Can password managers be hacked?
Short answer
Yes, password managers can be targeted and compromised by cyber criminals. Even when you use a complex password or a password manager, CISA warns that malicious actors still have ways to harvest or get past single passwords. Layering your protection with multi-factor authentication stops attackers from gaining access if your password is compromised.
The details
A common mistake is treating a master password as complete protection. Threat actors can harvest passwords through phishing attacks or social engineering. As CISA highlights, relying only on what you know leaves an account vulnerable to being guessed, stolen, or reused. Adding a second factor—such as an authenticator app, a text prompt, or a fingerprint—creates a barrier that keeps attackers out even if your vault password leaks.
Security agencies like the NCSC recommend password managers to create and remember complex passwords, but emphasize combining them with basic defensive practices. Installing the latest software updates ensures device security fixes are applied promptly. Backing up essential data safeguards your records against loss. Prioritize adding two-step verification to your password manager and primary email before managing other accounts.
What to do
- Create a master password using three random words to make it difficult to crack.
- Turn on multi-factor authentication or two-step verification on your password manager.
- Install the latest software and app updates on all your devices.
- Check the security settings on your email and financial accounts to enable second verification factors.
- Back up your important data to an external drive or cloud storage.
Terms explained
- Multi-factor authentication
- Multi-factor authentication (MFA) requires two or more kinds of proof to sign in, such as a password plus an app prompt, security key or biometric unlock of a passkey.
- Password manager
- A password manager is an app that generates, stores and fills unique passwords and passkeys, protected by one strong master password and usually MFA.
- HTTPS and TLS
- HTTPS is HTTP protected by TLS encryption, which keeps data between a browser and a website private and tamper-resistant and confirms the site controls its domain.
- Patch management
- Patch management is the process of finding, prioritizing, testing and installing software updates that fix security flaws.
- Phishing
- Phishing is a fraudulent message, usually email, that impersonates a trusted sender to trick people into revealing credentials, paying money or running malware.
- Social engineering
- Social engineering is the manipulation of people, rather than technology, to gain access, information or money.