Password Managers and Account Security Cheat Sheet

Updated 2026-05-20

🧠Study flashcards on this topic103 cards · spaced repetition→

Password managers are encrypted vaults that generate, store, and autofill unique credentials for every account — eliminating the human memory bottleneck that leads to password reuse. The field matters because 77% of breaches involve stolen credentials, and a single strong master password protecting a vault of randomly generated unique passwords dramatically shrinks the attack surface. The key mental model: a password manager is not just a convenience tool but a security architecture decision — the vault's encryption, key derivation function, and zero-knowledge design determine how safe your data remains even if the provider's servers are compromised. As passkeys gain adoption, the role of password managers is evolving from credential storage to unified identity vaults that handle both legacy passwords and cryptographic passkeys.

What This Cheat Sheet Covers

This topic spans 15 focused tables and 116 indexed concepts, 103 flashcards. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.

Table 1: Password Manager Comparison (1Password, Bitwarden, Dashlane, LastPass)Table 2: Core Security ArchitectureTable 3: Master Password SecurityTable 4: Password Generator SettingsTable 5: Two-Factor Authentication (2FA) Types and StrengthTable 6: TOTP — How It WorksTable 7: Passkeys — Architecture and AdoptionTable 8: Breach Monitoring and AlertsTable 9: Browser Extension IntegrationTable 10: Family and Team PlansTable 11: Passkey and Password Storage in ManagersTable 12: Emergency Access and Account RecoveryTable 13: Secure Sharing FeaturesTable 14: Advanced Security Features and SettingsTable 15: Authenticator App Comparison

Quick IndexSubscribe to unlock

A jump-to index of every table row in this cheat sheet.

Mind MapSubscribe to unlock

An interactive map of every table and concept in this topic.

Table 1: Password Manager Comparison (1Password, Bitwarden, Dashlane, LastPass)

Choosing the right password manager depends on the security architecture, audit transparency, and pricing model — not just features. The four most-discussed managers differ sharply in breach history, open-source status, and zero-knowledge implementation details.

Manager	Example	Description
1Password	`Secret Key: A3-ASWWYB-798JRYLJVD4-23DC2-86TVM-H43EB`	• Uses Two-Secret Key Derivation (2SKD): master password + 128-bit Secret Key must both be present to decrypt vault • neither can be guessed from server data alone • Regular Cure53 audits
Bitwarden	`Self-hosted via Docker;` `Premium: $19.80/yr (2026)`	• Fully open-source (client and server code on GitHub) • AES-CBC-256 + HMAC • zero-knowledge • annual third-party audits (Cure53, Mandiant, Palo Alto Unit 42) • optional self-hosting
Dashlane	`Dark web monitoring + built-in VPN (premium plans)`	• No known vault breach to date • bundles dark web monitoring and optional VPN • removed free tier in September 2025 • most recent public audit dates to 2016 — transparency gap vs. 1Password/Bitwarden
LastPass	`2022 breach: encrypted vaults + unencrypted URLs stolen`	• Avoid for new deployments. 2022–2023 breach exposed encrypted customer vaults alongside unencrypted metadata • subsequent cryptocurrency thefts totaling $150M+ linked to stolen vault data • $24.5M class-action settlement (2026).
NordPass	`XChaCha20 encryption (vs. AES-256 in peers)`	• Uses XChaCha20 instead of AES-256 — newer and considered more future-proof • zero-knowledge • annual independent audits • free plan limited to one device at a time
Proton Pass	`AES-256-GCM; encrypts metadata (URLs, usernames)`	• Swiss jurisdiction (strong privacy laws) • encrypts all vault metadata including item names and URLs — unlike most competitors • includes email alias feature via SimpleLogin
Keeper	`Role-based access, audit logs, Keeper SSO Connect`	• Strong enterprise focus with RBAC, activity logging, and SSO integration • supports emergency access • publishes annual third-party audits
KeePassXC	`.kdbx database file; self-synced via Dropbox/Nextcloud`	• Fully offline and open-source • no cloud component — vault file stored locally • cross-platform fork of KeePass • requires manual sync strategy • maximum user control, no vendor dependency

Table 2: Core Security Architecture

The technical foundation of a password manager determines whether a server-side breach can expose your passwords. Zero-knowledge architecture, strong key derivation, and client-side encryption are the non-negotiable requirements to evaluate before trusting any manager with credentials.

