2.2: What a Password Manager Actually Is

What a Password Manager Actually Is

A password manager is three tools in one app: an encrypted vault that stores your passwords, a generator that invents a new random password whenever you need one, and autofill that types them into login pages for you. You remember exactly one thing, your master passphrase, and the manager remembers everything else.

That’s the whole product. But you’re about to hand it every key you own, so you deserve to know precisely what it does with them.

Zero-knowledge, in plain words

Good managers are built on a design called zero-knowledge: your master passphrase never leaves your device. Your device uses it to derive the encryption key, scrambles your vault locally, and sends only the scrambled version to the company’s servers. The company stores locked boxes. It does not have the key, and it cannot compute the key.

This is why a manager company can’t email you your forgotten master passphrase. It isn’t policy — they truly don’t have it. The same design that makes forgetting inconvenient is what makes the company’s servers a boring target.

“But what if the manager company gets breached?”

It happens. Password manager companies are heavily attacked, and one major one, LastPass in 2022, lost customer vault data outright. So walk through what the attackers took: a warehouse of sealed safes. No master passphrases, because those never left customers’ devices. Each safe has to be cracked on its own, by guessing its owner’s master passphrase.

Which points to the one real weakness in the system: a weak master passphrase. LastPass users with short or reused master passphrases had reason to worry. Users with a strong, unique one had handed the attackers ciphertext they could keep forever without opening. The lesson isn’t that managers are unsafe. It’s that everything rests on the one secret you keep, which is why the next lesson treats creating it with real care.

Choosing one

• 1Password (paid, roughly the price of a coffee each month). The most polished apps, excellent family sharing, and Watchtower, a report that flags weak, reused, and breached passwords. The default answer if you’re willing to pay.
• Bitwarden (free tier that covers everything; open source). The code is public and independently audited, and the free tier does everything this course needs. The default answer if you’re not.
• Apple Passwords / Google Password Manager (free, already on your devices). Real zero-knowledge encryption and solid security. The trade-off is reach: they work beautifully inside their own ecosystem and awkwardly outside it. If every device you own is Apple, or your life runs on Chrome and Android, they’re a legitimate choice.

What’s not a legitimate choice in 2026: a notebook of reused variations, or the same three passwords rotated from memory. Any manager above beats that by a mile.

“Isn’t one basket risky?”

All your eggs in one basket sounds wrong until you look hard at the alternative. This basket is armored: encrypted with a key derived from a passphrase only you know, guarded by a company whose entire business is guarding it. And the alternative was never “no basket.” It was fifty flimsy baskets scattered across the internet, most sharing the same lock, where a breach of the weakest opens the rest. You read Module 1. You know how that ends.

Pick one before the next lesson. It’s a five-minute decision, and 2.3 is where you set it up for real.