Are password managers safe for business?

What the NCSC says

The UK's National Cyber Security Centre has backed password managers for years, while being clear that they are a target in their own right:

So the NCSC's answer to "are password managers safe?" is yes, with two conditions: choose a reputable provider, and protect the account with two-step verification. The rest of this page shows what "reputable" looks like in practice.

Zero knowledge explained

All four password managers covered here describe a zero-knowledge design. In plain terms, your vault is encrypted on your own device with a key derived from your master password, so the provider stores only scrambled data it cannot read. Keeper puts it this way: "Encryption and decryption of data always occur locally on the user's device" (Keeper (opens in a new tab)).

What that means if the provider's servers are attacked:

1. You type your master password on your own device; it is not sent to the provider in a form that can be read
2. Your device turns the master password into an encryption key, using a slow key-derivation function that makes guessing expensive
3. Your vault is encrypted with that key before it is synced, so the provider's servers hold only encrypted data
4. Someone who steals that encrypted data has to guess your master password, one slow attempt at a time, before they can read anything

The weak point is the master password itself. A long, unique master password makes stolen vault data extremely hard to crack, and a short or reused one makes it easier. That is why the master password rules you enforce for staff, or unlocking through single sign-on, matter as much as the choice of product. Some details sit outside the encrypted vault, such as website addresses in some products, so it is worth reading each vendor's security pages.

How each password manager protects your vault

Each vendor describes its own encryption on its security pages. Here is what each one states:

1Password's design adds a second secret. Its support site explains: "Your 1Password account password protects your data on your devices ... Your Secret Key protects your data off your devices" (1Password (opens in a new tab)). 1Password adds that "Someone who attempts a brute-force attack on our servers won't be able to decrypt your data without your Secret Key, which we never have".

Independent checks and certifications

Encryption is only part of the picture. The NCSC's "strong security track record" is easier to judge when a vendor publishes certifications, outside testing and a way for researchers to report bugs. As each vendor states it:

These are each vendor's own statements; certificates and reports are usually available from each vendor's trust centre. If your organisation needs copies for a supplier review or an insurer, we can help you request the right documents.

The 2022 LastPass incident

LastPass is often asked about because of two security incidents it disclosed in 2022. LastPass's own account, published on its blog on 1 March 2023 (LastPass (opens in a new tab)), says:

• In the first incident, "A software engineer's corporate laptop was compromised"
• In the second, "The threat actor targeted a senior DevOps engineer by exploiting vulnerable third-party software"
• The backups taken held "encrypted and unencrypted LastPass customer data"; the unencrypted parts included "URLs, file paths to installed LastPass Windows or macOS software, and certain use cases involving email addresses"
• "end user master passwords are never known to LastPass", and vault data "can only be decrypted with a unique encryption key derived from each user's master password"
• LastPass brought in Mandiant, rebuilt its development environment, rotated affected secrets and certificates, and published separate guidance for personal and business customers

Since then, LastPass says it has "rebuilt our core technology, revamped our processes, and restructured our team", raised PBKDF2 iterations to 600,000 and moved to a secure cloud platform (LastPass (opens in a new tab)). Is LastPass safe now? Read LastPass's own account above; we supply LastPass, Keeper, 1Password and NordPass and can compare them on the points that matter to you.

Has NordPass or 1Password been breached?

The useful question for any provider is what protects you if its servers are ever attacked:

• NordPass says that it "encrypts all your data locally on your device before it's uploaded to the cloud", so "even if the organization's encoded data ends up in malicious hands, it will be completely unreadable". It is hosted on Amazon Web Services and "stores customer vault items in separate AWS data centers across the US and EU" (NordPass (opens in a new tab)). We found no breach notice on NordPass's own website
• 1Password says: "Your credentials are encrypted on your device before they reach our servers. We never hold your decryption keys" (1Password (opens in a new tab)). It adds that a brute-force attack on its servers "won't be able to decrypt your data without your Secret Key, which we never have" (1Password (opens in a new tab))

That is the point the NCSC makes: no security product is impregnable, so choose one whose design still protects you if the worst happens, and keep your own side strong.

Your part: the safeguards you set for staff

The provider looks after its servers. Your organisation looks after the accounts, and a business plan lets you set the safeguards once in the admin console:

• Strong, unique master passwords: the NCSC suggests three random words (opens in a new tab), and for a password manager one that is "totally different from any password or passphrase you've ever used anywhere else" (NCSC (opens in a new tab)). Enforce the length with a policy, or have staff unlock the vault through single sign-on
• Multi-factor authentication on every vault: enforce it with a policy, or rely on your identity provider's own multi-factor authentication when staff unlock with single sign-on
• Keep apps, extensions and browsers up to date on work devices, and lock devices with a PIN, password or biometrics
• Set up account recovery and offboarding before you need them: admin recovery, Keeper Account Transfer or NordPass Item Transfer, depending on the product
• On shared or public computers, the NCSC says "you should never save your password in the browser" (NCSC (opens in a new tab))

Our business password policy guide turns these into rules you can adapt.

Choosing a password manager for your organisation

For a business, "safe" also means control: who can see which shared logins, what happens when someone leaves, and whether staff sign in with your identity platform. We can supply Keeper, 1Password, NordPass and LastPass, so we can compare their security documentation, admin controls and single sign-on against your needs and recommend the one that fits. Licences can be billed monthly, with the plan and terms confirmed at quote.

Contact us for free advice or a quote, or read how to choose a business password manager.