A password manager encrypts all your passwords into a vault using a key derived from your master password, and that encryption happens on your own device, so the company's servers only ever store and sync scrambled data they cannot read. When you open your vault, the app re-derives the key from your master password, decrypts your logins locally, and fills them into sites whose address matches the one you saved.
The rest of this article walks through those steps using Bitwarden's published security whitepaper as the worked example, because it documents its design in detail. Other reputable managers differ in algorithms and names but follow the same pattern.
Step 1: your master password becomes a key
The master password itself is never used as the encryption key and never sent to the company. The app runs it through a key derivation function (KDF), a deliberately slow function that turns a password into a fixed-length key. In Bitwarden's design:
- The master password goes through PBKDF2-SHA256 with 600,000 iterations, salted with your account email, producing a 256-bit Master Key. Argon2id is available instead; Bitwarden's defaults for it are 32 MiB of memory, 6 iterations and 4 threads.
- HKDF stretches that to a 512-bit Stretched Master Key.
The slowness is the point. Bitwarden's KDF page says KDFs are used "to frustrate brute-force or dictionary attacks against a master password." Each guess an attacker tries has to repeat the same 600,000 rounds. You can feel the cost yourself. This Python snippet runs the same PBKDF2 configuration:
import hashlib, time
t = time.perf_counter()
hashlib.pbkdf2_hmac("sha256", b"correct horse battery staple", b"[email protected]", 600_000)
print(time.perf_counter() - t)On a laptop with a Core i7-13700H (Python 3.12.2) it took 0.23 seconds. That is unnoticeable when you unlock once, and a real cost when multiplied by billions of guesses, although attackers with specialised hardware run it much faster than one laptop core. A KDF slows guessing down; it can't rescue a weak or reused master password.
Step 2: a random key encrypts the vault
Your master password doesn't encrypt your logins directly. When you create the account, the app generates a random 512-bit symmetric key with a cryptographically secure random number generator. That key encrypts the vault. The Stretched Master Key then encrypts (wraps) the random key, and only the wrapped version, which Bitwarden calls the Protected Symmetric Key, is uploaded.
Two layers sound like extra complexity, but they solve a real problem: changing your master password only requires re-wrapping one key, not re-encrypting every item. Bitwarden goes a step further and gives every vault item its own random 64-byte key, itself encrypted with your account key. Vault data is protected with what the whitepaper describes as "AES-CBC 256 bit encryption with HMAC authentication": the HMAC detects any tampering with the stored ciphertext.
Step 3: logging in without sending the password
The server still needs to check that it's you before handing over your encrypted vault. Bitwarden's client derives a separate value, the Master Password Hash, from the Master Key and sends that. The server hashes it again with its own random salt and another 600,000 PBKDF2 iterations before storing or comparing it. So the server can verify you, but what it holds can't decrypt anything: the Master Key itself never leaves your device.
Per the whitepaper, the server stores the double-hashed login value, your wrapped key, the encrypted vault, and account details such as your email. This is what "zero-knowledge" means in practice: "Bitwarden team members cannot see your passwords."
Step 4: sync across devices
Because the server only holds ciphertext, syncing is just copying encrypted blobs. A new phone downloads the encrypted vault and the wrapped key; you type your master password; the phone derives the Stretched Master Key, unwraps the vault key, and decrypts locally.
Step 5: autofill, and why it blocks phishing
Each saved login stores the website address it belongs to. The browser extension or app compares that address with the page you are on, and only offers matching logins. Bitwarden's default is base-domain matching: a login saved for https://google.com is offered on https://accounts.google.com but not on https://google.net.
That check is a security feature. A phishing page at a look-alike address gets no autofill suggestion, and the missing suggestion is a warning sign worth noticing. Copying and pasting the password by hand overrides that protection, so be suspicious of any site where you find yourself doing it.
Standards bodies back this workflow. NIST SP 800-63B-4 says services "SHALL allow the use of password managers and autofill functionality" and "SHOULD permit claimants to use the 'paste' function", noting that password managers "have been shown to increase the likelihood that subscribers will choose stronger passwords."
Generating passwords
The other half of the job is creating a unique random password for each site, so one breached site doesn't expose the others. A manager's generator uses a cryptographic random source, the same kind as larely's password generator, which runs in your browser. Length matters more than symbols: NIST's current guidelines require at least 15 characters for a password used on its own, and say services "SHALL NOT impose other composition rules" such as mandatory mixed character types.
What a password manager doesn't protect against
| Threat | Protected? | Why |
|---|---|---|
| The company's servers are breached | Largely | Attackers get ciphertext and must guess your master password, slowed by the KDF |
| A website you use is breached | Yes, if passwords are unique | The leaked password works nowhere else |
| Phishing look-alike sites | Partly | Autofill won't match, unless you paste the password in yourself |
| Weak master password | No | Offline guessing of a stolen vault becomes feasible |
| Malware on your unlocked device | No | Decrypted data is in memory while unlocked; malware can also capture what you type |
| Forgotten master password | No | Nobody else has the key, so recovery depends on options you set up in advance |
Two habits close most of the gap: a long master password that you use nowhere else, such as several random words, and two-factor authentication on the password manager account. How two-factor authentication codes work explains the codes, and passkeys are the newer login method that managers increasingly store alongside passwords, which removes the shared secret altogether.
Frequently asked questions
- Can the password manager company see my passwords?
- Not with an end-to-end encrypted manager that works as designed. Your vault is encrypted on your device with a key derived from your master password, and the company stores only the encrypted result. Bitwarden's whitepaper, for example, says it never stores and cannot access your master password or your cryptographic keys. You are trusting that the software actually does this, which is why published security designs and audits matter.
- What happens if I forget my master password?
- With a zero-knowledge manager, the company cannot recover your vault for you, because it never had the key. Your options are whatever recovery you set up in advance, such as an emergency access contact, an account recovery feature provided by an organization, or a device that is still unlocked. Otherwise you have to start a new vault. Write the master password down and keep it somewhere physically safe.
- Is the password manager built into my browser good enough?
- It is far better than reusing passwords. Browser and operating-system managers now generate, store and sync passwords and passkeys, and many people need nothing more. Dedicated managers add cross-browser and cross-platform support, sharing with family or teams, and more control over how the vault is encrypted. Pick the one you will actually use everywhere.
- Is it safe to store 2FA codes in the same password manager?
- It is convenient but reduces the separation between factors: someone who unlocks your vault gets both the password and the one-time code. Many people accept that trade-off for everyday accounts and keep codes for critical accounts, such as email and the password manager itself, in a separate authenticator app or on a hardware key.