A password manager is software that stores usernames and passwords in a collection called a password vault. The vault is intended to be encrypted, and its encryption key is commonly derived from a master password chosen by the user. Most password managers can generate passwords, save credentials as they are entered, and fill them when the user returns. Some can also synchronize records between devices, share credentials with other users, and store payment-card details, notes, and documents.
Password managers are available as standalone applications, browser extensions, features built into web browsers, and services integrated with an operating system. A vault may remain on one device, be synchronized through a provider's servers, or be copied between devices through a separate file-storage service. By generating and storing a different password for each account, a password manager can reduce the need to memorize many passwords or reuse the same password across accounts.
Because a single vault may contain credentials for many accounts, the vault and its master password are valuable targets for attack. Security depends on how the vault is protected and on features such as autofill, synchronization, sharing, and account recovery. Users may also avoid or stop using password managers because of concerns about security or control, inconvenience, or compatibility with websites.
Password managers have existed since the 1990s. They later became available as browser components, mobile applications, cloud-based services, and features built into an operating system. Some password managers can also create and store passkeys, login credentials based on public-key cryptography that can replace passwords or serve as an additional authentication factor.
Operation and features A password manager keeps login credentials, such as usernames and passwords, in a repository known as a password vault. Ideally, the vault is encrypted using a key generated from a password chosen by the user, commonly known as the master password. Some password managers offer multi-factor authentication for access to the password database. Cloud-based password managers generally keep server-side vault data encrypted while encryption and decryption are performed by the user's client. The client sends encrypted data to the service and decrypts retrieved data locally.
Password generation is a common feature of modern password managers, where users can configure properties such as length, permitted characters, and composition requirements. Because the result is stored in the vault, users can assign separate generated passwords to different accounts without memorizing each one. Some password managers also flag duplicate passwords or credentials that may need to be changed. When a user enters a password manually on a login form, the password manager may prompt them to add that credential to the vault. When the user returns, it can match the stored record to the site and fill the username and password fields. Autofill may occur automatically or require user interaction, depending on the password manager and context. If several accounts are stored for a site, the user can select which account to use.
Cloud-based services can synchronize an encrypted vault so that the same records are available on several devices. Some cloud services support sharing vault data with other authorized users, including household or organizational groups, and may also provide account-recovery features. Vaults can also contain non-login information, such as payment-card details, notes, and personal documents.
Deployment models Password managers may be standalone applications, browser extensions, or features built into a web browser. Some products are available in more than one of these forms. A desktop application may work with a browser extension to fill saved credentials into website login forms. Apple's iCloud Keychain can enable passwords and passkey synchronization across Apple devices approved by the user. In Google's ecosystem, passwords and passkeys can be saved to a Google Account and used to sign in to apps and websites on devices using that account.
A locally maintained password database is stored on the user's own device rather than on a provider-controlled server. Some standalone password managers require users to synchronize their vaults manually rather than providing built-in cloud synchronization. A vault file can instead be synchronized between devices through a separate file-sync service rather than through the password manager provider. A separate backup helps preserve access to a locally maintained password database if the device is lost or stolen.
In a cloud-synchronized password manager, encrypted vault data is kept on a remote server and synchronized with the user's devices. Some services allow organizations to run the storage server on their own systems instead of using the vendor's server. Bitwarden organizations can group shared records into collections and assign access to individual users or groups. 1Password Business provides administrative policies for authentication, sharing and permissions, and single sign-on.
History Password management software dates back to the 1990s. PassKeeper was available by March 1996. The Microsoft Windows-based utility lets users to organize credentials and notes in an encrypted file. In September 1997, Counterpane Systems released Password Safe, a free utility for Windows 95. It stored its password database on the user's computer, protected it with Blowfish encryption, and used a single "Safe Combination" to access the saved passwords. The first version of 1Password, then named 1Passwd, was released on May 19, 2006 and LastPass was founded in 2008. Dashlane had been operating since 2012, and the open-source Bitwarden launched in 2016.
