Password managers are the advice every security expert gives, and for good reason. They generate unique passwords, store them encrypted, and spare you from reusing "Summer2024!" across forty websites. But in 2025, a study from ETH Zürich's security group put a sharper question to the category: how much can a password manager actually protect you when the things around it go wrong? The answer was not the clean "they're safe" that marketing pages suggest.
Most people who search for "password manager security risks" are not looking to abandon their vault. They are asking a more practical question: if I already use one, am I exposed, and what should I change? Or they are deciding whether to adopt one at all and want an honest picture rather than a sales pitch. Both deserve a straight answer.
This article walks through what the ETH Zürich research and the broader incident history actually show, where the real risks sit (master passwords, browser autofill, recovery mechanisms, and the sync layer), and how to set up your vault so the risks stay small. I will also be direct about tradeoffs, because a password manager is still one of the highest-value security tools a regular person can adopt. The goal is to make you a better-informed user, not to scare you away from a tool that works.
Key Takeaways
- A password manager dramatically reduces credential reuse, the single most common cause of account takeovers. That benefit is real and still outweighs most risks for typical users.
- The weakest link is usually the master password. A short or reused master password undoes the whole design.
- Browser autofill, phishing sites, and malicious extensions can expose stored credentials even when the vault encryption itself is sound.
- Vendor breaches have happened. Strong, unique master passwords and a second factor on the vault account limit what a stolen encrypted vault can reveal.
- Audit your vault quarterly: check for weak, reused, and breached entries, and review which browser extensions can read your pages.
- Treat recovery options (emergency access, account recovery codes) as attack surface, and store recovery material offline.
What the ETH Zürich Study Actually Found
Researchers at ETH Zürich's Information Security and Cryptography group examined how popular password managers handle the moments around the vault: how they fill credentials into pages, how they behave when parts of the system are compromised, and how their designs assume a trusted environment that is not always there. The headline finding was not that encryption is broken. It was that the trust boundaries are messier than users are led to believe.
Several themes come through clearly in this kind of research and in related disclosures across the industry:
- Autofill can be tricked. Some autofill implementations could be induced to fill credentials into lookalike or cross-origin frames under certain conditions.
- The browser is part of the trusted computing base. If the browser or an extension with page access is compromised, the vault's protections matter less than you would hope.
- Recovery paths weaken the model. Features that let you regain access, such as emergency contacts or recovery keys, create additional ways in that attackers may target.
- Vendors are a concentration point. Your encrypted vault sits on someone else's servers, so the security of their infrastructure and their key-handling design matters.
None of this means the tools are useless. It means a password manager is one layer in a stack, and its guarantees depend on what surrounds it. The study is most useful as a reminder to examine your setup rather than assume it is airtight.
Where the Real Password Manager Security Risks Are
When people picture a password manager being hacked, they imagine someone cracking AES-256 or breaking into a vendor's database and reading plaintext passwords. Those scenarios are rare. The common failures are more mundane and more under your control. Here is where I would look first.
1. A weak or reused master password
Your master password is the only thing standing between an attacker with a copy of your encrypted vault and everything inside it. Vault encryption is strong, but it is only as strong as the key derived from your master password. Offline cracking tools running on consumer GPUs can test billions of guesses per second against weak candidates.
Say you have 47 passwords across 12 services. If your master password is a single dictionary word with a number appended, a determined attacker who obtains your vault file can often recover it in hours. If it is a 5-word random passphrase (for example, six or more words drawn at random from a large wordlist), the same attack takes astronomically longer. The vault did not change. The master password did.
2. Phishing and fake login pages
Modern password managers check the domain before filling credentials, which is a real protection. But if you manually copy and paste, or if you approve an autofill prompt on a page that looks right but is not, the protection is gone. Phishing kits that mimic bank and email logins are cheap and common, and they often get the URL almost right.
3. Malicious or over-permissioned browser extensions
Any extension with permission to read and change data on the sites you visit can, in principle, see what you type and what gets filled. A password manager extension needs that access. So does a grammar checker, a coupon finder, or a "free VPN." Permission sprawl across extensions is one of the most underrated risks in personal security.
