You probably can't trust your password manager if it's compromised
(2026/02/16)
- Reference: 1771258814
- News link: https://www.theregister.co.uk/2026/02/16/password_managers/
- Source link:
Academics say they found a series of flaws affecting three popular password managers, all of which claim to protect user credentials in the event that their servers are compromised.
The team, comprised of researchers from ETH Zurich and Università della Svizzera italiana (USI), examined the "zero-knowledge encryption" promises made by Bitwarden, LastPass, and Dashlane, finding all three could expose passwords if attackers compromised servers.
The premise of zero-knowledge encryption is that user passwords are encrypted on their device, and the password manager's server acts merely as a dumb storage box for the encrypted credentials. Therefore, in the event that the vendor's servers are controlled by malicious parties, attackers wouldn't be able to view users' secrets.
[1]
As one of the most popular alternatives to Apple and Google's own password managers, which together dominate the market, the researchers found [2]Bitwarden was most susceptible to attacks, with 12 working against the open-source product. Seven distinct attacks worked against [3]LastPass , and six succeeded in [4]Dashlane .
[5]
[6]
The attacks don't exploit weaknesses in the same way that remote attackers could exploit vulnerabilities and target specific users. Instead, the researchers worked to test each platform's ability to keep secrets safe in the event they were compromised.
In most cases where attacks were successful, the researchers said they could retrieve encrypted passwords from the user, and in some cases, change the entries.
[7]
They used a malicious server model to test all of this – setting up servers that behaved like hacked versions of those used by the password managers. Seven of Bitwarden's 12 successful attacks led to [8]password disclosure, whereas only three of LastPass's attacks led to the same end, and one for Dashlane.
All three vendors claim their products come with zero-knowledge encryption. The researchers noted that none of them outline the specific threat model their password manager secures against.
The researchers said: "The majority of our attacks require simple interactions which users or their clients perform routinely as part of their usage of the product, such as logging in to their account, opening the vault and viewing the items, or performing periodic synchronization of data.
[9]
"We also present attacks that require more complex user actions, such as key rotations, joining an organization, sharing credentials, or even clicking on a misleading dialog. Although assessing the probability of these actions is challenging, we believe that, within a vast user base, many users will likely perform them."
In the [10]full paper [PDF], they went on to argue that password managers have escaped deep academic scrutiny until now, unlike [11]end-to-end encrypted messaging apps. It is perhaps due to a perception that password managers are simple applications – deriving keys and then encrypting them. However, their codebases are more complex than that, often offering features such as the ability to share accounts with family members and featuring various ways to maintain backward-compatibility with older encryption standards.
Kenneth Paterson, professor of computer science at ETH Zurich, [12]said "we were surprised by the severity of the security vulnerabilities" affecting the password managers.
"Since end-to-end encryption is still relatively new in commercial services, it seems that no one had ever examined it in detail before."
The team's primary recommendation for vendors is to ensure that new users have access to the latest cryptographic standards by default.
One of the main reasons password manager providers haven't upgraded their codebases is that they fear doing so would irrevocably lose existing users' secrets. The researchers said that some vendors have gone to extreme lengths to support older formats, which in turn creates complexity in the code.
The best way forward? The researchers suggested ensuring all new users are onboarded with the latest cryptographic standards, while offering existing customers the choice between migrating to them or staying put, but with the knowledge of the vulnerabilities.
"We want our work to help bring about change in this industry," said Paterson. He claimed: "The providers of password managers should not make false promises to their customers about security but instead communicate more clearly and precisely what security guarantees their solutions actually offer."
Vendor response
Dashlane published a comprehensive [13]response , thanking the researchers, and said the infoseccers' decision to test using a malicious server model represented "a useful exercise."
The vendor also confirmed it had fixed the most serious issue – the attack researchers showed could lead to the disclosure of a password, and published a separate [14]security advisory devoted to that.
