Bold warning: password managers aren’t as unbreachable as you’d think, even when they promise “zero-knowledge encryption.” If you rely on them daily, you’ll want to read this closely. And this is the part most people miss: the real risk isn’t only about hackers breaking in from the outside, but about how these tools are built and how users interact with them.
Begin with the big picture: most people juggling dozens, sometimes hundreds, of online passwords can’t memorize them all. That’s why password managers are so popular. They let you unlock every stored credential with a single master password, often syncing across devices and even letting you share access with trusted friends or family members. The core appeal is convenience and centralized security—in theory, a single, well-protected vault that keeps sensitive data like login details, banking sites, and card numbers safe.
A common selling point is zero-knowledge encryption. In practice, providers insist they never see your actual passwords, and even if their servers were compromised, the data would remain unreadable. Yet a team led by Matilda Backendal at ETH Zurich and colleagues from Lugano and other institutions recently questioned whether this promise holds up under real-world attack conditions.
What they did
- They analyzed three widely used password managers: Bitwarden, LastPass, and Dashlane, which together serve roughly 60 million users and command about 23% of the market.
- They built their own setup that imitates a compromised server, assuming the attacker can behave maliciously and deviate from expected protocol—this is called a malicious server threat model.
- They tested how the systems respond during typical interactions: logging in, opening a vault, viewing passwords, and syncing data.
The findings were troubling
- The researchers demonstrated a range of attacks, including targeted intrusions into specific vaults and, in some cases, full access to all vaults within an organization.
- In many scenarios, they could read, and in some cases alter, stored passwords.
- The key insight: simple, everyday operations that users perform—logging in, opening the vault, or syncing—can be exploited if the underlying code and architecture aren’t robust enough.
Why this happened
- The team observed that in trying to make password managers user-friendly (for example, by enabling easy password recovery or sharing features), the codebase grew more complex and, in turn, more vulnerable. A more expansive surface area means more opportunities for attackers.
- Importantly, the attacks didn’t require cutting-edge hardware or extreme computing power. Small, ordinary programs can impersonate a server and trick clients into revealing data.
Industry response and guardrails
- When researchers notified the providers, most offered cooperation and a 90-day window to address the vulnerabilities. Yet update speed varied—some providers were prompt, others less so.
- Developers expressed reluctance about pushing updates too quickly, fearing customers could lose access to their passwords or other data. This tension between quick security fixes and uninterrupted accessibility is a real obstacle for the industry.
- Some providers still rely on cryptographic methods from the 1990s, which modern standards have long outgrown, according to the researchers.
Paths to stronger security
- The researchers propose concrete improvements, including upgrading new customer experiences to current cryptographic standards while offering existing users a migration path to the enhanced system, or allowing them to stay with the older, more vulnerable setup—clearly communicating what protections remain.
- For everyday users, the takeaway is practical: choose a password manager that is transparent about vulnerabilities, subject to external audits, and, at minimum, defaults to end-to-end encryption.
A call to action
The authors want to spark real industry change. They argue that providers should stop overpromising security and instead clearly outline what guarantees they truly offer. And they urge users to demand better standards and transparent practices from the tools they rely on every day.
Question for readers: Do you think the benefits of cloud-enabled password managers outweigh the security risks they may pose in practice? What features would make you more confident in using one, and would you consider migrating to a more secure protocol even if it meant extra steps or reduced convenience? Share your thoughts and experiences in the comments.
