Password Managers: Are They Safe in 2026?

The short answer

Yes, a password manager is safer than the alternatives, and no, that is not the whole story. The encryption used by every mainstream vault is not the weak point. The weak points are your master password, your device, and the settings you never opened.

That distinction matters because the question people usually ask is "has this company ever been hacked?" when the more useful question is "if this company is hacked tomorrow, what does the attacker actually get, and does my setup slow them down?" The LastPass incident of 2022 is the best case study we have for answering that, and it is worth understanding properly rather than as a headline.

What a password manager protects, and what it does not

Mainstream password managers use what is usually called zero-knowledge architecture. Your vault is encrypted on your device with a key derived from your master password, and the provider stores only the encrypted blob. The provider never receives the master password, which means a server breach hands the attacker ciphertext rather than a list of your logins.

The UK's National Cyber Security Centre takes this seriously enough to recommend password managers to consumers and businesses, while being blunt that they are a good thing for now, rather than forever. Its password manager buyers guide also flags the detail most reviews skip: it is worth checking which fields are encrypted, because you may want data such as the domains you have saved passwords for to be encrypted too.

So three things sit outside that protection:

The master password. It is the single key to everything, and it is stored in your head, not on their servers.
Your device. Once the vault is unlocked, the contents are in memory and on screen. Encryption at rest does nothing about malware sitting next to it.
The metadata. Depending on the product, the list of sites you hold accounts with may not be encrypted at all.

What the LastPass breach really taught us

In August 2022 an attacker got into LastPass's development environment. In a second stage, a DevOps engineer's home computer was compromised and the keys obtained there opened cloud storage holding customer data. The company's December 2022 notice confirmed that a backup of customer vault data was copied, and described it as a proprietary binary format containing both unencrypted data such as website URLs and fully encrypted fields including usernames, passwords, secure notes and form-filled data. A March 2023 update added that a backup of the multifactor database was also taken, encrypted, but with the separately stored decryption key included in the secrets the attacker had already obtained.

Three lessons come out of that, and all three generalise to any provider.

A stolen vault is an offline problem. Online, a service can rate limit you. Offline, the attacker has the file, unlimited attempts, and modern GPUs. The only thing standing between them and your logins is how expensive each guess is, which is a function of your master password and the key derivation settings.

Metadata is worth stealing on its own. A list of the sites you bank with, the exchange you hold crypto on, and the email provider you use is a targeting list. Several of the account takeovers reported after that breach began with the attacker knowing exactly where to aim.

Stated defaults are not the same as your settings. LastPass had raised its default to 100,100 PBKDF2 iterations in 2018, but the change was not applied retroactively, so long-standing accounts kept far weaker settings that nobody had told their owners about. After the breach the recommended minimum was revised upward to 600,000, which matches the figure in the OWASP Password Storage Cheat Sheet for PBKDF2-HMAC-SHA256. If you have held any vault account for more than a few years, that setting is the first thing to check.

The five ways a vault actually gets opened

Almost nothing on this list is a failure of AES.

A weak or reused master password

If the master password appears in a breach corpus, or is short enough to fall to an offline attack, everything else is decoration. Current guidance has moved firmly toward length: NIST SP 800-63B-4, finalised in 2025, recommends at least 15 characters where a password is the only factor, prohibits forced composition rules, and drops routine expiry in favour of changing only when there is evidence of compromise. The NCSC's three-random-words approach lands in the same place from a different direction.

Your device, rather than their servers

Infostealer malware is the quiet epidemic behind most credential theft, and it targets the browser's saved passwords, the OS keychain and the password manager alike. Verizon's analysis of infostealer logs in its Data Breach Investigations Report research found that in the median case only 49% of a user's passwords across different services were distinct from each other, which is why a single infected machine cascades into a dozen account takeovers. No vault design survives an attacker with code running on your unlocked device. It is worth being clear about which layer each tool covers, because they are not interchangeable: encrypting your connection protects traffic in transit, and our guide to choosing a VPN for a small business in 2026 walks through that decision, but no VPN stops malware that is already running on the machine.

Phishing the login rather than the encryption

A convincing "your vault session expired" email is cheaper than cryptanalysis. The manager's own protection here is boring but effective: autofill matches on the registered domain, so if the extension does not offer to fill on a page that looks like your bank, treat that as a warning rather than a bug.

Account recovery and the second factor

Recovery is the designed-in bypass of your master password. Emergency access contacts, recovery kits, SMS codes on a number that can be ported away: each is a path in. Recovery deserves the same scrutiny as the front door.

Sharing, exports and forgotten backups

Most managers can export the entire vault as plain text. That file, sitting in a downloads folder from the last time you migrated, undoes everything above.

The settings that decide whether your vault holds

Work through these once and you have addressed most of the realistic risk.

