Are Password Managers Safe? What Audits and Incidents Show

Short answer: Yes, for most organizations, if the vendor uses documented zero-knowledge or end-to-end encryption, requires single sign-on and multi-factor authentication on the account that opens the vault, and has a track record of disclosing and patching incidents. The risk that remains is concentration: one compromised admin account now protects everything.

How password managers protect data

Business password managers use what vendors call zero-knowledge or end-to-end encryption: your device encrypts and decrypts vault data locally, and the vendor's servers only ever store and sync ciphertext they cannot read. 1Password describes a dual-key model in which the account password and a separate secret key are combined on the device to derive the encryption key, so the company states it cannot see what a customer has saved. Bitwarden documents a comparable design: data is encrypted with AES-256 and authenticated with HMAC-SHA-256 on the local device before anything reaches its servers, which function only as encrypted storage.

For an IT team, the practical effect is that a server breach alone should not expose plaintext vault contents, because the decryption keys never leave client devices. What it does not protect against is the client itself: a compromised endpoint, a phished master password, or an admin account without MFA. It also assumes the vendor's server behaves honestly during login and sync, an assumption the February 2026 ETH Zurich research directly tested.

Known incidents and what they changed

The incidents below span multiple vendors and are included as neutral, dated examples of how the market has actually failed and recovered, not a ranking of which product is safest.

The real risks

A password manager changes what IT teams need to defend, not whether they need to defend anything.

• Concentration risk: one vault now guards every credential in the business, so the account that opens it becomes the highest-value target, not any single password inside it.
• Client-side compromise: zero-knowledge encryption protects data at rest and in transit, but it does nothing for a phished master password or malware already running on an admin's device.
• Browser extension attack surface: the August 2025 DEF CON 33 research found the weakest point was rarely the core encryption; it was the extension's autofill interface.
• Server trust assumption: a zero-knowledge claim only covers an honest server. The February 2026 ETH Zurich study showed a compromised or malicious server can still manipulate vault data during ordinary login and sync, a scenario most vendor marketing does not address.
• Third-party supply chain exposure: LastPass's June 2026 incident, a stolen OAuth token at a third-party vendor reaching its CRM, shows the attack surface extends past the vault itself.
• Offboarding gaps: the security benefit disappears if departing employees keep vault access because deprovisioning is manual instead of tied to the identity provider.

How to reduce the risk

1. Require SSO and phishing-resistant MFA, such as a hardware key or platform authenticator, on the account that opens the vault, not just a master password.
2. Keep browser extensions on automatic updates and set extension site access to "on click" rather than "on all sites" in Chromium-based browsers, a mitigation recommended after the DEF CON 33 clickjacking disclosure.
3. Tie vault provisioning and deprovisioning to the identity provider (Entra ID, Okta, Google Workspace) through SCIM or directory sync, so an offboarded employee loses vault access the moment HR closes the account.
4. Read the vendor's own SOC 2 Type II and ISO 27001 reports rather than the marketing summary, and confirm the audit date is current, not several years old.
5. Check the vendor's public incident history for how quickly it disclosed and patched, not only whether an incident happened, since every vendor named in this article has had at least one.
6. Keep a break-glass account outside the password manager, protected by a hardware key and a documented recovery process, in case the vault itself becomes unavailable.

What to check before you choose one

None of the incidents above are a reason to avoid password managers. CISA's guidance to small and medium businesses is to require one specifically because the alternative, reused or written-down passwords, shows up constantly in breach data.

The difference between a good and a risky choice is documented assurance:

• A published encryption architecture.
• Current SOC 2 Type II and ISO 27001 reports.
• SSO and SCIM on a plan your organization can actually use.
• A public record of how the vendor has handled past incidents.

The password management category hub lists the vendors covered on this site as a starting point, and the shortlist builder turns these checks into a checklist to score a vendor against. For one vendor's audit and incident record in full, see the Bitwarden review.

Bottom line

For most organizations, a business password manager is safer than the alternative it replaces, provided the vendor publishes its encryption model, keeps its SOC 2 and ISO audits current, and has a track record of disclosing incidents instead of burying them. That verdict flips for a team with no capacity to enforce SSO, MFA and offboarding, since a password manager without those controls just centralizes the risk instead of reducing it. Start with the buyer guide for choosing a business password manager to work through the requirements against your own environment.