Password managers: how they work and what to look for
A VPN is one layer. Password managers, 2FA, browsers, and encrypted communication — the full picture, budgeted realistically.
Why password managers exist (and why you can't skip them)
Every additional password you try to remember makes you less secure. The human brain naturally gravitates toward patterns: incremental variations, favorite numbers, pet names with symbols tacked on. Meanwhile, credential stuffing attacks rely on exactly this laziness. When Adobe's 2013 breach exposed 153 million accounts, attackers didn't just compromise Adobe users—they used those credentials to break into bank accounts, email, and cloud storage across the internet.
Password managers solve the core problem: they generate and store genuinely random passwords so you never reuse credentials. One strong master password unlocks your vault. Everything else is cryptographic entropy that an attacker can't guess or derive.
The second benefit is less obvious but equally important. By removing the friction of creating and retrieving passwords, managers eliminate the most common excuse for weak security. When signing up for a new service takes five seconds instead of "let me think of a password I'll remember," you stop cutting corners.
How password managers actually work
Every reputable manager uses zero-knowledge architecture. This means your vault is encrypted on your device before it ever reaches the company's servers. The provider stores encrypted blobs they mathematically cannot decrypt. Your master password never leaves your device in plain text—it derives an encryption key locally, which unlocks your vault.
Here's the step-by-step process:
1. You create a master password. The manager runs it through a key derivation function (KDF)—typically PBKDF2, Argon2, or similar. This converts your passphrase into a cryptographic key while making brute-force attacks computationally expensive.
2. That derived key encrypts your entire vault using AES-256 (occasionally XChaCha20-Poly1305). Each password, note, and piece of metadata becomes ciphertext.
3. The encrypted vault syncs to the provider's servers. Because the encryption happened locally, the provider receives only scrambled data.
4. On other devices, you enter your master password again. The device derives the same key and decrypts the vault locally.
If the provider suffers a breach, attackers get encrypted vaults—useless without your master password. That's why zero-knowledge matters: your security doesn't depend on trusting the company's internal controls.
Local vs cloud architecture: Tools like KeePassXC skip cloud sync entirely. Your encrypted database lives on your devices only, synced manually via your own methods (USB drive, self-hosted cloud, etc.). This maximizes control but requires more technical comfort. Cloud-based managers like 1Password and Bitwarden handle sync automatically but require trusting their infrastructure—an acceptable trade-off given zero-knowledge encryption.
What to evaluate before choosing
Open-source vs proprietary
Open-source managers publish their code for public audit. Anyone can verify the encryption implementation, check for backdoors, and confirm zero-knowledge claims. Bitwarden makes this a core selling point—security researchers have repeatedly validated its architecture.
Proprietary managers like 1Password don't publish full source code. You're trusting their internal security practices and third-party audits. 1Password has undergone multiple professional audits (check their security page for current reports), but you can't independently verify every claim.
Neither approach guarantees safety. Open-source code can contain bugs that sit undiscovered for years. Proprietary tools may have stronger internal processes. What matters more is public accountability: does the provider publish audit results? Do they respond transparently to discovered vulnerabilities?
Sync infrastructure and jurisdiction
Cloud-based managers run servers somewhere. Where matters for both performance and legal exposure.
Bitwarden operates US-based servers. NordPass runs from Panama. Proton Pass uses Swiss infrastructure. Each jurisdiction comes with different data retention laws and government access frameworks. Because of zero-knowledge encryption, location primarily affects metadata: who accessed their vault when, from which IP address, etc. The actual passwords remain encrypted regardless.
If avoiding US jurisdiction matters to you (FISA courts, NSLs), look beyond US-based providers. But remember: zero-knowledge means even legal pressure can't force password disclosure—there's nothing to hand over.
Security features that actually matter
KDF strength: The key derivation function determines how expensive brute-force attacks become. Modern managers should support Argon2 or PBKDF2 with at least 100,000 iterations (Bitwarden defaults to 600,000). Higher iteration counts mean more CPU time per password attempt—stretching a hypothetical breach from weeks to centuries.
Check if the provider lets you adjust iterations. Users with older devices may need lower settings for acceptable performance; security-focused users can crank them higher.
2FA protection for the vault: Your master password is the single point of failure. Multi-factor authentication adds a second requirement: a TOTP code, hardware security key (FIDO2/WebAuthn), or biometric. If someone steals your master password through a keylogger, they still can't access your vault without the second factor.
1Password supports hardware keys and Duo. Bitwarden supports TOTP, Duo, YubiKey, and FIDO2. Basic free tiers often limit 2FA options—a reasonable trade-off if you're budget-conscious but worth paying to unlock.
Emergency access/recovery: What happens if you forget your master password? Zero-knowledge means the provider can't reset it—your vault becomes permanently inaccessible.
Some managers offer emergency access: you designate a trusted contact who can request vault access after a waiting period (you configure the duration). You approve or deny the request. If you're incapacitated and can't deny, they gain access automatically. This creates a small trust assumption but solves the "hit by a bus" problem.
1Password's Travel Mode temporarily removes vaults from your devices when crossing borders, then restores them when you're safe. Niche feature, but valuable for journalists or activists.
Usability that doesn't compromise security
Browser extensions are the primary interface for most users. They should auto-fill credentials without requiring constant manual copy-paste, but never auto-fill on the wrong domain (phishing protection).
Subdomain matching: Does the extension distinguish between `login.example.com` and `phishing.example.com`? It should. Good managers only auto-fill when the full domain matches saved credentials.
Biometric unlock: Face ID, Touch ID, or Windows Hello can unlock your vault without typing your master password each time. Biometric templates stay on your device; the manager sees only an "authenticated" signal. This maintains zero-knowledge while reducing friction.
