Password manager

Short description: Application for storing and managing passwords

Bitwarden is an example of a password manager.

A password manager is a software program that prevents password fatigue by automatically generating, autofilling, and storing passwords.[1][2] They are useful for local applications or web applications such as online shops or social media.[3] Web browsers tend to have a built-in password manager. Password managers typically require a user to create and remember a single password to unlock to access the stored passwords. Password managers can integrate multi-factor authentication and passkey authentication.

## Contents

* 1 History
* 2 Types
* 2.1 Browser-based
* 2.2 Local
* 2.3 Cloud-based
* 2.4 Enterprise
* 2.5 Hardware
* 3 Vulnerabilities
* 3.1 Weak vault storage
* 3.2 Master password as single point failure
* 3.3 Device security dependency
* 3.4 Cloud-based storage
* 3.5 Password generator security
* 3.6 Others
* 4 Blockage
* 5 See also
* 6 References
* 7 External links

## History

The first password manager software designed to securely store passwords was Password Safe created by Bruce Schneier, which was released as a free utility on September 5, 1997.[4] Designed for Microsoft Windows 95, Password Safe used Schneier's Blowfish algorithm to encrypt passwords and other sensitive data. Although Password Safe was released as a free utility, due to export restrictions on cryptography from the United States, only U.S. and Canadian citizens and permanent residents were initially allowed to download it.[4]

As of October 2024[update], the built-in Google Password Manager in Google Chrome has become the most used password manager.[5]

## Types

### Browser-based

These are built directly into web browsers like Chrome, Safari, Firefox, and Edge. They offer convenient access for basic password management on the device where the browser is used. However, some may lack features like secure syncing across devices or strong encryption.

### Local

These are standalone applications installed on a user's device. They offer strong security as passwords are stored locally, but access may be limited to that specific device. Popular open-source options include KeepassXC, KeePass and Password Safe.

### Cloud-based

These store passwords in encrypted form on remote servers, allowing access from supported internet-connected devices. They typically offer features like automatic syncing, secure sharing, and strong encryption. Examples include 1Password, Bitwarden, and Dashlane.

### Enterprise

Designed for businesses, these cater to managing access credentials within an organization. They integrate with existing directory services and access control systems, often offering advanced features like role-based permissions and privileged access management.

### Hardware

These physical devices, often USB keys, provide an extra layer of security for password management. Some function as secure tokens for account/database access, such as Yubikey and OnlyKey, while others also offer offline storage for passwords, such as OnlyKey.

## Vulnerabilities

### Weak vault storage

Some applications store passwords as an unencrypted file, leaving the passwords easily accessible to malware or people attempting to steal personal information.

### Master password as single point failure

Some password managers require a user-selected master password or passphrase to form the key used to encrypt passwords stored for the application to read. The security of this approach depends on the strength of the chosen password (which may be guessed through malware), and also that the passphrase itself is never stored locally where a malicious program or individual could read it. A compromised master password may render all of the protected passwords vulnerable, meaning that a single point of entry can compromise the confidentiality of sensitive information. This is known as a single point of failure.

### Device security dependency

While password managers offer robust security for credentials, their effectiveness hinges on the user's device security. If a device is compromised by malware like Raccoon, which excels at stealing data, the password manager's protections can be nullified. Malware like keyloggers can steal the master password used to access the password manager, granting full access to all stored credentials. Clipboard sniffers can capture sensitive information copied from the manager, and some malware might even steal the encrypted password vault file itself. In essence, a compromised device with password-stealing malware can bypass the security measures of the password manager, leaving the stored credentials vulnerable.[6]

As with password authentication techniques, key logging or acoustic cryptanalysis may be used to guess or copy the "master password". Some password managers attempt to use virtual keyboards to reduce this risk - though this is still vulnerable to key loggers that take the keystrokes and send what key was pressed to the person/people trying to access confidential information.[7]

### Cloud-based storage

Cloud-based password managers offer a centralized location for storing login credentials. However, this approach raises security concerns. One potential vulnerability is a data breach at the password manager itself. If such an event were to occur, attackers could potentially gain access to a large number of user credentials. A 2022 security incident involving LastPass exemplifies this risk.[6]

### Password generator security

Some password managers may include a password generator. Generated passwords may be guessable if the password manager uses a weak method of randomly generating a "seed" for all passwords generated by this program. There are documented cases, like the one with Kaspersky Password Manager in 2021, where a flaw in the password generation method resulted in predictable passwords.[8][9]

### Others

A 2014 paper by researchers at Carnegie Mellon University found that while browsers refuse to autofill passwords if the login page protocol differs from when the password was saved (HTTP vs. HTTPS), some password managers insecurely filled passwords for the unencrypted (HTTP) version of saved passwords for encrypted (HTTPS) sites. Additionally, most managers lacked protection against iframe and redirection-based attacks, potentially exposing additional passwords when password synchronization was used across multiple devices.[10]

## Blockage

This article needs to be updated. Please update this article to reflect recent events or newly available information. (June 2022)

|

Various high-profile websites have attempted to block password managers. In 2015 British Gas blocked password managers but backing down when publicly challenged.[11][12][13] Reasons cited have included protecting against automated attacks, protecting against phishing, blocking malware, or simply denying compatibility. The Trusteer client security software from IBM features explicit options to block password managers.[14][15]

Such blocking has been criticized by information security professionals as making users less secure.[13][15] The typical blocking implementation involves setting `autocomplete='off'` on the relevant password web form. This option is now consequently ignored on encrypted sites,[10] such as Firefox 38,[16] Chrome 34,[17] and Safari from about 7.0.2.[18]

