How does a password manager work? The vault, the master password and everything in between

What is a password manager?

A password manager is software that stores your logins in an encrypted vault, fills them into websites for you, and generates strong passwords so you never have to remember or reuse them.

Instead of memorising dozens of passwords, you remember one: the master password. Everything else sits inside the vault, locked until you unlock it.

Most password managers have the same four parts:

• A vault that holds logins, notes and sometimes authenticator secrets.
• A master password that unlocks the vault.
• An autofill tool, usually a browser extension, that types credentials into login forms.
• Sync, so the same vault is available on every device you use.

Many also offer team sharing, which matters once more than one person needs the same account.

How does a password manager work, step by step?

A password manager turns your master password into an encryption key, uses that key to lock each saved login, and only decrypts a login when you ask for it.

1. You create a master password when you sign up.
2. The app stretches that password into an encryption key using a deliberately slow function, so guessing it is expensive for an attacker.
3. Every login you save is encrypted with that key material before it is stored.
4. You visit a site, the extension recognises the login form and offers the matching account.
5. You click fill (or use a shortcut) and the app decrypts that one item and types it in.
6. When you lock the vault, close the browser or go idle, the decrypted data is dropped from memory.

The important point is that the vault is a locked box. Opening it requires something only you know.

What is the master password and why does it matter so much?

The master password is the single secret that unlocks your vault, so it should be long, unique and never used anywhere else.

NIST SP 800-63B, the US guidance on digital identity, favours length over complexity rules. A passphrase of several unrelated words is easier to remember and harder to guess than a short string full of symbols.

Because everything depends on it, a good master password is:

• Long: a passphrase of four or more random words is a sensible start.
• Unique: not reused on any other account.
• Memorised, not stored in the same place as the vault.

Pair it with two-factor authentication or a trusted-device check where the product offers it. For a deeper look at how this is protected, see zero-knowledge encryption explained.

How does encryption in the browser keep passwords private?

In a zero-knowledge password manager, your passwords are encrypted inside your own browser before anything is sent to the server, so the provider only ever stores unreadable ciphertext.

This design is called zero-knowledge, or client-side encryption. The company running the service cannot read your vault because it never holds the key.

BobWork Vault is built this way. Each item is encrypted with AES-256-GCM, and your master password is stretched with PBKDF2-SHA256 at 600,000 iterations. HKDF then derives two separate values from it: an encryption key and a sign-in proof. The server sees the proof and ciphertext, not the key. More detail is on the security page.

Not every password manager works this way, and designs differ in detail, so check each product's own security documentation before you trust it with business logins.

How does autofill work?

Autofill works through a browser extension that detects login fields on a page, matches the site to a saved login, decrypts that one item and types it in.

Good autofill does more than paste text:

• It checks the site address, so a lookalike phishing page does not get your password.
• It handles two-step sign-ins, where the email comes first and the password on a second page.
• It can fill the six-digit authenticator code after the password, if the manager stores two-factor secrets.
• It offers to save a new login after you sign in, and to generate a strong password on sign-up forms.

In BobWork Vault, a key icon appears in login fields for one-click fill. The shortcut is Ctrl+Shift+F (⌘+Shift+F on Mac), and there is also a right-click menu on login fields. The Chrome extension also works in Edge, Brave and Arc.

How does a password manager sync between devices?

A password manager syncs by uploading the encrypted vault to the provider's servers and downloading it onto each device you sign in on.

Because the data is already encrypted, the server acts only as a storage and delivery point. Your other device decrypts the vault locally once you enter your master password.

Providers usually add a check for new devices. BobWork Vault, for example, asks for an emailed code in addition to the master password when you sign in somewhere new. Convenience features such as Touch ID or Windows Hello can unlock the vault on a trusted device, but the master password is still required periodically.

BobWork Vault runs as a browser extension and a web vault that works in any modern browser. It does not have mobile apps, so plan for that if your team relies on phones.

How does a password manager share passwords with a team?

A team password manager shares a login by giving each chosen teammate their own encrypted access to that item, rather than sending the password in plain text.

Behind the scenes, each item has its own key, and that key is wrapped separately for every person who may open it. In BobWork Vault this uses AES-256-GCM per item with each item key wrapped per teammate using P-256 ECDH.

What teammates can do with a shared item depends on the access level:

You can share a single password or a whole folder. The team sharing page shows the flow, and our guide to setting up a team password manager covers rollout.

Is a password manager safe if it gets hacked?

A well-designed password manager stays safe in a server breach because attackers only get encrypted data, which is useless without each user's master password.

That safety depends on three things: the encryption design, the strength of your master password, and how the provider handles recovery. Be sceptical of any tool that can email you your master password, because that implies someone else can read your vault.

In BobWork Vault, nobody, including BobWork, can recover a forgotten master password by default. Organisations can opt in to admin-assisted recovery, where members enrol. An Emergency Kit is offered at sign-up so you can store the recovery details offline.

The trade-off is real: stronger privacy means you carry more responsibility for your master password.

Password manager vs browser password saving: what is the difference?

A dedicated password manager is built for sharing, access control and auditing, while a browser's built-in saving is designed mainly for one person's convenience.

If you are weighing this up for a business, read whether Chrome's password manager is safe for business. If you decide to switch, importing a CSV takes minutes, and you can turn off Chrome's own autofill so two managers do not compete.

What should you check before choosing a password manager?

Choose a password manager by checking how it encrypts data, how it handles recovery, where it works, and whether it fits the way your team shares logins.

1. Is encryption done on your device, with only ciphertext stored on the server?
2. What happens if you forget the master password?
3. Does it work on every device and browser your team uses?
4. Can you give different people different access levels?
5. Is there an easy way to remove a leaver's access?
6. Can you import your existing passwords from a CSV?
7. What does the plan page say about price and limits?

For a shortlist approach, see our guide to the best free password manager for teams.

What does BobWork Vault do differently?

BobWork Vault is a free password manager for teams that includes team sharing in the free plan, with encryption done in the browser.

It also checks passwords against Have I Been Pwned using k-anonymity, so only the first five characters of a SHA-1 hash leave your browser. A guided offboarding flow removes a leaver's access, hands over what they owned, re-keys shared items and builds a checklist of passwords to change on each site.

It does not have mobile apps, single sign-on or enforced password policies, so check that it fits your setup. If it does, you can create a free account, import your existing passwords and invite your team.

Try BobWork Vault — free for your whole team

BobWork Vault is a free, zero-knowledge password manager for teams, made by BobWork (BobOffice, LLC). Shared folders, login-only access, 2FA codes and guided offboarding, end-to-end encrypted. Add it to Chrome or create a free account.

Keep reading

• What is zero-knowledge encryption in a password manager?
• How to set up a password manager for a small team: a 10-step rollout plan
• The best free password manager for teams in 2026: a fair buyer's guide

More: free team password manager · free company password manager · company password manager · password management software · how to share passwords with teammates · compare password managers