crackthe.net
Is a password manager safe? What protects your vault
How password managers protect your vault, what the LastPass breach of 2022 showed, the CVE entries of the managers listed here, and what you can do.
Key points
- The makers of all six password managers listed here say the vault is encrypted on your device before it is synced.
- If someone steals the synced copy, your main password decides how long it holds. In 2022, attackers copied the vault backups of LastPass customers.
- Use a long main password that you use nowhere else. Two-factor sign-in stops logins with a stolen main password, but it does not protect a copy that is already stolen.
How the vault is protected
A password manager keeps your passwords in an encrypted vault. The key that opens it is made from your main password. To slow down guessing, the app runs the main password through many rounds of a key derivation function before the key comes out. Every guess costs an attacker the same work.
All six makers say the vault is encrypted on your device before it is synced. The five that sync it through their own servers say they cannot read it. KeePassXC keeps the vault in a file that you sync yourself, if at all. Where the encrypted vault is kept differs:
| Where the encrypted vault is kept | How the main password becomes the key | |
|---|---|---|
| 1Password | 1Password’s servers, synced to your devices | PBKDF2 with 650,000 rounds, plus a Secret Key that stays on your devices |
| Bitwarden | Microsoft Azure in the US or the EU, or your own server | PBKDF2 with 600,000 rounds by default, Argon2id as an option |
| KeePassXC | a file on your device; you choose where to sync it | Argon2id recommended, no fixed default |
| Keeper | Amazon Web Services in several regions, among them the US and the EU | PBKDF2 with 1,000,000 rounds |
| Passpack | data centers in the US and the EU | PBKDF2 with 1,000,000 rounds |
| Proton Pass | Proton’s servers in Switzerland, Germany, or Norway | bcrypt, number of rounds not stated |
The table shows what the makers state on their own pages. This site has not tested the apps.
What the LastPass breach showed
LastPass is not listed here, but its breach is the best-documented case of stolen vaults. This is how LastPass itself described it:
- August 2022: An attacker got into LastPass’s development environment through one developer’s account and took source code. LastPass saw no access to customer vaults at the time.
- Later in 2022: With information from that break-in, the attacker went after a senior DevOps engineer through flawed third-party software. The keys taken from that engineer opened the company’s cloud backup storage.
- December 2022: LastPass reported that the attacker had copied a backup of customer vault data. Usernames, passwords, and notes in it were encrypted. Website addresses were not.
- March 2023: LastPass said the storage held backups of all customer vault data.
LastPass says it never knows the main password, so the attackers could only try to guess it. They can do that offline, where no lockout after failed attempts slows them down. The default at the time was 100,100 rounds of PBKDF2. Since 2018, LastPass had required main passwords of at least twelve characters. It advised customers with a weaker main password to change the passwords stored in their vault.
The lesson: a stolen vault is only as strong as its main password. Fields that are not encrypted, such as the list of websites, can still show which services you use.
CVE entries of the managers listed here
A CVE entry is a public record of a security flaw. This archive counted the entries in the US National Vulnerability Database (NVD) that concern each manager itself and were published since 2021:
| Tool | Own CVE entries since 2021 | Newest entry |
|---|---|---|
| 1Password | 8 | August 2024 |
| Bitwarden | 16 | October 2026 |
| KeePassXC | 7 | October 2026 |
| Keeper | 1 | July 2023 |
| Passpack | 0 | – |
| Proton Pass | 0 | – |
More entries do not simply mean less safety: widely used apps are examined more closely. What counts is how fast the maker fixes a flaw and that you install the update.
What you can do
- Choose a long main password that you use nowhere else. Several random words are easier to remember than a short password full of symbols, and harder to guess.
- Turn on two-factor sign-in for the password manager. It stops someone who learns your main password from signing in. It does not protect a copy of the vault that is already stolen.
- Install updates for the app and the browser extension, so that fixes reach you.
- Never enter your main password through a link from an email or a text message. After its breach, LastPass stated that it never calls, emails, or texts customers to ask them to click a link and confirm their data.
Next step
The page Password managers compared lists the six managers with their free plans, open source status, devices, and CVE entries.
The figures in this guide come from the archive and change with every data update. As of November 8, 2026.
Check it with the archive's data
Read next: What is a VPN? Meaning, how it works, and what it hidesAll guides