Some websites made it harder for users to rely on password managers by disabling features like password autofill or blocking the ability to paste into password fields. Companies like T-Mobile, Barclaycard, and Western Union have implemented these restrictions, often citing security concerns such as malware prevention, phishing protection, or reducing automated attacks. However, cybersecurity experts have criticized these measures, arguing they can backfire by encouraging users to reuse weak passwords or rely on memory alone—ultimately making accounts more vulnerable. Some organizations, such as British Gas, have reversed these restrictions after public feedback, but the practice still persists on many websites.[19]

## See also

* List of password managers
* Security token
* Smart card
* Cryptography

## References

1. ↑ Waschke, Marvin (2017) (in en). Personal cybersecurity : how to avoid and recover from cybercrime. Bellingham, Washington: Apress. pp. 198. doi:10.1007/978-1-4842-2430-4. ISBN 978-1-4842-2430-4. OCLC 968706017. https://books.google.com/books?id=hJHlDQAAQBAJ&pg=PA198.
2. ↑ "Password Managers - Information Security Office - Computing Services". https://www.cmu.edu/iso/governance/guidance/password-managers.html.
3. ↑ "What is a Password Manager? - Definition from Techopedia" (in en). http://www.techopedia.com/definition/31435/password-manager.
4. ↑ 4.0 4.1 "Counterpane Systems Brings the Security of Blowfish to a Password Database". http://www.counterpane.com/passsafe.html.
5. ↑ "U.S.: top password managers 2023 | Statista" (in en). https://www.statista.com/statistics/1454205/most-popular-password-managers-us/.
6. ↑ 6.0 6.1 Valiaugaitė, Inga (2022-07-13). "Are Password Managers Safe to Use in 2024?". https://cybernews.com/best-password-managers/are-password-managers-safe/.
7. ↑ Nadkarni, Tanusha S.; Mohandas, Radhesh; Pais, Alwyn R. (2011). "A Novel Technique for Defeating Virtual Keyboards - Exploiting Insecure Features of Modern Browsers". Advances in Computing and Communications. Communications in Computer and Information Science. 191. Springer. pp. 680–689. doi:10.1007/978-3-642-22714-1_71. ISBN 978-3-642-22713-4. https://doi.org/10.1007/978-3-642-22714-1_71. Retrieved April 11, 2025.
8. ↑ Claburn, Thomas (2021-07-06). "Kaspersky Password Manager's random password generator was about as random as your wall clock". Archived from the original on 2024-03-07. https://web.archive.org/web/20240307083626/https://www.theregister.com/2021/07/06/kaspersky_password_manager/.
9. ↑ Arghire, Ionut (2021-07-07). "Kaspersky Password Manager Generated Passwords That Could Quickly Be Brute-Forced". Archived from the original on 2023-06-02. https://web.archive.org/web/20230602221329/https://www.securityweek.com/kaspersky-password-manager-generated-passwords-could-quickly-be-brute-forced/.
10. ↑ 10.0 10.1 "Password Managers: Attacks and Defenses". https://www.usenix.org/system/files/conference/usenixsecurity14/sec14-paper-silver.pdf.
11. ↑ Wright, Mic (16 July 2015). "British Gas deliberately breaks password managers and security experts are appalled". https://thenextweb.com/news/no-pass-on-this-one.
12. ↑ Reeve, Tom (15 July 2015). "British Gas bows to criticism over blocking password managers". http://www.scmagazineuk.com/british-gas-bows-to-criticism-over-blocking-password-managers/article/426463/.
13. ↑ 13.0 13.1 Cox, Joseph (26 July 2015). "Websites, Please Stop Blocking Password Managers. It's 2015". https://www.wired.com/2015/07/websites-please-stop-blocking-password-managers-2015/.
14. ↑ "Password Manager". https://www.trusteer.com/support/norton-password-manager.
15. ↑ 15.0 15.1 Hunt, Troy (15 May 2014). "The "Cobra Effect" that is disabling paste on password fields". http://www.troyhunt.com/2014/05/the-cobra-effect-that-is-disabling.html.
16. ↑ "Firefox on windows 8.1 is autofilling a password field when autocomplete is off.". https://support.mozilla.org/en-US/questions/1064817.
17. ↑ Sharwood, Simon (9 April 2014). "Chrome makes new password grab in version 34". https://www.theregister.co.uk/2014/04/09/chrome_makes_new_password_grab_in_version_34/.
18. ↑ "Re: 7.0.2: Autocomplete="off" still busted". https://discussions.apple.com/message/25080203#25080203.
19. ↑ Zetter, Kim (July 8, 2015). "Websites, Please Stop Blocking Password Managers". Wired. https://www.wired.com/2015/07/websites-please-stop-blocking-password-managers-2015/. Retrieved April 11, 2025.

## External links

* v
* t
* e

Password managers

Proprietary|

* 1Password
* Dashlane
* Enpass
* Intuitive Password
* Keeper
* LastPass
* Mitto
* Myki
* Pleasant Password Server
* SafeInCloud

Open source|

* Bitwarden
* Factotum
* Firefox Lockwise
* GNOME Keyring
* KeePass
* KeePassX
* KeePassXC
* Keychain
* KWallet
* Pass
* Password Safe
* Seahorse

Discontinued|

* Gator eWallet
* KYPS
* Mitro
* Offer Assistant

* Category
* List of password managers

0.00

(0 votes)

Original source: https://en.wikipedia.org/wiki/Password manager. Read more

|

Retrieved from "https://handwiki.org/wiki/index.php?title=Password_manager&oldid=4234682"
*[v]: View this template
*[t]: Discuss this template
*[e]: Edit this template