Password Manager Breach Response: What to Do When Your Vault Provider Gets Hacked
Password managers exist to solve one problem: remembering dozens of unique, strong passwords is impossible for a human brain, so you put them all in one encrypted vault instead. That design is sound — but it also means a breach at the password manager company itself is one of the worst-case scenarios in personal cybersecurity. It has already happened to major providers, and when it does, knowing exactly what to do in the first 24 hours matters more than almost anything else you'll read on this site. This isn't a reason to stop using a password manager — the alternative (reusing passwords everywhere) is far riskier. It's a guide for the moment your provider sends that breach notification email. What Actually Gets Exposed in a Vault Breach Reputable password managers use zero-knowledge, end-to-end encryption: the company itself cannot read your stored passwords, because your vault is encrypted and decrypted locally using a key derived from your master password, which the...