How do password managers work?

May 25, 2022

Passwords should be long and unguessable. You should choose a unique password for each website but never reuse them. Because nobody can remember all of them, everyone should use a password manager.

But how do password managers protect our passwords?

The solid foundation

From Wikipedia,

In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can decipher a ciphertext back to plaintext and access the original information.

You might ask, who are the “only authorized parties“? We will answer this question later.

Here is a simple diagram for encryption and decryption

To make it easier to grasp the essence, we omit algorithm parameters such as salt, initial vector, authentication tag, etc. In computer programs it is very complex.

Now we can answer the question above. Those who hold the encryption key are the only authorized parties. Cryptography is very solid and empowers password managers. Most password managers use the AES-256 algorithm, a symmetric-key algorithm.

If a hacker tries to break a password manager, he/she will not attempt to crack the AES-256 algorithm but steal the encryption key. A good password manager’s vital role is to protect the encryption key(Unfortunately, not all password managers do it well).

Password managers

A well-designed password manager must use cryptographic algorithms to encrypt our passwords. Before utilizing the encryption process above, most password managers ask users to set a master password. Since master passwords are not strong enough for cryptography, password managers need to stretch the master password into an encryption key with PBKDF2 or other crypto algorithms. That is, deriving a cryptographic key from the master password. Then the password manager encrypts the password and additional information with the encryption key, usually using the AES algorithm, the military-grade encryption.

Nowadays, military-grade encryption is more than a marketing word because any piece of software can use the AES-256 algorithm.

Here is a diagram showing how password managers encrypt our passwords.

To view the saved passwords in password managers, the user must enter the master password to unlock the vault.

Password managers should only save the encrypted ciphertext on storage, and must never store the master password, in any form. By doing so, password managers make sure only the user holds the encryption key because it is derived from the master password entered by the user, nowhere else.

From research conducted by TeamSIK, we conclude there are some common mistakes made by password manager developers.

  • Use homemade encryption algorithms. Homemade crypto algorithms are almost always weak.

  • Store encryption key in application code. That means any user’s encrypted vault can be decrypted by the app.

  • Store master password on storage to help do authentication.

Storage

Password managers write the encrypted data into files on the local storage device.

Many other programs can access the encrypted vault on desktop computers. But on iOS, password managers put the encrypted database in their private sandboxed storage, which is not accessible by other apps. On Android, apps can choose between private storage and external storage. The external storage is accessible by many other apps, like desktop computers.

Obviously, sandboxed storage is much safer than public storage.

Cloud-based password managers send the encrypted data to the cloud as well as store it locally.

Recent Posts