How Do Password Managers Work? Encryption Explained Simply

It starts with your master password. When you create your vault, the app runs your master password through a key-derivation function (like Argon2 or PBKDF2) tens or hundreds of thousands of times. The output is an encryption key — and the process is deliberately slow so attackers can't guess passwords quickly.

That key encrypts everything with AES-256 (or XChaCha20 in NordPass's case) — the same standard banks and governments use. Your logins become ciphertext: random-looking data that reveals nothing without the key.

Sync works by uploading only that ciphertext. When you add a password on your phone, the encrypted blob syncs to the company's servers and down to your laptop, which decrypts it locally. At no point does the server see readable passwords — this is zero-knowledge architecture.

Autofill is the everyday magic: the browser extension detects a login form, verifies the domain matches the saved entry (this blocks most phishing), and fills credentials after you unlock with Face ID, fingerprint or PIN.

Passkeys extend this: instead of a password, the manager stores a private cryptographic key and signs you in with biometrics. 1Password, Bitwarden, Proton Pass and most managers here already support them.

If you forget your master password, most zero-knowledge managers cannot recover your vault — that's the price of true privacy. Set up emergency access or a recovery kit on day one (our setup guides walk through it).