How secure are password managers?

The short answer

A reputable password manager stores your credentials in a strongly encrypted database that can only be opened with your master password. This solves the real problem: without a password manager, people use weak or identical passwords – and that is exactly how most successful attacks happen. This is why both the BSI and the UK’s NCSC explicitly recommend using password managers.

So the right question is not whether a password manager is secure enough – but which one meets the security criteria.

How a password manager protects your data

• Industry-standard encryption: The database is encrypted with AES-256 – standardised in FIPS 197 and listed by the NSA in the CNSA 2.0 Suite for particularly sensitive systems. New local databases use the authenticated AES-GCM mode (via Windows CNG), which makes tampering with the encrypted data detectable; the classic AES-CBC mode remains available. Our article Rijndael/AES explains how the algorithm works.
• The master password as the only key: The master password is not stored in plain text; the key is derived from it cryptographically. Modern guidelines such as NIST SP 800-63B require, among other things, memory-hard derivation functions and a salt for this.
• Protection during use: Auto-lock on inactivity, controlled clipboard handling, and auto-fill reduce the attack surface at the workstation – including against prying eyes and phishing typos.
• Transport encryption: When accessing central databases, the connection is protected with TLS 1.3.
• Early leak detection: Stored passwords can be checked against the public database Have I Been Pwned – using k-anonymity, without passwords ever leaving the computer in plain text.

What do the BSI, NIST, and NCSC say?

• BSI: Recommends password managers so that every service gets its own strong password – and has advised since 2025 against routine password changes without cause. Both practically presuppose a password manager.
• NIST: SP 800-63B requires services to allow pasting passwords – explicitly so that password managers can be used – and recommends checks against compromised-password lists.
• NCSC (UK): Recommends password managers as a central building block of modern password strategies in organizations.

The position of the authorities is consistent: the password manager is not the risk – it is the recommended countermeasure.

An honest look at residual risks

No system is risk-free. Four points you should know – and deliberately secure:

• The master password is the central key: It must be long and unique (a passphrase) and must not be used anywhere else. Access can additionally be secured with 2FA – such as TOTP or a FIDO2 hardware token.
• Compromised endpoints: A computer with malware can read every input – this applies to password managers as it does to any other application. Endpoint protection and up-to-date systems remain mandatory.
• The vendor cloud as an attack target: Central cloud vaults holding many users’ data are a highly attractive target. This risk can be limited architecturally: with on-premises operation, the encrypted databases reside in your own infrastructure – there is no central vendor vault that would be interesting for all customers at once.
• A forgotten master password: Without the master password, the data cannot be recovered – that is the flip side of real encryption. For companies, central server databases with roles and backups solve this problem organizationally.

How to recognize a secure password manager

Table scrolls sideways

For companies, requirements such as roles, central policies, and audit logs come on top – a complete checklist is included in the article Business password manager.

How Password Depot meets these criteria

• Cryptography: AES-256 (FIPS 197) for databases, TLS 1.3 with Perfect Forward Secrecy for client-server connections; server-side user passwords are hashed with Argon2id.
• Externally tested: In the 10-day penetration test by SySS GmbH (12/2025), no critical or high-severity vulnerabilities were identified – the report is documented in the Trust Center.
• Certified security processes: The information security management system of the manufacturer AceBIT is certified to ISO/IEC 27001:2022 (TÜV NORD). Transparency note: the certification covers the manufacturer’s ISMS – development, sales, and support – not the product itself.
• 2FA and passwordless methods: TOTP, FIDO2/WebAuthn, and Windows Hello additionally secure access.
• Data sovereignty: Databases reside locally, on your own Enterprise Server, or in your own Azure tenant – with no vendor cloud in the chain of trust.
• Predictable security: Free security updates with a documented support period (version 19: at least December 2030).
• Built-in leak checks: Tools → Security check → Check in Pwned passwords checks existing passwords against known data breaches.

For businesses: enforcing security centrally

For private use, a well-configured client is sufficient. In organisations, central enforcement is decisive: the Password Depot Enterprise Server defines password policies server-side, controls access via roles and groups from Active Directory or Entra ID, and logs every access in a tamper-evident audit trail – the basis for audits and GDPR accountability. This turns a secure standalone application into a verifiable security standard for the entire company.

Conclusion: secure is what meets the criteria – not what is convenient

According to the concurring assessment of the BSI, NIST, and the NCSC, password managers are the right path to unique, strong passwords. What matters is the selection: strong, documented cryptography, independent testing, 2FA, and a storage location you control. If you also take the vendor cloud out of the chain of trust, you eliminate the last structural residual risk as well.

Frequently asked questions about password manager security

Can password managers be hacked?

In practice, attacks target weak master passwords, compromised endpoints, or vendors’ central cloud vaults – not the AES-256 encryption itself. A long, unique master password, 2FA, and a solution with a self-determined storage location minimize these attack surfaces.

Isn’t it risky to store all passwords in one place?

The risk of the encrypted collection is much smaller than the risk of the alternative: weak or reused passwords across dozens of services. That is exactly why the BSI and the NCSC explicitly recommend password managers – what matters are a strong master password and 2FA.

Does the manufacturer know my passwords?

With Password Depot, no: the master password is not stored in plain text, the database is encrypted with AES-256, and with on-premises operation the data resides exclusively in your own infrastructure.

Is the browser’s password storage just as secure?

Browser storage is tied to the browser profile, offers no independent master password concept on all platforms, no central policies, and no roles or logs for teams. Better than nothing for personally used individual accounts – unsuitable for companies.

What happens if I forget my master password?

Without the master password, the encrypted data cannot be recovered – that is the consequence of real encryption without a backdoor. In business use, central server databases, roles, and automated backups cushion this risk organizationally.

Are cloud password managers insecure?

Reputable cloud vendors also encrypt strongly. Structurally, however, their central vault remains a highly attractive attack target, and storage location and availability rest with the vendor. Anyone who must rule that out – for compliance reasons, for example – runs password management on-premises or in their own cloud tenant.