In June 2013, Apple announced iCloud Keychain for OS X Mavericks. The built-in password manager used iCloud to synchronize passwords only with trusted devices. By 2014, password managers were built into browsers, offered by third parties, and available on mobile platforms. Some also backed up passwords to the cloud and synchronized them across devices. In 2022, Google began rolling out a common password-management interface in Chrome and Android settings. Apple released the Keychain-based Passwords app in 2024 for accessing credentials including passwords, passcodes, and verification codes.
Security model When properly implemented and used, a password manager makes it practical to use a different generated password for each account without having to remember them all. Use of password managers is associated with stronger password choices, particularly when a password generator is included. Because one vault may contain credentials for many accounts, the password manager and its master password are valuable targets for attack. One threat model assumes that the password manager server is fully malicious and may depart arbitrarily from its expected behavior. Under this model, expected protections include keeping vault contents secret, detecting unauthorized changes to vault data and metadata, and limiting sharing and account recovery to the intended users.
Vault protection The master password is commonly used to create the key that encrypts the vault. An attacker who obtains a copy of an encrypted vault may try to guess its master password offline. To make offline guessing more expensive, password managers commonly apply deliberately slow password-based key derivation or hashing to the master password. In a 2020 evaluation, some password managers left particular metadata unencrypted, including site addresses, usernames, account-use information, or security-related settings, depending on the product. If integrity checks do not cover the vault as a whole, a malicious server may be able to alter, remove, or rearrange vault data without detection.
Autofill and phishing Password managers generally associate stored credentials with particular websites and may decline to suggest or fill them when the current address does not match. Automatic filling can expose a stored password to malicious code on a compromised page without requiring the user to select the credential. In a 2014 test, six of ten password managers were vulnerable to an attack in which a rogue Wi-Fi network loaded login pages in invisible frames and captured autofilled passwords. Requiring the user to initiate filling prevents this kind of silent sweep attack, but user interaction alone does not eliminate all autofill risks.
A malicious website can also imitate the unlock interface of a password manager browser extension. In a 2025 phishing simulation involving 29,809 people at an educational institution, one of four targeted third-party password managers was detected in 448 participants. One hundred and forty of those users (31.25%) entered their master password into the imitation interface. A stolen master password can expose stored credentials, and phishing-resistant multi-factor authentication adds a separate barrier to using the stolen password.
Client security A password manager's client can be targeted through malicious websites, rogue applications on the user's device, or adversarial networks. Browser-based autofill can be abused when credentials are released to a compromised page. User interaction prompts can themselves be exploited through clickjacking, where a deceptive page conceals or disguises the control being activated. These client-side and network attacks differ from offline attacks in which an adversary first obtains an encrypted copy of the vault.
Cloud storage, sharing, and recovery Cloud-based password managers often describe their client-side encryption as "zero-knowledge encryption". In this usage, encryption is intended to prevent the provider from seeing the plaintext contents of the vault. The term has no strict technical definition. A 2026 analysis interpreted the vendors' security claims as implying protection even when the server behaves maliciously. That analysis identified 25 attacks against Bitwarden, LastPass, and Dashlane under this malicious-server threat model. The attacks involved weaknesses in account recovery and sharing, failures to verify public keys, incomplete protection against changes to an entire vault, and legacy cryptographic compatibility.
A 2024 study examined injection attacks in which a victim first accepts a shared item that the attacker can later update. Depending on the product, those updates could affect password-health metrics, site-icon requests, compressed vault size, or attachment deduplication. Across the ten password managers studied, different attack variants could reveal passwords, usernames, website addresses, or attachment contents. The first four vendors notified had deployed mitigations by the time of the study's publication, but disclosure to the remaining six was still underway. The paper described general-purpose detection and mitigation techniques against injection attacks as a direction for future research.
Password generation The strength of a generated password depends on how unpredictably it is chosen and on settings such as its length and the characters the generator can use. A 2020 evaluation generated 147 million passwords and found a small fraction of shorter outputs vulnerable to guessing attacks, including passwords under 10 characters in its online-attack tests and under 18 in its offline-attack tests.