Can a Password Manager Be Hacked? And How Do We Talk About It?
I got asked this on a webinar last week. Then I got asked it again a few days later.
I’m running webinars throughout Cybersecurity Awareness Month, and every time I mention password managers, someone puts their hand up. Can they be hacked?
I used to give a quick, confident “they’re safe, just use one” but I don’t anymore, because that answer doesn’t land and it isn’t completely honest either.
The honest answer: yes
A password manager is software built by a company, so of course it can be attacked.
LastPass were compromised in 2022 and that is the one that most people remember, and the people asking may know about it already. Attackers did manage to copy customer vault backups. Yes, the vaults were encrypted, but things like the website URLs were not. People that had weak master passwords were in real trouble but people with strong ones were in a far better place.
So I tell people what a breach actually costs them... and then I compare it with what they’re doing now.
The comparison that matters
Most of the people I speak to aren’t comparing a password manager with a perfect system. They’re comparing it with:
- the same password on forty sites
- a notes app or a spreadsheet
- a favourite password with a number on the end that changes every few months
One breach at any site they use and the rest start to fall like dominoes.
A decent password manager does, of course, break that chain:
- Your vault is encrypted on your device before it syncs anywhere, so the provider holds data it can’t read.
- Every site gets its own random password, so one leak is contained at that one leak.
- Autofill checks the web address, which means a lookalike phishing page often won’t fill anything in.
That quiet little warning does a job I can’t rely on people to do themselves at 4:55pm on a Friday.
I use the free version of Bitwarden and I tell people that in every session, because it changes the room. It’s open source, it publishes independent security audits, and the free tier covers everything most people need. I used other solutions previously but they wanted to charge me for using more that one device.
The risks are still real
We can't hide this and I think I’d rather say so than hide them.
- A weak master password undermines the whole thing.
- Malware on a device can capture what you type or autofill.
- A phished login to the manager itself can hand over the vault.
Turning on multi-factor authentication for the password manager account closes a lot of that gap, so I now treat it as part of the advice rather than an extra.
The hard bit is communication
That’s the technical story, and to be honest, it’s the easy bit.
Almost nobody objects to the encryption. They object to the feeling. “All my passwords in one place” sounds reckless, even when the maths and us says it’s safer. Going in to detail about AES-256 encryption (if you can) doesn’t shift a gut feeling. That's where stories come in. Analogies as well. I’m still working out which ones work and which ones get a polite nod and nothing else.
Then there’s the practical stuff. Setup takes effort. Moving years of saved logins is tedious. Browsers already offer a built-in option, so people ask why they’d need anything else. Shared family accounts, work versus personal logins, and the fear of forgetting the master password come up every single time.
Over to you
I’d like to hear how you’re dealing with this.
How are you explaining it? - How do you explain the safety of password managers to people who aren’t technical? Do you bring up the LastPass breach yourself, or wait until someone else does? What has actually changed someone’s mind, and what fell flat?
Adoption. - What does it look like where you are? Do you give people a company-approved manager, recommend one, or leave it up to them? Have you seen uptake move after a campaign, and what do you think caused it?
Barriers. - What has got in your way? Budget, leadership scepticism, user fear, the support load when someone forgets their master password, or something I haven’t thought of?
Drop it in the comments. I suspect plenty of us are solving the same problem on our own, and I’d love to change that.
