Are Password Managers Safe? Four Risks, Security Research and Practical Mitigations

The short version​

• Password managers are still a sound security choice. NIST's current guidance requires services to allow them. The guidance says well-designed managers encourage complex passwords that are unique to each service. NIST SP 800-63B-4 requires verifiers to allow password managers and autofill.
• Every drawback below is real. Each one depends heavily on the product, your settings and your threat model.
• Each drawback has a practical mitigation.

1. One vault, one master secret​

BGR's argument is simple. Put every credential in one place and that place becomes a prize. Someone who cracks or steals your master password, with no two-factor authentication in the way, could reach your banking logins, email, card numbers and secure notes. The flip side is lockout. BGR notes that managers using a zero-knowledge design don't keep a copy of your master key. If you forget the password and lose your recovery kit, the vault stays sealed.

The risk is real, but it varies by product. Some services offer recovery options and some don't. A stolen master password alone may not be enough if other protections are in place.

What researchers found about cloud vaults​

A study from ETH Zurich and USI Lugano, due at USENIX Security 2026, gives the cloud-vault risk some concrete numbers. The team tested Bitwarden, LastPass and Dashlane. They demonstrated 12 attacks on Bitwarden, 7 on LastPass and 6 on Dashlane, using their own servers that behaved like a hacked password-manager server. Between them, the three serve around 60 million users and hold a 23 per cent market share.

The researchers' summary says the attacks range from integrity violations of targeted vaults to compromise of every vault in an organisation, and most allow password recovery. They also note that "zero knowledge encryption" has no strict technical meaning. A vendor's use of the phrase is not a security guarantee on its own.

The study has limits:

• The threat model is a fully malicious server, meaning the provider's backend has already been breached or tampered with. Some vendors pointed out that the attacks require full compromise of the servers and advanced cryptographic skill.
• The attacks relied on routine actions such as logging in, opening the vault, viewing passwords or syncing. That makes the weakness hard for a user to spot.
• Vendors have responded. Bitwarden said seven issues were resolved or being remediated, LastPass added hardening measures, and Dashlane removed support for legacy cryptography. Reports differ on how complete the fixes are. Don't assume everything is patched, and don't assume nothing is.
• This is evidence about three specific services under one threat model. It doesn't show that every manager fails the same way, or that ordinary users have been attacked this way.

What to do​

• Use a long, memorable master passphrase that you don't reuse anywhere else.
• Turn on multifactor authentication if the service offers it.
• Know how your manager's recovery works. If it issues a recovery kit or emergency-access option, store it offline and protect it like the vault itself.
• Keep the apps and browser extensions updated so you receive vendor fixes.

2. Sync and offline headaches​

BGR's second complaint is that cloud syncing can lag. A login you save on your work laptop may not appear on your phone when you need it. The author admits this isn't an everyday problem and often fixes itself. She also describes a stale offline copy leaving you at an airport gate unable to log in. That is a hypothetical, not a documented outage.

BGR also claims that losing your internet connection will "almost always" cause sync errors. It offers no testing to back that up. Treat it as a possible dependency, not a certainty. Sync design and offline behavior differ between managers and between configurations.

What to do​

• Before committing, check whether the manager offers offline vault access. Also check how it handles changes made while a device is offline.
• Confirm that an important new login has synced to your other devices before you rely on it there.
• Keep a plan for when the service is unreachable, such as a protected emergency-access arrangement.

3. Autofill that doesn't always cooperate​

BGR says autofill often struggles with multi-step logins, such as banking sites and checkout flows. When it fails, you end up copying and pasting by hand. BGR adds that phones suffer most, and that app and OS updates can break integrations. The author warns that enough friction might push people back to weak, easy passwords.

Those are usability claims without measurements. The more interesting angle is that autofill is also a security boundary.

Autofill as an attack surface​

A separate USENIX Security 2026 paper, "AutoFail" from TU Wien researchers, studied how Android's Autofill Framework works with browsers and password managers. They identified vulnerabilities affecting 9 password managers and 5 widely used mobile browsers. The flaws could leak credentials to attacker-controlled origins, bypass web isolation and reveal relationships between a user's accounts. The researchers say they disclosed their findings. Major browser and password-manager developers confirmed them and are implementing fixes.

The public summary has gaps:

• It doesn't name the affected products.
• It doesn't give attack preconditions or patch status.
• It concerns Android's autofill pipeline. It doesn't show that desktop autofill, including on Windows, works the same way.

NIST adds balance. Its guidance says password form elements let managers fill passwords without exposing them through the clipboard. It also recommends that sites allow copy-paste for people using other tools. Autofill has benefits and implementation risks, and the evidence doesn't justify turning it off.

What to do​

• Keep your password manager, browser and operating system updated.
• When autofill fails, check the website's domain before you paste credentials manually.
• Follow your vendor's own security recommendations on autofill settings. There's no universal setting that suits every product.

4. Subscription costs and free-tier limits​

BGR's last point is cost. It argues that subscription pricing feels like "digital rent." It says free tiers may cap devices or saved passwords, and that family plans tend to be premium offerings. It warns that fees might push some people back to sticky notes.

BGR names no providers, prices or plan terms. This is a selection consideration, not a security flaw. Plans and prices change and vary by product, so the claims shouldn't be read as universal. Free plans may be perfectly adequate for some users.

What to do​

Before importing any credentials, check the service's current:

• Pricing and renewal terms
• Device limits
• Sharing and family features
• Recovery options
• Whether the free plan covers your actual needs

A paid plan isn't required to get the core benefit, and cost doesn't make handwritten notes safer.

How the four drawbacks compare​

Bottom line​

BGR's four drawbacks hold up as things to think about before you sign up. They are not reasons to avoid a password manager. The ETH Zurich and TU Wien research shows that vendors' security promises deserve scrutiny, especially "zero knowledge" marketing. It does not show that ordinary users face inevitable vault compromise. NIST still treats password managers as a tool that encourages unique, complex passwords.

Pick a manager deliberately. Look at its recovery model, offline behavior, update record and pricing. Then secure the master password and recovery materials, and keep everything patched.