A password manager asks you to put all your logins in one place, which sounds risky until you see how it works. This guide explains the mechanics in plain words. It is part of our password managers guide. If you are brand new to the idea, start with password managers explained for beginners.
What happens when you save a password
When you save a login, the app encrypts it before anything else happens. Encryption scrambles the data so that it looks like random noise without the right key.
That key comes from your master password. The app runs your master password through a deliberately slow calculation to produce the key, which makes guessing far more expensive for an attacker.
What zero-knowledge means
Good cloud-based managers use what is called a zero-knowledge design:
- Your master password stays on your device and is never sent to the company.
- Your vault is encrypted on your device.
- Only the scrambled vault is uploaded to sync between your devices.
If the company's servers were copied, the attacker would get encrypted vaults, not your passwords. They would then have to guess each master password, which is why yours needs to be long and random. Some managers add a second secret stored on your devices, so a stolen vault is harder still to attack.
Why this beats your memory
The real comparison is not with perfect security. It is with what most people actually do:
| Habit | Risk |
|---|---|
| Reusing one password | One leak opens many accounts |
| Small variations of one password | Attackers spot the pattern |
| A notes app or spreadsheet | Readable by anyone who gets in |
| A password manager | One strong master password guards unique passwords |
A manager also helps you spot fake login pages. It links each login to a real web address, so it will not offer to fill your password on a lookalike site.
Where the real risks are
A password manager is not magic. It has failure modes, and you should know them:
- A weak master password. This is the most important risk, because a copied vault can be attacked offline.
- Malware on your device. While your vault is unlocked, malicious software may be able to read what you can read. Read about password-stealing malware.
- Losing access. If you forget the master password, the provider usually cannot help. Plan emergency access and backups early.
- A breach at the provider. Past incidents show that encrypted vaults can be stolen, as we cover in what to do if your manager gets hacked.