Concept	Example	Description
Zero-knowledge architecture	`Vault encrypted on device → only ciphertext reaches server`	• Provider's servers store only encrypted blobs • without the master password (which never leaves the client), the provider cannot decrypt or read vault contents even under legal compulsion or after a breach

The rest of this section is part of the full cheat sheet

Table 3: Master Password Security

The master password is the single key that unlocks all others — its strength directly determines the cryptographic ceiling of the entire vault. Zero-knowledge design means managers cannot reset it, making both strength and recovery planning essential.

Concept	Example	Description
Passphrase (Diceware)	`correct-horse-battery-staple` (4 words, ~51 bits)	Six Diceware words from the EFF list provides ~77 bits of entropy — comparable to a 13-character random alphanumeric password while remaining genuinely memorable.

The rest of this section is part of the full cheat sheet

Table 4: Password Generator Settings

The password generator is the most important daily-use feature in any manager — its output quality determines the strength of every account credential. Understanding entropy and generator settings helps practitioners configure the right balance for different account types.

Setting	Example	Description
Password length	`16 chars minimum; 20+ for critical accounts`	• Length is the primary entropy driver: each additional character multiplies the keyspace • at 16 characters from a full character set, entropy exceeds 100 bits — brute-force impractical

The rest of this section is part of the full cheat sheet

Table 1: Password Manager Comparison (1Password, Bitwarden, Dashlane, LastPass)

Manager	Example	Description
1Password	`Secret Key: A3-ASWWYB-798JRYLJVD4-23DC2-86TVM-H43EB`	• Uses Two-Secret Key Derivation (2SKD): master password + 128-bit Secret Key must both be present to decrypt vault • neither can be guessed from server data alone • Regular Cure53 audits
Bitwarden	`Self-hosted via Docker;` `Premium: $19.80/yr (2026)`	• Fully open-source (client and server code on GitHub) • AES-CBC-256 + HMAC • zero-knowledge • annual third-party audits (Cure53, Mandiant, Palo Alto Unit 42) • optional self-hosting
Dashlane	`Dark web monitoring + built-in VPN (premium plans)`	• No known vault breach to date • bundles dark web monitoring and optional VPN • removed free tier in September 2025 • most recent public audit dates to 2016 — transparency gap vs. 1Password/Bitwarden
LastPass	`2022 breach: encrypted vaults + unencrypted URLs stolen`	• Avoid for new deployments. 2022–2023 breach exposed encrypted customer vaults alongside unencrypted metadata • subsequent cryptocurrency thefts totaling $150M+ linked to stolen vault data • $24.5M class-action settlement (2026).
NordPass	`XChaCha20 encryption (vs. AES-256 in peers)`	• Uses XChaCha20 instead of AES-256 — newer and considered more future-proof • zero-knowledge • annual independent audits • free plan limited to one device at a time
Proton Pass	`AES-256-GCM; encrypts metadata (URLs, usernames)`	• Swiss jurisdiction (strong privacy laws) • encrypts all vault metadata including item names and URLs — unlike most competitors • includes email alias feature via SimpleLogin
Keeper	`Role-based access, audit logs, Keeper SSO Connect`	• Strong enterprise focus with RBAC, activity logging, and SSO integration • supports emergency access • publishes annual third-party audits
KeePassXC	`.kdbx database file; self-synced via Dropbox/Nextcloud`	• Fully offline and open-source • no cloud component — vault file stored locally • cross-platform fork of KeePass • requires manual sync strategy • maximum user control, no vendor dependency

Table 2: Core Security Architecture

Concept	Example	Description
Zero-knowledge architecture	`Vault encrypted on device → only ciphertext reaches server`	• Provider's servers store only encrypted blobs • without the master password (which never leaves the client), the provider cannot decrypt or read vault contents even under legal compulsion or after a breach

Table 3: Master Password Security

Concept	Example	Description
Passphrase (Diceware)	`correct-horse-battery-staple` (4 words, ~51 bits)	Six Diceware words from the EFF list provides ~77 bits of entropy — comparable to a 13-character random alphanumeric password while remaining genuinely memorable.

Table 4: Password Generator Settings

Setting	Example	Description
Password length	`16 chars minimum; 20+ for critical accounts`	• Length is the primary entropy driver: each additional character multiplies the keyspace • at 16 characters from a full character set, entropy exceeds 100 bits — brute-force impractical