Password vaulting: what it is and how a vault works

A password vault is the encrypted storage inside a password manager. The NCSC, the UK's national cyber security centre, describes password managers as tools that help you create and store the credentials you use to log in to services, kept in a vault you open with a master password. CISA describes a password manager as a program that generates, stores and fills in your passwords, and recommends it over writing passwords down or keeping them in a file.

How it works

You create one master password, and the manager uses it to lock the vault. The NCSC explains that the key that decrypts the vault is usually derived from your master password, and that it shouldn't be accessible to anyone else, including the provider of a cloud-synced manager. When you sign up for a site, the manager can generate a long random password and save it. When you come back, it fills the login in for you.

An example

Without a vault, most people reuse a few passwords. If one site leaks them in a breach, attackers try the same combination elsewhere, which is called credential stuffing. With a vault, each account has its own random password, so a leak at one site doesn't open the others.

Trade-offs

Putting all your logins in one place makes the vault a valuable target, which is why the master password matters. CISA recommends a long passphrase of unrelated words as the master password and says to turn on multifactor authentication, especially for email, social media and financial accounts. Because the key comes from your master password, losing it can mean losing access to the vault, so pick something you can remember and keep a recovery plan for the account.

Vault vs. browser password saving

Browsers also store passwords. Both are forms of password vaulting. Check how a tool protects the stored data and whether it can sync across your devices before choosing.

How to protect yourself

Pick a long master passphrase

CISA suggests a passphrase of unrelated words, 4 to 7 words long. Don't reuse it anywhere else.

Turn on multifactor authentication

Protect the vault account itself, and your email, social media and financial accounts, with a second step such as an authenticator app or security key.

Let the manager generate unique passwords

Replace reused passwords starting with your email and bank accounts, so one leak doesn't unlock others.

Check where you're exposed

If a breach exposed old passwords, change them. Serus monitors breach databases and the dark web and alerts you when your email or passwords appear, so you know which logins to update.

Frequently asked

Is a password vault safe?

Official guidance recommends password managers over reusing passwords or keeping them in a file. The vault is still a valuable target, so use a strong master password and multifactor authentication.

What happens if I forget my master password?

Often you can't recover the vault, because the decryption key comes from the master password. Check how your manager handles this before you rely on it.

What's the difference between a password vault and a password manager?

The vault is the encrypted storage. The password manager is the full tool around it, which also generates passwords and fills them in.

What is password vaulting?