[15]McDonald's is not lovin' your bigmac, happymeal, and mcnuggets passwords
[16]Don't click on the LastPass 'create backup' link - it's a scam
[17]HSBC app takes a dim view of sideloaded Bitwarden installations
[18]Death to one-time text codes: Passkeys are the new hotness in MFA
"Dashlane has fixed an issue that, if Dashlane's servers were fully compromised, could have allowed a downgrade of the encryption model used to generate encryption keys and protect user vaults," it said. "This downgrade could result in the compromise of a weak or easily guessable Master Password, and the compromise of individual 'downgraded' vault items.
"This issue was the result of the allowed use of legacy cryptography. This legacy cryptography was supported by Dashlane in certain cases for backward compatibility and migration flexibility.
"Dashlane has removed support for this legacy cryptography, which means these downgrade attacks are no longer possible."
Bitwarden, meanwhile, said in a [19]post : "Bitwarden has never been breached and believes third-party security assessments like these are critical to continue providing state of the art security to individuals and organizations."
It added: "Thank you ETH Zurich for your insights and commitment to stronger password security."
A LastPass spokesperson told The Reg : "Our Security team is grateful for the opportunity to engage with ETH Zurich and benefit from their research. While our own assessment of these risks may not fully align with the severity ratings assigned by the ETH Zurich team, we take all reported security findings seriously. We have already implemented multiple near‑term hardening measures while also establishing plans to remediate or reinforce the relevant components of our service on a timeline commensurate with the assessed risk."
The researchers said the vendors responded constructively to their outreach attempts and were working to mitigate the exploited weaknesses.
The researchers said it is highly likely that the same weaknesses they highlighted in the study apply to other vendors across the industry, and couldn't rule out the possibility the attacks are already known to the more advanced hackers, including those with government backing. ®
Get our [20]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2026/01/07/hsbc_bitwarden_sideloaded/
[3] https://www.theregister.com/2023/01/16/dump_lastpass_bitwarden/
[4] https://www.theregister.com/2016/01/18/dashlane_password_manager/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/11/06/most_common_passwords/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://eprint.iacr.org/2026/058.pdf
[11] https://www.theregister.com/2025/10/08/germany_chat_control_opposition/
[12] https://ethz.ch/en/news-and-events/eth-news/news/2026/02/password-managers-less-secure-than-promised.html
[13] https://www.dashlane.com/blog/zero-knowledge-malicious-server
[14] https://support.dashlane.com/hc/en-us/articles/33346483084050-Security-advisory-Cryptography-downgrade-issue
[15] https://www.theregister.com/2026/02/02/mcdonalds_password_advice/
[16] https://www.theregister.com/2026/01/21/lastpass_backup_phishing_campaign/
[17] https://www.theregister.com/2026/01/07/hsbc_bitwarden_sideloaded/
[18] https://www.theregister.com/2025/12/06/multifactor_authentication_passkeys/
[19] https://bitwarden.com/blog/security-through-transparency-eth-zurich-audits-bitwarden-cryptography/
[20] https://whitepapers.theregister.com/
The team, comprised of researchers from ETH Zurich and Università della Svizzera italiana (USI), examined the "zero-knowledge encryption" promises made by Bitwarden, LastPass, and Dashlane, finding all three could expose passwords if attackers compromised servers.
The premise of zero-knowledge encryption is that user passwords are encrypted on their device, and the password manager's server acts merely as a dumb storage box for the encrypted credentials. Therefore, in the event that the vendor's servers are controlled by malicious parties, attackers wouldn't be able to view users' secrets.
[1]
As one of the most popular alternatives to Apple and Google's own password managers, which together dominate the market, the researchers found [2]Bitwarden was most susceptible to attacks, with 12 working against the open-source product. Seven distinct attacks worked against [3]LastPass , and six succeeded in [4]Dashlane .
