Why Your Password Manager Can Still Get Hacked

Password managers are undeniably better than reusing "password123" — but they're not invincible. The LastPass breach of 2022, where attackers stole encrypted password vaults, was a wake-up call. Let's be precise about where the real risks are.

Attack surface #1: Your master password

Every password manager is only as strong as its master password. If that password is weak, guessable, or reused anywhere else, attackers can decrypt your vault offline at their leisure. The rule: your master password should be at least 20 characters, entirely unique, and ideally a random passphrase (four random words strung together are both memorable and highly secure).

Attack surface #2: The device itself

If your phone or laptop is compromised with malware before you unlock your password manager, the attacker can capture passwords as they autofill — bypassing encryption entirely. This is called a keylogger attack. The defense: keep your OS and apps updated, and never install software from unofficial sources.

Attack surface #3: The vendor's infrastructure

The LastPass breach demonstrated that even reputable vendors get attacked. The saving grace: well-designed managers use zero-knowledge encryption — your passwords are encrypted locally before upload, so even if their servers are breached, attackers only get scrambled data. Check that your manager explicitly uses zero-knowledge architecture (Bitwarden, 1Password, and others do).

Attack surface #4: Browser extensions

Malicious browser extensions can intercept passwords before they're encrypted. Regularly audit your installed extensions and remove anything you don't actively use or recognize.

The bottom line

Password managers remain the single best thing most people can do for their security posture. Use one. But pair it with a strong unique master password, two-factor authentication on the manager itself, and a clean device. That combination makes you dramatically harder to target than the vast majority of users.

The anatomy of a password manager breach

The most significant real-world example is LastPass, which suffered a breach in 2022 that exposed encrypted password vaults. The crucial word is "encrypted" — attackers got the vault data, but it was protected by each user's master password. For users with strong master passwords, the data remained practically inaccessible. For those with weak ones, it was a different story.

This illustrates the key vulnerability of password managers: they reduce your attack surface to a single point of failure — the master password. If that master password is guessed, phished, or exposed in a breach of another service, every credential stored in the vault is at risk.

Browser-based password managers have different risks

Built-in browser password managers (Chrome, Safari, Firefox) are convenient but carry their own risks. They are tightly integrated with your browser profile, which is also linked to your Google, Apple, or Mozilla account. If any of these accounts are compromised — a common occurrence — your saved passwords travel with them.

Browser managers also offer weaker separation from malicious browser extensions. A rogue extension running in the same browser can, in some configurations, read autofill data or monitor form submissions. Dedicated password managers run as separate processes with stronger isolation boundaries.

Multi-factor authentication: the essential complement

No discussion of password manager security is complete without emphasising multi-factor authentication (MFA). Enabling MFA on your password manager account means that even if your master password is compromised, an attacker still needs a second factor — your phone, a hardware key, or a biometric — to access your vault.

The gold standard is a hardware security key (like a YubiKey). It's phishing-resistant because it cryptographically verifies the website domain before releasing the authentication code — something authenticator apps and SMS codes cannot do. For anyone managing sensitive credentials, hardware keys are worth the £40–60 investment.

Practical steps to harden your password manager setup

The good news is that most attack vectors against password managers are well-understood and preventable with straightforward steps. Use a long, memorable passphrase as your master password — at least 16 characters. Enable multi-factor authentication, ideally with a hardware key. Keep your password manager application and operating system updated.

Be vigilant about phishing — password managers with browser extensions will only autofill on the legitimate domain, and if yours isn't autofilling, check the URL carefully before typing anything. The security of your password manager is only as strong as the security practices around it.