How do password managers work?

Most people hate to register accounts, much less to create passwords. That might be the reason why they re-use them several times when creating accounts. Although it solves the problem at hand – registration, it leaves a gap in your security, which could one day explode in your face.

However, it’s the year 2020, and there are solutions. One of them could be password managers. With them, you could create complex passwords and store them. Here’s how the password managers work and how you can use them to make yourself safer on the web.

What is a password manager?

A password manager is a program that allows you to generate and store your passwords in an encrypted vault. Without one, you would have to remember all your log-in details, which usually results in re-using the same weak passwords.

In contrast, you only have to remember one master password when using a password manager. And thanks to the autosave and autofill features, you’ll be able to connect to all your accounts easily.

Most of them let you also store credit card information for easy and safe online shopping as well as secure notes. You can also share selected information with your family and friends without copy-pasting it into an email or instant message. It also supports using biometric data (fingerprint or face) instead of your master password for even more security and convenience.

How do password managers secure your passwords?

There are multiple ways to categorize password managers. However, this time we want to present three technologies and explain how they work. We must also point out that some providers offer multiple methods to save your data. Most of them will require you to use a master password that protects your vault.

Here are the three types of password managers:

• Locally installed or offline password managers
• Web-based or online password manager services
• Stateless or token-based password managers

Let’s explore each of them more thoroughly.

Locally installed or offline password managers

As the name implies, locally installed password managers, also known as offline password managers, store your data on your device. It can be your computer or a smartphone, depending on your preference. You will find your passwords in an encrypted file, separately from the password manager itself. Some managers also allow storing each password in a separate file, greatly increasing overall security.

As always, you need a master password to access your offline vault. If it’s a strong one, there’s a minimal chance that either the government or some hackers will break into your local database. That’s because brute-forcing military-grade encryption requires a significant amount of time. What’s more, if you keep that device with all passwords offline, there’s no way to access it without seizing it.

Naturally, offline password managers have some inherent flaws. For starters, using them on multiple devices might prove challenging. There’s only one location, and other devices somehow have to sync with the one that has the vault. It usually means having your device with the locally installed password manager online, so it becomes accessible to third-parties. Finally, if the device with your offline password manager breaks down and you have no backup, be ready for some tedious manual labor.

If you have an offline or locally installed password manager, then your passwords are stored locally! To be more precise, it’s the device that you’ve chosen for your vault. However, there’s a possibility to synchronize the passwords between multiple devices, which means all of them must be online. If you want even more security, you can save your passwords on different files, requiring a unique key for each.

Pros

Eliminates the risk that someone will breach your password vault

Usually, it’s a free service

Cons

You can access your vault on only one device

If you lose your device, you lose your vault

Web-based or online password manager services

By far, the most popular type, web-based password managers, store your passwords on a cloud, which is usually the provider’s server. Such setup means that you can access your passwords from everywhere anytime, without the need to install the online password manager software. If accessing your vault via a web application is not possible, you would only need a browser extension or a mobile app.

But how can one know if their passwords are not accessible to the provider? Well, all reputable online password managers use zero-knowledge technology. It means that they encrypt your data on your device before sending it to the server. It also means that your vault is available for access attempts to third-parties 24/7. What’s more, all security measures mean nothing if there’s a keylogger malware on your device, and you’re not using two-factor authentication.

Finally, you should expect to pay for a web-based password manager. There are great free versions to choose from, but some features like device limit or dark web scanning will always be premium. That said, most paid online password managers will not break your bank, especially if you commit long-term.

Chances are you went for the online (or web-based) password manager. In this case, your passwords are stored online! Your vault is on the provider’s server, available 24/7 to you from anywhere as long as you have the master password. You don’t even need to install the password manager client – most of the time, a browser extension will suffice. Sometimes you can access the vault via a web application available on the provider’s website.

Pros

You can sync your vault across all your devices

Usually, it will be paid service

Cons

You’ll need Internet connectivity for authentication

Your credentials are stored in an unknown location

Stateless or token-based password managers

Last on the list are token-based or stateless password managers. In this scenario, a local piece of hardware, such as a flash USB device, contains a key to unlock your particular account. There’s also no such thing as a password vault because the password manager generates them anew every time you log in. For additional safety, we recommend using not only the token but your master password too. This way, you’ll be implementing two-factor authentication.

Stateless password managers don’t require synchronization between your devices because there’s no database in the first place. In a way, that’s also safer because there’s no place where a hacker can find all your passwords. Although, one can hack token-based passwords if she or he knows the master password and one account.

Contrary to online password managers, these are usually free and open-source. That’s why they are not particularly recommended for amateur users because all the support they get will be forums and knowledge bases. On top of that, you will need a smart card reader or a USB stick to generate tokens.

And if you find yourself with a token-based password manager (also known as a stateless password manager), that means your passwords are stored nowhere! How can it be so? Well, as the name implies, there’s no password vault, only token generation whenever you access a specific account. One can generate a token on an external device, such as a USB stick.

Pros

Your credentials are stored in a separate device

Cons

If you lose your device, you lose your access

This method usually requires proprietary hardware and software

How do password managers encrypt passwords?

256-bit AES encryption is a military-grade level cipher used to encrypt and decrypt data so only authorized parties can access it. The NSA and major corporations adopted it in 2005, and it soon became a standard for Virtual Private Networks, firewalls, and password managers.

