type your master password into a convincing fake page, it's exposed. Slow down on urgent "log in now" messages.
- An infected device. The manager can't protect you if malware is already watching your keystrokes — which is why basic device hygiene and updates still matter.
The bottom line
A reputable password manager is one of the highest-impact, lowest-effort upgrades you can make to your security — and you don't have to pay for it. The only real homework is picking a trustworthy one and protecting your master password.
FAQ
Password manager safety, answered
Are password managers safe to use?
Yes — for the vast majority of people, a reputable password manager is far safer than the alternative of reusing or memorising passwords. They use zero-knowledge encryption, meaning the company itself can't read your vault and neither can an attacker who breaches their servers. The data is useless without your master password. The thing to choose carefully is which one, based on its engineering and track record.
Isn't putting all my passwords in one place risky?
It feels that way, but the opposite is true. The realistic threat for most people isn't a cracked vault — it's password reuse, where one leaked password unlocks ten accounts. A manager fixes exactly that by giving every account a strong, unique password you don't have to remember. With zero-knowledge encryption and a strong master password, the 'one basket' is a very well-locked one.
What happened with LastPass?
LastPass — once a top recommendation — it suffered a major breach in 2022–2023 in which attackers stole encrypted copies of more than 25 million users' password vaults — and because many older vaults used weak password-strengthening settings and stored website addresses unencrypted, security researchers have since linked the stolen data to large-scale cryptocurrency theft. The lesson isn't "password managers are unsafe"; it's that engineering and track record matter, and that you should choose a manager that hasn't exposed its users' vaults. Plenty haven't.
What's the single most important thing to get right?
Your master password. It's the one key to everything, so it must be long, unique, and never reused anywhere else — a passphrase of several random words works well. Pair it with two-factor authentication on your manager, and even a determined attacker is locked out.