Why Your Password Manager
Isn't Enough

← Back to blog

If you're using a password manager, you're already ahead of most people. You're not reusing passwords across sites. Every account has a long, random, unique credential. Your brain isn't deciding between Password1 and Password1!. That's a meaningful improvement in your security posture.

But "ahead of most people" isn't the same as "protected." Password managers solve a specific problem very well. They don't solve everything. And the gaps they leave are exactly where modern attacks are focused.

Here's what you're actually protected against, what you're not, and the additions that close the remaining exposure.

What Password Managers Actually Do Well

It's worth being precise about the value here, because it genuinely is substantial.

• They eliminate password reuse. Credential stuffing, taking a leaked username and password from one breach and trying it on every other site, is one of the most prolific attack methods in use today. Unique passwords on every account make this a dead end.
• They generate strong passwords. A 20-character random string is not guessable or brute-forceable in any practical timeframe. Humans are terrible at generating randomness; password managers are excellent at it.
• They protect against lookalike phishing domains. Autofill only triggers when the domain matches exactly. A password manager won't fill your credentials into micros0ft.com or paypa1.com, it doesn't recognise the site. This is a meaningful phishing defence that gets overlooked.
• They reduce friction. The reason people reuse passwords is that unique passwords are hard to remember. When the manager handles memory, the path of least resistance becomes the secure path.

What They Don't Protect Against

1. Malware already on your device

If an infostealer or keylogger is running on your machine, it can capture your master password as you type it. Or it can extract credentials directly from the vault database before it's encrypted. This isn't theoretical, RedLine Stealer, one of the most widely distributed infostealer variants, specifically targets password manager vault files and browser credential stores.

The password manager is only as safe as the device it runs on. A compromised device means a compromised vault.

2. A weak or phished master password

Your password manager is secured by a single master password. If that password is weak, guessable, or reused somewhere it's been breached, you've concentrated all your risk into one point of failure. The 2022 LastPass incident is instructive here: attackers obtained encrypted vault data. For users with strong, unique master passwords and MFA enabled, the impact was low. For users with weak master passwords, those vaults were potentially crackable offline.

The master password needs to be long (15+ characters), unique to the password manager, and ideally something that doesn't appear in any dictionary or previous breach. A randomly generated passphrase works well.

3. Social engineering

No technical control prevents a convincing phone call, a fabricated urgency, or a well-crafted pretext from getting a person to hand over an MFA code or approve a login request they shouldn't. Password managers don't have opinions about whether you should be logging in right now. They just fill the credentials.

4. Session and cookie theft

This is the gap that's grown significantly over the past two years. Modern malware families like Lumma Stealer and Stealc go after browser session cookies rather than passwords. The session cookie is the proof that you already authenticated. An attacker with your session cookie can import it into their own browser and pick up exactly where you left off: already logged in, MFA already passed, no credentials needed.

Your password manager plays no role here. The account is already authenticated. The threat is the active session, not the password.

What to Pair It With

These additions are listed in rough order of priority. Each one closes a specific gap.

1. MFA on the password manager itself

This is non-negotiable. Enable multi-factor authentication on your vault, use an authenticator app (Authy, Microsoft Authenticator, or your manager's built-in TOTP), not SMS. If your master password is ever compromised, MFA is the last line of defence before your entire credential set is exposed.

2. MFA on every account that matters

Microsoft 365, Google Workspace, your email, your bank, any SaaS platform holding business data. MFA on the account itself means a leaked password alone isn't enough to log in. Use an authenticator app rather than SMS wherever possible, SIM-swapping attacks can intercept SMS codes, and targeted attacks often involve this.

3. A hardware security key for your most critical accounts

For your email account and your password manager master account, consider a FIDO2 hardware key (YubiKey is the market leader). A hardware key provides phishing-resistant MFA, the cryptographic authentication is bound to the legitimate domain, so even if you land on a convincing fake login page, the key won't authenticate. You can't steal what never leaves the physical device.

This is a higher bar than most firms need immediately, but for business owners or anyone with high-value accounts, it's worth the investment.

4. EDR on every endpoint

Endpoint Detection and Response is the answer to the infostealer and session-theft threat. Consumer antivirus catches known signatures. EDR watches behaviour, it identifies processes attempting to read vault databases, scrape browser memory, or exfiltrate data, even if the malware is brand new and has no known signature yet.

This is the control that protects the password manager from the device it runs on being compromised. Without it, the vault is only as secure as whatever you last clicked on.

5. Passkeys where available

Passkeys replace the password entirely with a cryptographic key pair stored on your device. There's nothing to steal from a breach, nothing to phish, and nothing to reuse. Google, Apple, Microsoft, and a growing number of SaaS platforms support them. When a service offers passkeys, use them, they remove the credential from the threat model entirely.

Which Password Manager Should You Use?

For most individuals and smaller firms, the choice matters less than simply using one consistently. That said, there are meaningful differences:

• Bitwarden, open source, independently audited, generous free tier, self-hosting option for the privacy-conscious. The default recommendation for most people.
• 1Password, excellent business features, clean UX, good team vaults and permission management. Strong choice for smaller teams.
• Dashlane, built-in dark web monitoring, solid business dashboard. Good if you want breach alerts bundled in.

One thing to avoid: relying on your browser's built-in password storage as your only vault. Chrome, Edge, and Safari all store credentials, but with no MFA on the vault itself, the protection is your device login, nothing more. Browser credential stores are also a primary target for infostealers precisely because they're predictably located and easily accessed.

The Layered Security Model

The underlying principle here is that no single control covers everything. A password manager is excellent at what it does. MFA is excellent at what it does. EDR is excellent at what it does. The gaps in each control are covered by the others.

Credential stuffing is stopped by unique passwords. Phished passwords are stopped by MFA. Malware attempting to steal credentials is stopped by EDR. Session theft is stopped by EDR and short session lifetimes. Physical device theft is stopped by full-disk encryption.

The question to ask about any security tool isn't "is this enough?" It's "what does this cover, and what sits alongside it?"