Are password managers safe? What happens if one is hacked

Someone tells you to stop reusing passwords and get a password manager. Then you remember the news stories. Companies that store passwords for a living have been hacked. Putting every password in one place sounds like putting every egg in one basket.

It is a fair worry, and the honest answer is not “yes, perfectly safe”. The honest answer is that a password manager is a better bet than the alternatives for nearly everyone, that it can still go wrong, and that how it goes wrong depends on a few things you can check.

What a password manager is protecting you from

Most people have far too many accounts to remember a different password for each. So they reuse one or two. The risk is simple: if one website is breached and your password leaks, criminals try the same email and password on your email, your bank and your other accounts.

The UK National Cyber Security Centre (NCSC), the British government’s security agency, says this directly in its guidance: using the same password across accounts means that one compromised account can let a hacker into your others. It recommends a password manager so you can have a different password for every service without needing to remember them.

That is the comparison to keep in mind. The question is not “is a password manager perfect?” It is “is it safer than what I do now?” For a business whose staff share logins in WhatsApp, the answer is almost always yes.

How the vault is meant to be locked

A password manager keeps your logins in a vault. The important idea is that the vault is locked on your own device before it is stored on the company’s servers.

Companies call this zero knowledge, which means the provider does not know your secret and cannot read your vault. In the common design, a key made from your master password locks the vault on your phone or computer. The company only ever holds the locked copy.

So if the company’s servers are broken into, the thief gets locked boxes, not a list of passwords. That is the theory, and it holds up well, provided the lock is strong. The lock is only as strong as the one secret that opens it.

What really happened when LastPass was hacked

The best-known case is LastPass, which disclosed in 2022 that attackers had stolen customer data. Help Net Security reported LastPass’s own statement on 23 December 2022. The attackers copied customer account details such as names, email addresses and billing addresses. They also copied backups of customer vaults.

Those vault copies were a mix. The sensitive parts, such as usernames, passwords and secure notes, were encrypted. Other parts, including the website addresses saved in each vault, were not. LastPass said the encrypted parts could only be opened with a key made from each user’s master password, which LastPass does not store.

This case teaches three things worth knowing:

1. The locks held, but only as well as the master password. A thief with a copy of your vault can try to guess your master password offline, as many times as they like, without anyone noticing. A long, unique master password makes that impractical. A short or reused one does not.
2. Anything left unencrypted is exposed. Website addresses showed which services people used, which is useful for targeted phishing emails. When you choose a manager, ask what is and is not encrypted.
3. The breach started with a person, not a clever maths trick. According to Wikipedia’s summary of the UK Information Commissioner’s Office findings, an attacker got into the home computer of a senior engineer and captured their credentials. The ICO later fined LastPass UK in November 2025 for not putting appropriate technical and organisational measures in place.

None of that means password managers do not work. It means they are software run by companies, and companies make mistakes. What you can control is how much damage a mistake does to you.

What to check before you trust one

You do not need to read security papers. Ask these questions, and look for plain answers on the company’s website:

• Is the vault locked on my device, so the company cannot read it? If the answer is vague, move on.
• What is not encrypted? Good providers say clearly. Silence is a bad sign.
• Has anyone independent checked it? Look for dated, published audits by outside firms, and whether the provider shows what was found and fixed, not just a badge. For example, heylogin’s security page lists an independent source code review by the German firm secuvera, retested in September 2026, with findings and fixes shown.
• How do they tell you when something goes wrong? A status page and a policy for people to report flaws are good signs.
• What happens if I lose my way in? Recovery options matter, because a manager nobody can open is as bad as no manager.

The NCSC adds a practical point: the best password manager is the one that meets your needs and that you will actually use. A safe tool that staff avoid protects nobody.

Master password, or something else

Most password managers lock the vault with a master password, the one password you remember. Everything depends on it, so it should be long, unique and never used anywhere else.

Some products work differently. heylogin, which WPfoss supports as its partner for Africa, removes the master password and has you approve logins on your phone. That takes away the thing an attacker would try to guess, but it makes your phone part of the plan, so a lost or dead phone needs a recovery routine. We compare the trade-offs in heylogin vs 1Password vs Bitwarden.

What to do whichever one you pick

1. Turn on two-step verification for the password manager itself. The NCSC says that even if a criminal knows your main password, they still cannot get in without the second step.
2. Protect your email account first. Email is how most “forgot password” links arrive, so whoever controls your email can often reach everything else.
3. Keep your devices updated. A password manager cannot protect a computer that is already infected. As the LastPass case shows, an attacker on a personal computer can sometimes capture what you type.
4. Move shared logins out of chat and spreadsheets. Share through the manager, so you can see who has access and remove it when someone leaves.
5. Know your plan for a breach. If your provider reports one, change the passwords for your most important accounts first: email, banking, hosting and your website login.

If you suspect an account has already been taken over, how to tell if your website is hacked covers the first checks.

Want us to check yours?

For a business, the weak point is rarely the software. It is that nobody knows who still has which password, or that the manager was bought and half the team never opened it.

Our heylogin password management service plans the team structure, moves shared logins out of spreadsheets and chat threads, trains everyone and keeps it tidy. You can also ask us to review a password manager you already own.

• Email hello@wpfoss.com
• WhatsApp +254 118 271 160
• Tell us what you need

If your worry is the website itself, the free website security checker reads what a visitor’s browser can see and needs no signup.

Sources and further reading

• Managing your passwords, National Cyber Security Centre (UK). Source for password reuse risk, what a password manager does, turning on two-step verification, and choosing the one you will use.
• LastPass says attackers got users’ info and password vault data, Help Net Security, 23 December 2022. Source for what was copied, the mix of encrypted and unencrypted vault data and LastPass’s statement about the master password.
• 2022 LastPass data breach, Wikipedia. Source for the home computer compromise, offline cracking risk and the ICO penalty in November 2025.
• Security, heylogin. Source for the published independent audits, the status page and the vulnerability reporting policy.