While AES is the encryption, 256-bit is the key. Encryption keys are random strings of zeroes and ones. In this case, it means there are 2^256 combinations available. The more combinations, the harder it is to brute-force the right one.

AES 256-bit is a so-called symmetric or private key encryption algorithm. The key is used both for encrypting and decrypting data, so both parties must know it. In contrast, asymmetric or public-key encryption uses a public key for encryption and a private key for decryption. As a result, the private key doesn’t have to leave your device, increasing security.

Not all password managers use AES-256 encryption. Some use the less secure (although still extremely hard to brute-force) AES 128-bit standard. Usually, these are free and open-source password managers that get less-frequent updates.

However, there’s already better encryption than AES 256-bit that goes by the name of XChaCha2. So far, only NordPass has implemented this next-gen cipher among all premium password managers. It comes with Argon2 for key derivation while XChaCha2 encrypts your password vault.

Why use a password manager?

1. Password generators. You don’t need to spend 15 minutes pondering on the things that you like to come up with a password. Several password managers will allow you to generate a safe password with varying complexity. Not only this saves your time, but it also comes up with better passwords.
2. It makes the process easier. Password management, when you’re using a multitude of websites and platforms, is tedious. A reliable password manager tool will allow you to administrate all your passwords from a centralized environment
3. No more typing. Most password managers have a built-in feature that allows you to auto-fill passwords and other recurring information. It extends to your payment information or addresses. It saves you the hassle of needing to remember every single one of your passwords
4. Secure password sharing. Many people are sharing accounts with their friends and family. Netflix even allows different users that all log-in with the same password. However, the best way to share them isn’t to paste it into the chat. That’s the definition of asking for trouble. The password manager then allows users to securely share passwords with other users.
5. Cross-platform support. As applications, password managers are not at all complicated and do not require a lot of resources. It means that it’s much easier to develop them for a variety of platforms like web browsers or smartphone apps. For the end-user, this means an ability to get the same password vault no matter what’s your preferred method of connection.
6. Multi-factor authentication. Even if a hacker would install a keylogger and get your master password, this wouldn’t mean the end of the world if you have two-factor authentication enabled. The password would be useless without it, so you would still be safe, and the vault would stay locked.

Password manager setup

The answer depends on what type of password manager you are planning to use. If it’s token-based, first you need to decide what kind of device you want to use for key generation. In case you’ve decided on an offline password manager, you should also choose the primary device that will store your database. And if you’re leaning towards an online service, narrowing down your selection to a free or paid option should save plenty of time.

7-step password manager setup

Since the web-based password managers are the most user-friendly, we’ll be using them as an example. Below are the key steps in setting up a password manager:

1. Decide which devices you want to use your password manager on. Is it going to be your phone? If so, does anybody else know your access code? What about shared home devices, such as tablets and smart TVs? Will you use your password manager on the work computer? These are some of the most important questions to ask yourself before setting up your vault.
2. Install your chosen password manager. There are plenty of free and paid versions to choose from, but we recommend using only the best password managers. You should check what features are available on the free version (if any) and whether the added perks justify the price. Afterward, make sure it supports your OS and browser. If you’re planning to import your current vault, check if it’s possible first. Finally, paying a bit more for 24/7 customer support often pays off.
3. Create a secure master password. Even if your selected password manager allows master password recovery, you should still choose one that’s memorable but hard to guess. To fulfill the last requirement, it may be a good idea to use a passphrase containing 4-5 randomly chosen words. Lastly, while this may sound weird, consider sharing your master password with the person you trust the most so he or she could access your vault should something happen to you.
4. Enable two-factor authentication (2FA). Adding 2FA to the mix will greatly improve your password security. While the second factor can be “something that you have,” which will probably be your smartphone, we recommend choosing “something that you are” and using biometrics. Depending on your device, it can be either a fingerprint or also a face scan. What’s more, you can use 2FA instead of a master password, which significantly improves usability on touchscreen devices.
5. Start entering passwords. Before you get used to your new password manager and while you still cannot remember your master password that well, you may want to enter less important passwords first. A good idea is to generate a strong password for the email that you use for recovering the master password. Otherwise, a hacker can easily get hold of your database after breaking into your mailbox.
6. Consider adding other data. The majority of password managers let you save not only logins but also credit card details and secure notes. If you’re doing a lot of online shopping, having the payment info in autofill can save quite some time. And there’s probably no better place to keep the secrets that you may want to share only with the most trusted friends.
7. Share your logins. Sooner or later, somebody will ask you for your Netflix account. Copy-pasting the username and password is not the best idea, so that’s why your password manager allows you to share logins with others (or at least some do). Some services even allow you to create folders where you store the least-sensitive and often-shared passwords.

Can password managers work on multiple devices & phone apps?

Not all password managers can work on multiple devices, including smartphones. A stateless password manager is based on the idea that only one device can generate passwords for your accounts. What’s more, there’s no such thing as a password vault that you could check.

Locally installed password managers are also not suited for use on a bunch of devices. That’s because you are saving your database on one computer or smartphone and syncing between all devices is possible, but not convenient. Of course, if you decide to use multi-factor authentication, you will probably need two compatible devices.

Web-based password managers do work on multiple devices, mobile apps, and even browser extensions. Some also offer web applications accessible from the provider’s website. Your vault is stored in the cloud, meaning that the password manager is as device-agnostic as it can be to guarantee maximum usability. The actual scope will entirely depend on the particular service that you’re using.

FAQ