How password managers work, and how to judge one

By the TriPass team · Published 11 October 2026 · General security information, not a guarantee about any product.

What a password manager does

It keeps every password in one encrypted vault, fills them into websites and apps for you, and generates new random ones. You remember one strong master password; the manager remembers the rest. That makes a different, long, random password for every account practical, which is the single most effective thing most people can do for their account security.

The reason this matters: in Verizon’s 2025 Data Breach Investigations Report, stolen or abused credentials were the most common way attackers got in, at 22% of breaches. Reused passwords turn one site’s breach into many.

How the vault is encrypted (zero-knowledge)

A well-designed password manager encrypts your vault on your own device before anything is synced. In outline:

1. Your master password is run through a deliberately slow key-derivation function (such as PBKDF2 or Argon2) with a random salt. The slowness costs you a fraction of a second once, but costs an attacker the same for every single guess.
2. The resulting key encrypts the vault with a strong cipher such as AES-256-GCM, which also detects any tampering.
3. Only the encrypted vault leaves your device. Signing in to the service uses a separate value derived from your password, so the company never receives the password or the key.

This design is often called zero-knowledge: the company stores your vault but cannot read it. The consequence people forget: if you lose your master password, the company can’t reset it for you, so there must be a recovery method you control.

Is it safe to keep all your passwords in one place?

For most people, yes, and it is much safer than the realistic alternative of reusing a few passwords. But it does concentrate risk, so it helps to know where the real dangers are:

• A weak master password. If the company’s servers were ever breached, attackers could try guesses against your encrypted vault offline, with no limit on attempts. A long, random passphrase is the defence.
• A compromised device. Malware on your phone or computer can read what you see once the vault is unlocked. No password manager can fully protect an infected device.
• Phishing for the master password. Only ever type it into the app itself or the manager’s real website.
• Losing access. With zero-knowledge encryption, a forgotten master password and a lost recovery method mean the vault is gone for good.

How to judge a password manager: a checklist

Questions worth asking of any password manager, including ours:

1. Is the vault encrypted on your device, before it is synced, with the key derived from a password the company never receives?
2. Does the company say exactly what it stores, and what it can and can’t read?
3. How slow is the key derivation? Look for named algorithms and settings (for example OWASP recommends 600,000 iterations for PBKDF2-HMAC-SHA256).
4. How does recovery work if you forget the master password, and does that method give the company a way in?
5. Has it been independently audited, and is the design documented or the code open for others to check?
6. Does it work everywhere you need it: your phone, your computer, your browser, autofill?
7. Can you export your data in a usable format if you leave?
8. What is free and what is paid, and what happens to your data if you stop paying?
9. Does it support the sign-in methods you use, such as 2FA codes and passkeys?

How TriPass answers those questions

So you can judge us by the same list. This describes the current pre-release build; TriPass is not on the App Store yet.

Whatever you choose, the most important step is the same: one unique, generated password per account, and one strong passphrase you never use anywhere else. Our free password generator can make both.

Sources

• Verizon 2025 Data Breach Investigations Report
• OWASP Password Storage Cheat Sheet
• NIST SP 800-63B-4: Authentication and Authenticator Management