Mobile app quality varies wildly. Test keyboard integration (iOS and Android both offer password manager keyboards), auto-fill in apps, and whether the experience feels polished or like an afterthought.
Practical sharing and organization
Families and teams need credential sharing without compromising security.
Secure sharing: Good managers encrypt shared items with separate keys, then grant access to specific users. Shared passwords don't expose your entire vault. You can revoke access individually.
Collections and folders: As your vault grows past 100 credentials, organization matters. Can you group work vs personal? Can you share entire collections with teammates while keeping others private?
Bitwarden's free tier allows unlimited collections. 1Password structures everything around vaults—Personal, Family, Work—with granular permissions.
What separates free from paid tiers
Most managers offer free personal tiers with the core features: unlimited passwords, cross-device sync, browser extensions. Paid tiers add convenience and advanced security.
Typical premium features:
- TOTP code generation (2FA codes alongside passwords, eliminating separate authenticator apps)
- Advanced 2FA options (hardware keys, biometric)
- 1GB+ encrypted file storage (identity documents, recovery codes, secure notes)
- Emergency access/family sharing
- Dark web monitoring (alerts if your email appears in known breaches)
- Priority support
Bitwarden charges $10/year for premium—legitimately affordable. 1Password runs $36/year individual, but includes better family sharing tools. Proton Pass bundles with Proton's email/VPN if you're already in that ecosystem.
Free tiers work fine if you're solo and comfortable with basic 2FA. Families should budget for sharing features.
Setting up properly (most people skip critical steps)
Master password creation
Your master password is the weakest link. Brute-forcing your vault requires guessing it, so length and randomness matter more than complexity symbols.
Use a passphrase: Five random words from a dictionary create more entropy than `P@ssw0rd!2024`. Example: `correct-horse-battery-staple` (don't use that exact phrase—generate your own). The EFF publishes word lists specifically for this; Bitwarden's password generator includes passphrase mode.
Aim for at least 14 characters, ideally 20+. If you're relying on muscle memory to type it daily, practice until it's automatic. Write it down on paper initially and store it somewhere physically secure—not in a digital note.
Initial import and cleanup
Most managers import from browsers or competing tools. The imported data is often garbage: duplicate entries, old accounts you no longer use, passwords shared across multiple sites.
After importing, spend 30 minutes cleaning:
- Delete defunct accounts
- Merge duplicates
- Use the manager's "weak password" or "reused password" audit tool
- Start replacing the worst offenders with generated passwords
2FA configuration
Enable 2FA on your password manager vault immediately. This isn't optional. Use a hardware key if possible (YubiKey, Titan Key), or TOTP as a fallback.
Store backup codes somewhere separate from the vault—ideally on paper, in a fire-safe or with a trusted family member. If you lose your 2FA device and backup codes simultaneously, you're locked out permanently.
Device trust and browser extension permissions
Browser extensions request permission to read and modify all web pages. This is necessary for auto-fill but creates risk if the extension itself is compromised.
Only install extensions from official sources (Chrome Web Store, Firefox Add-ons). Verify the publisher matches the password manager company. Fake extensions periodically appear—check reviews and download counts before installing.
Desktop apps reduce browser extension risk by keeping the vault isolated. The extension communicates with the local app instead of accessing the vault directly.
Red flags that should end your evaluation
Walk away immediately if a provider:
Claims to offer zero-knowledge but wants SMS for recovery: SMS recovery requires the provider to decrypt your vault (or store an escrow key). This contradicts zero-knowledge architecture. Legitimate zero-knowledge managers warn you that master password loss means permanent vault loss.
Uses proprietary, non-standard encryption: AES-256 is proven. XChaCha20-Poly1305 is well-vetted. Custom encryption algorithms without peer review suggest either incompetence or intentional backdoors.
Lacks published security audits: Audits aren't perfect, but refusing to undergo independent review suggests something to hide. Check the provider's website for recent third-party penetration tests and cryptographic audits.
Stores master passwords or offers "instant recovery": Some less-reputable tools store password hints or recovery keys server-side. This breaks zero-knowledge. If they can recover your password, so can an attacker who breaches their systems.
Integration with your broader privacy stack
Password managers work best as part of layered security:
Combine with a VPN: When you log into accounts through public WiFi, a VPN encrypts traffic between your device and the VPN server. Your password manager protects the credentials themselves; the VPN protects the connection. Different layers, different threats.
Feed into 2FA apps: Many managers now generate TOTP codes directly, replacing standalone apps like Authy. This is controversial—keeping 2FA separate provides defense-in-depth if your password vault is compromised. Decide based on your threat model. Convenience usually wins for non-critical accounts; security wins for banking and email.
Support browser isolation: Using Firefox's Multi-Account Containers or separate browser profiles for different contexts (work, personal, banking) adds compartmentalization. Your password manager works across all profiles while keeping browsing data separated.
Key takeaways
- Zero-knowledge architecture is non-negotiable: If the provider can read your passwords, they're not a security tool—they're a liability.
- Master password strength matters more than any other decision: Use a long passphrase, enable 2FA on the vault, and accept that password loss means permanent lockout.
- Open-source provides accountability, not automatic security: Proprietary tools with public audits can match open-source safety; evaluate based on transparency and track record.
- Free tiers cover core needs; paid tiers buy convenience: Unless you need family sharing or advanced 2FA, free works fine. Budget $10-40/year for premium features if sharing or TOTP generation matters.
- Integration beats isolated tools: A password manager integrated with your VPN provider's ecosystem and your 2FA workflow reduces friction that otherwise leads to security shortcuts.
- Clean your vault regularly: Imported data is messy. Audit quarterly for reused passwords, weak credentials, and defunct accounts that expand your attack surface unnecessarily.