How Password Managers Work

The Core Concept: Zero-Knowledge Architecture

Modern password managers use "zero-knowledge" architecture. This means the service provider cannot access your passwords - even if they wanted to, even if compelled by law enforcement, even if they're hacked.

How? Your passwords are encrypted on your device before being sent to their servers. The encryption key is derived from your master password, which is never transmitted.

Key Derivation: Protecting Your Master Password

Your master password isn't used directly for encryption. Instead, it goes through a key derivation function (KDF) that:

• * Adds a random salt (unique to your account)
• * Runs through many iterations (100,000+) to slow down brute-force attacks
• * Produces a cryptographic key of the exact length needed

// PBKDF2 example (simplified)
const salt = getRandomSalt(16);  // Unique per user
const iterations = 600000;        // Makes brute-force slow
const keyLength = 256;            // bits

const encryptionKey = pbkdf2(
  masterPassword,
  salt,
  iterations,
  keyLength,
  'sha256'
);

// Even if attacker gets the encrypted vault,
// they'd need to run 600,000 iterations per guess

Modern managers use Argon2 (memory-hard, resistant to GPU attacks) or PBKDF2 with high iteration counts.

Encryption: AES-256

Your vault is encrypted with AES-256 - the same encryption standard used by governments for classified information. It's considered unbreakable with current technology.

Metadata like "when did you last access this item" may not be encrypted, but actual credentials always are.

Why Not Just Use Browser Password Storage?

Browser built-in password managers have improved, but dedicated password managers offer significant advantages:

What If the Password Manager Gets Hacked?

This has happened (LastPass in 2022). Here's why zero-knowledge architecture limits the damage:

• * Attackers got encrypted vaults, not plaintext passwords
• * Each vault needs the user's master password to decrypt
• * Strong master passwords remain secure
• * Weak master passwords are vulnerable to offline brute-force

Choosing a Master Password

Your master password is the only password you need to remember. Make it count: