A hack at a password manager company sounds like the worst case. In practice it depends on how the product was built and how strong your master password is. This guide belongs to our password managers section.
What attackers actually get
With a zero-knowledge design, as explained in how password managers work, stolen vaults are scrambled. But a breach can still expose:
- Your email address and account details.
- Some unencrypted data, such as website addresses in certain older designs.
- The encrypted vault, which an attacker can try to crack offline.
That last point is the reason your master password matters. With six random words, offline guessing is not practical. With a short or reused password, it may be.
There are several kinds of "hacked"
| What happened | Risk to you | What to do |
|---|---|---|
| Provider's servers breached | Vault copied, needs cracking | Follow the steps below |
| Your device infected | Unlocked vault may be readable | Clean the device, then change passwords |
| Your master password phished | Vault can be opened | Change it now, then all key passwords |
| A fake app or extension | Whatever you typed is stolen | Remove it, then change passwords |
What to do after a provider breach
- Read the company's official notice, using its website rather than an email link.
- Change your master password if it was at all weak or reused.
- Turn on two-factor login for the vault.
- Replace the passwords for your email, bank and other key accounts.
- Move any crypto secrets out of the vault at once. Those should never have been stored digitally.
- Reset two-factor codes stored in the vault for your important accounts.
- Watch out for phishing, since attackers may use your email address and details. See fake security alerts.
If your device was infected
No master password protects a vault while malware watches you unlock it. Clean or replace the device first, then change passwords from a safe device. Read about password-stealing malware.
How to judge a provider afterwards
Look at how quickly it disclosed the breach, how clearly it explained what was exposed, and what it changed. Honest reporting is a good sign. If you want to leave, follow our guide to switching password managers safely.