[5]
[6]
The attacks don't exploit weaknesses in the same way that remote attackers could exploit vulnerabilities and target specific users. Instead, the researchers worked to test each platform's ability to keep secrets safe in the event they were compromised.
In most cases where attacks were successful, the researchers said they could retrieve encrypted passwords from the user, and in some cases, change the entries.
[7]
They used a malicious server model to test all of this – setting up servers that behaved like hacked versions of those used by the password managers. Seven of Bitwarden's 12 successful attacks led to [8]password disclosure, whereas only three of LastPass's attacks led to the same end, and one for Dashlane.
All three vendors claim their products come with zero-knowledge encryption. The researchers noted that none of them outline the specific threat model their password manager secures against.
The researchers said: "The majority of our attacks require simple interactions which users or their clients perform routinely as part of their usage of the product, such as logging in to their account, opening the vault and viewing the items, or performing periodic synchronization of data.
[9]
"We also present attacks that require more complex user actions, such as key rotations, joining an organization, sharing credentials, or even clicking on a misleading dialog. Although assessing the probability of these actions is challenging, we believe that, within a vast user base, many users will likely perform them."
In the [10]full paper [PDF], they went on to argue that password managers have escaped deep academic scrutiny until now, unlike [11]end-to-end encrypted messaging apps. It is perhaps due to a perception that password managers are simple applications – deriving keys and then encrypting them. However, their codebases are more complex than that, often offering features such as the ability to share accounts with family members and featuring various ways to maintain backward-compatibility with older encryption standards.
Kenneth Paterson, professor of computer science at ETH Zurich, [12]said "we were surprised by the severity of the security vulnerabilities" affecting the password managers.
"Since end-to-end encryption is still relatively new in commercial services, it seems that no one had ever examined it in detail before."
The team's primary recommendation for vendors is to ensure that new users have access to the latest cryptographic standards by default.
One of the main reasons password manager providers haven't upgraded their codebases is that they fear doing so would irrevocably lose existing users' secrets. The researchers said that some vendors have gone to extreme lengths to support older formats, which in turn creates complexity in the code.
The best way forward? The researchers suggested ensuring all new users are onboarded with the latest cryptographic standards, while offering existing customers the choice between migrating to them or staying put, but with the knowledge of the vulnerabilities.
"We want our work to help bring about change in this industry," said Paterson. He claimed: "The providers of password managers should not make false promises to their customers about security but instead communicate more clearly and precisely what security guarantees their solutions actually offer."
Vendor response
Dashlane published a comprehensive [13]response , thanking the researchers, and said the infoseccers' decision to test using a malicious server model represented "a useful exercise."
The vendor also confirmed it had fixed the most serious issue – the attack researchers showed could lead to the disclosure of a password, and published a separate [14]security advisory devoted to that.
[15]McDonald's is not lovin' your bigmac, happymeal, and mcnuggets passwords
[16]Don't click on the LastPass 'create backup' link - it's a scam
[17]HSBC app takes a dim view of sideloaded Bitwarden installations
[18]Death to one-time text codes: Passkeys are the new hotness in MFA
"Dashlane has fixed an issue that, if Dashlane's servers were fully compromised, could have allowed a downgrade of the encryption model used to generate encryption keys and protect user vaults," it said. "This downgrade could result in the compromise of a weak or easily guessable Master Password, and the compromise of individual 'downgraded' vault items.
"This issue was the result of the allowed use of legacy cryptography. This legacy cryptography was supported by Dashlane in certain cases for backward compatibility and migration flexibility.
"Dashlane has removed support for this legacy cryptography, which means these downgrade attacks are no longer possible."
Bitwarden, meanwhile, said in a [19]post : "Bitwarden has never been breached and believes third-party security assessments like these are critical to continue providing state of the art security to individuals and organizations."
It added: "Thank you ETH Zurich for your insights and commitment to stronger password security."