4. Unlocked vaults and shared devices
Auto-lock settings that are set to "never," or a vault left unlocked on a shared family computer, make the encryption irrelevant to anyone sitting at the keyboard. This is the most common real-world exposure I see.
5. Recovery and account takeover of the vault itself
If the email account tied to your password manager account is weakly protected, an attacker who takes over that email can often reset your vault account. Recovery codes stored in a cloud note, or emergency access granted too broadly, widen this path.
6. Vendor-side incidents
Password managers have experienced security incidents, and the lesson the industry drew was that encrypted vaults with zero-knowledge designs limit damage, but metadata, account details, and some recovery data may still be exposed. Your protection here comes from a strong master password and a second factor on your vault account, so that a stolen copy of the encrypted data is not enough.
How Password Managers Compare on Security Trade-offs
Not every password storage approach carries the same risk profile. The right choice depends on your threat model: a casual user worried about reused passwords has different needs from a journalist protecting sources. Here is a practical comparison.
| Option | Protects against password reuse | Exposure if the vendor is breached | Autofill phishing risk | Setup effort | Best for |
|---|---|---|---|---|---|
| Cloud password manager (zero-knowledge) | High | Low to moderate (encrypted vault only) | Low to moderate, depends on domain matching | Low | Most individuals and families |
| Local-only password manager (self-hosted or offline vault) | High | None from vendor (you hold the file) | Low to moderate | High (you manage backups and sync) | Technically confident users |
| Browser built-in password saving | Moderate | Depends on browser account security | Moderate | Very low | Light users who accept tradeoffs |
| Notes app or spreadsheet | Low (people rarely keep it unique) | Depends on the host service | High (no domain checking) | Low | Not recommended |
| Reusing a few memorable passwords | Very low | Entire exposure when any one site leaks | High | None | Not recommended |
For most readers, the cloud zero-knowledge option wins on balance. The residual risks are manageable, and the alternative of reused passwords is far worse. The local-only route is worth it if you are willing to handle backups carefully, because it removes the vendor from your threat model entirely.
How to Harden Your Password Manager Setup
The fixes below address the risks above in rough order of impact. You can complete the core set in under an hour.
- Replace your master password with a passphrase. Use five or six words chosen at random, not sentences you invented. Write it on paper and store it somewhere safe at home until you have memorized it. Do not store it in a note on your phone.
- Turn on two-factor authentication for the vault account. Use an authenticator app or a hardware security key rather than SMS where the option exists.
- Secure the email account behind your vault. Give that email its own unique password, enable two-factor authentication, and review its recovery options. This email is effectively the key to everything.
- Set a sensible auto-lock timeout. Five minutes of inactivity is a reasonable default. Lock the vault manually when you step away from a shared machine.
- Audit your existing passwords. Use the vault's health or breach report to find weak, reused, and compromised entries. Change the most important ones first: email, banking, cloud storage, and your work accounts.
- Review browser extensions. Remove anything you do not use, and check the permissions of the rest. A password manager extension should be the only one with broad rights on your banking pages.
- Store recovery material offline. Print recovery codes and keep them in a locked drawer, not in a cloud note or a screenshot on your phone.
- Enable domain checking and disable blind autofill on unfamiliar pages. Let the manager fill only when the domain matches an entry exactly.
A worked example: auditing a real vault
Take a typical user with 47 saved logins across 12 services that matter (email, two banks, a cloud drive, a shopping account, streaming, a work VPN, social media, and so on). A first audit might turn up the following, and the numbers are instructive.
- 9 passwords reused across 2 or more sites. If one site leaks, all 9 accounts are exposed at once.
- 4 entries flagged in a breach report, including one email account that was used on a site that was later compromised.
- 2 logins with weak passwords under 10 characters.
- 1 saved login on a lookalike domain (a typo of the real bank address), which the user does not recognize.
The fix is a sequence, not a single heroic afternoon. Start with the email account and the two banks, because compromise there cascades into everything else. Generate new 20-character random passwords for each, update the vault entry, then sign out of other sessions. Work through the reused set over the next week. Delete the lookalike entry and confirm the real domain is saved correctly. A user who completes this in two or three evenings has eliminated the most damaging exposures without changing tools.
When a Password Manager Is Still the Right Call
After everything above, it is fair to ask whether a password manager is worth the trou