Make the master password long, not clever. A passphrase of several unrelated words beats a short string of symbols, and it is the one credential you should never reuse anywhere.
Check your key derivation settings. If your provider exposes an iteration count, 600,000 is the current OWASP figure for PBKDF2-HMAC-SHA256. If Argon2id is offered, prefer it. Raising the setting re-encrypts your vault, so do it while you have your recovery details to hand.
Put strong multifactor authentication on the vault account itself. An authenticator app or a hardware security key, not SMS.
Store the recovery kit offline. Printed, in a drawer. Not in the vault it recovers, and not in cloud storage protected by a password stored in that same vault.
Delete old exports and check what sharing is still active. Shared items outlive the reason they were shared.
Keep the app and browser extension updated. Vault clients are high-value targets and patches matter.
Turn off clipboard persistence where the product offers it, so copied passwords do not linger.

Browser built-in or standalone: which is safer?

The honest answer is that the gap has narrowed. First-party browser and platform managers benefit from deep integration with the operating system's own security, they are free, and they are already there, which matters because the manager people actually use beats the better one they abandon.

Standalone managers still win on three fronts: they work the same across Windows, macOS, Android, iOS and Linux without pushing you into one ecosystem; they usually offer more control over encryption settings, sharing and audit; and independent security audits of the client are easier to find. Against that, a standalone product is one more vendor holding your data, and browser-stored credentials are exactly what infostealers are written to grab.

For most people the useful framing is not which is theoretically stronger, but which one you will keep using on every device you own.

Passkeys change the maths, but they do not empty your vault

Passkeys are genuinely different: there is no shared secret to phish, steal or reuse. The FIDO Alliance reported on World Passkey Day 2026 that an estimated 5 billion passkeys are now in use worldwide, with awareness near universal and three quarters of consumers having enabled one somewhere.

The gap is between adoption and replacement. The same research found that among organisations that have deployed passkeys, 57% still rely on phishable methods for day-to-day sign-in, and the long tail of smaller sites has not shipped support at all. Your utility provider, your local council portal and that forum you signed up to in 2014 will be asking for passwords for years.

What is actually happening is that password managers are becoming credential managers. They store passkeys alongside passwords, sync them across platforms, and increasingly handle the recovery problem that device-bound passkeys create when you lose the device. Adopting passkeys is a reason to use a vault deliberately, not a reason to stop.

If your provider is breached, will you be told?

This is where the answer depends on where you live, and it is less reassuring than most people assume.

EU and UK. Under the GDPR, a controller must notify the supervisory authority within 72 hours of becoming aware of a qualifying breach, and notify affected individuals without undue delay only when the breach is likely to result in a high risk to their rights and freedoms. Strong encryption is explicitly a factor that can reduce that assessed risk, which means a stolen but encrypted vault may be reported to the regulator without every customer receiving a direct notice.
United States. There is no single federal rule for consumer services. All fifty states have breach notification laws, timelines vary from roughly 30 days to "without unreasonable delay", and many include a safe harbour where encrypted data was taken but the keys were not.
Canada. PIPEDA requires notification to the Privacy Commissioner and to individuals as soon as feasible, but only where the breach creates a real risk of significant harm.
Australia. The Notifiable Data Breaches scheme allows up to 30 days to assess a suspected breach before notification obligations bite.

The practical takeaway is the same everywhere: do not treat "I have not received an email" as evidence that nothing happened. When a provider you use discloses an incident publicly, act on the news rather than waiting to be individually contacted.

FAQ

Is a password manager safer than reusing passwords?
Considerably. Reuse converts any one breached site into a key for all your accounts, which is exactly the pattern credential stuffing exploits. A vault removes that link even if the vault itself is imperfect.

What happens if I forget my master password?
With a true zero-knowledge provider, the vault cannot be recovered by the vendor, because they never had the key. Recovery kits, emergency contacts and biometric unlock exist for this reason, which is why setting one up at the start is not optional.

Should I keep my two-factor codes in the same vault?
It is a real trade-off. Storing time-based codes alongside passwords means a compromised vault gives up both factors at once. Storing them on a separate device preserves the separation but costs convenience. For high-value accounts such as email, banking and the vault itself, keep the second factor somewhere else.

Are free password managers safe?
Free is not the same as insecure. Several well-regarded managers are free at the individual tier and open source, which allows independent scrutiny of the client. Judge the product on its encryption model, its audit history and its recovery design, not on its price.

Do I still need one if I am using passkeys?
Yes, for now. Passkey coverage is uneven across smaller sites, and a manager is increasingly the thing that syncs passkeys across your devices and stores the passwords you still need.

The bottom line

A password manager concentrates risk in exchange for eliminating a much larger one. That trade is worth making, and it gets substantially better if you spend twenty minutes on the master password, the key derivation setting, the second factor and the recovery plan. Those four choices, not the vendor's marketing, are what decides how your vault behaves on the day something goes wrong.

If you have been using the same vault since before 2020 and have never opened its security settings, that is the place to start this week.

This article is general information about security practices and not professional security or legal advice. For guidance specific to your organisation, consult a qualified professional.