A LastPass spokesperson told The Reg : "Our Security team is grateful for the opportunity to engage with ETH Zurich and benefit from their research. While our own assessment of these risks may not fully align with the severity ratings assigned by the ETH Zurich team, we take all reported security findings seriously. We have already implemented multiple near‑term hardening measures while also establishing plans to remediate or reinforce the relevant components of our service on a timeline commensurate with the assessed risk."
The researchers said the vendors responded constructively to their outreach attempts and were working to mitigate the exploited weaknesses.
The researchers said it is highly likely that the same weaknesses they highlighted in the study apply to other vendors across the industry, and couldn't rule out the possibility the attacks are already known to the more advanced hackers, including those with government backing. ®
Get our [20]Tech Resources
[1] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[2] https://www.theregister.com/2026/01/07/hsbc_bitwarden_sideloaded/
[3] https://www.theregister.com/2023/01/16/dump_lastpass_bitwarden/
[4] https://www.theregister.com/2016/01/18/dashlane_password_manager/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.theregister.com/2025/11/06/most_common_passwords/
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aZNNMBlWRpXa-EiSsOlLYgAAAEQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[10] https://eprint.iacr.org/2026/058.pdf
[11] https://www.theregister.com/2025/10/08/germany_chat_control_opposition/
[12] https://ethz.ch/en/news-and-events/eth-news/news/2026/02/password-managers-less-secure-than-promised.html
[13] https://www.dashlane.com/blog/zero-knowledge-malicious-server
[14] https://support.dashlane.com/hc/en-us/articles/33346483084050-Security-advisory-Cryptography-downgrade-issue
[15] https://www.theregister.com/2026/02/02/mcdonalds_password_advice/
[16] https://www.theregister.com/2026/01/21/lastpass_backup_phishing_campaign/
[17] https://www.theregister.com/2026/01/07/hsbc_bitwarden_sideloaded/
[18] https://www.theregister.com/2025/12/06/multifactor_authentication_passkeys/
[19] https://bitwarden.com/blog/security-through-transparency-eth-zurich-audits-bitwarden-cryptography/
[20] https://whitepapers.theregister.com/
m4r35n357
All together now downvoters, what do we ALL know about The Cloud?
Re: No servers
MJB7
That works fine if you have one device you want to access your passwords on. I can think of several devices I need my passwords on:
My personal laptop
My phone
My partner's laptop
My work computer (where I am typing this, and where I had to enter my el-reg password
Our streaming computer (for driving the telly)
And that doesn't include "a random internet cafe computer if our home burns down". I don't fancy the complexity of backing up a password database across multiple devices.
Re: No servers
cd
KeePass, with a copy on each one.
Blurry lines
Marty McFly
A password is the 'something you know' authentication method. It is supposed to reside between your ears and be inaccessible to everyone else.
Putting that password in a password manager changes it over to a 'something you have' authentication method. Access to a database now becomes the controlling security factor. Compromise the password manager and now it can be shared & duplicated just like a physical key.
The bottom line... Never put anything in an online password manager that doesn't also have a multi-factor companion.
Re: Blurry lines
MJB7
"Never" is too strong. I don't actually care if somebody manages to find my ElReg password.
If you were serious about security
JimmyPage
Then you wouldn't be using passwords anyway. That's not the users fault. That's the morons who (supposedly) deliver the service.
Once it's established - against user preference and best practices - that service providers are going to use passwords regardless, then as a user the next best thing is to ensure unique complex passwords for everything as the starting point, and then 2FA (where it's offered, not all service providers bother). And for that, a password manager is the least shit option.
unique complex passwords
Mishak
Where they generally require something so complex that you'll only ever "remember" it if you write it down or use a password manager.
I've had enough of sites that insist you must have 2 digits, upper and lower case, one of a select set of symbols, ...
What's wrong with a passphrase like "it's going to take a long time for a hacker to guess this one"?
Of all the functions that needs to minimise its attack surface password management must surely be at the top of the list. Keep 'em local. No servers.