Is a password manager safe?

Yes, a well-designed password manager is much safer than the alternatives most people use: reusing the same few passwords, keeping them in a notes app or a spreadsheet, or writing them on sticky notes. Here's how a password manager protects you, and what it can't do.

The real risk is password reuse

Websites get breached all the time. When one leaks its users' emails and passwords, attackers try the same combinations on email, banking and shopping sites. This is called credential stuffing, and it works because most people reuse passwords.

A password manager removes the problem: it generates a different strong password for every account and remembers them for you. One site leaking can no longer unlock the others.

How a good password manager protects your data

• Encryption on your device. Your data is encrypted before it leaves your phone or computer, so it's never stored or sent in readable form.
• Zero knowledge. The company that makes the app can't read your data, because only you hold the key. What is zero-knowledge encryption?
• Slow key derivation. Your encryption key is derived from your master password with an algorithm that's deliberately slow, so every guess an attacker makes is expensive.
• Your master password is never sent. Good password managers sign you in without sending your master password to their servers.

What happens if a password manager gets hacked?

With a zero-knowledge design, attackers who break into the company's servers only get encrypted data. To read it, they would have to guess each user's master password, and slow key derivation makes each of those guesses costly.

That's why your master password matters so much: a long, unique passphrase keeps your vault out of reach even if the encrypted data is stolen.

What a password manager can't protect you from

• Malware on your device. If your phone or computer is compromised, an attacker may be able to see what you see. Keep your system updated and install apps only from trusted stores.
• Giving away your master password. No app or company will ever need it by email, text or phone call. Never share it.
• A weak or reused master password. It's the one password that protects all the others.

How to choose a safe password manager

• End-to-end and zero-knowledge encryption. Your data should be encrypted on your device, with keys only you have.
• A published security model. The company should explain how its encryption works.
• Strong key derivation. For example, PBKDF2 with at least 600,000 iterations of SHA-256 or 210,000 of SHA-512, as recommended by OWASP, or a memory-hard algorithm such as Argon2id.
• Works on all your devices, so you're never tempted to fall back to reusing passwords.

How Citadel does it

• Your data is encrypted on your device with AES-256-GCM.
• Your keys are derived with PBKDF2-HMAC-SHA512 and 650,000 iterations, more than three times OWASP's recommendation.
• Sign-in uses the Secure Remote Password (SRP) protocol, so your master password never leaves your device.
• Citadel runs on iPhone, iPad, Mac and Windows.

Read the full security model.