Password managers are encrypted vaults that generate, store, and autofill unique credentials for every account β eliminating the human memory bottleneck that leads to password reuse. The field matters because 77% of breaches involve stolen credentials, and a single strong master password protecting a vault of randomly generated unique passwords dramatically shrinks the attack surface. The key mental model: a password manager is not just a convenience tool but a security architecture decision β the vault's encryption, key derivation function, and zero-knowledge design determine how safe your data remains even if the provider's servers are compromised. As passkeys gain adoption, the role of password managers is evolving from credential storage to unified identity vaults that handle both legacy passwords and cryptographic passkeys.
What This Cheat Sheet Covers
This topic spans 15 focused tables and 116 indexed concepts. Below is a complete table-by-table outline of this topic, spanning foundational concepts through advanced details.
Table 1: Password Manager Comparison (1Password, Bitwarden, Dashlane, LastPass)
Choosing the right password manager depends on the security architecture, audit transparency, and pricing model β not just features. The four most-discussed managers differ sharply in breach history, open-source status, and zero-knowledge implementation details.
| Manager | Example | Description |
|---|---|---|
Secret Key: A3-ASWWYB-798JRYLJVD4-23DC2-86TVM-H43EB | Uses Two-Secret Key Derivation (2SKD): master password + 128-bit Secret Key must both be present to decrypt vault; neither can be guessed from server data alone. Regular Cure53 audits. | |
Self-hosted via Docker;Premium: $19.80/yr (2026) | Fully open-source (client and server code on GitHub); AES-CBC-256 + HMAC; zero-knowledge; annual third-party audits (Cure53, Mandiant, Palo Alto Unit 42); optional self-hosting. | |
Dark web monitoring + built-in VPN (premium plans) | No known vault breach to date; bundles dark web monitoring and optional VPN; removed free tier in September 2025; most recent public audit dates to 2016 β transparency gap vs. 1Password/Bitwarden. | |
2022 breach: encrypted vaults + unencrypted URLs stolen | Avoid for new deployments. 2022β2023 breach exposed encrypted customer vaults alongside unencrypted metadata; subsequent cryptocurrency thefts totaling 150M+ linked to stolen vault data; 24.5M class-action settlement (2026). |