What we found
LastPass Password Manager: FClaimed 'zero-knowledge' encryption. Hackers stole 25.6 million vaults. URLs, email addresses, and company names were stored unencrypted. $438 million stolen from cracked vaults.
UK ICO fined LastPass GBP 1,228,283 for UK GDPR violations. The breach affected over 1 million UK data subjects. LastPass's own MFA database was also compromised, including authenticator seeds and phone numbers used for two-factor authentication.
Dashlane Password Manager: FDashlane knows your email, IP address, which devices you use, when you log in, and how you use the app.
Dashlane collects: email address, IP address, billing information, device identifiers, usage analytics, and support message records. Their privacy policy states they can 'disclose personal data if it believes it is necessary to protect its rights.' Zero-knowledge applies only to vault contents, not the substantial metadata collected around it.
Apple Passwords (iCloud Keychain): FWithout Advanced Data Protection enabled (which most people haven't), Apple holds the keys to your passwords.
iCloud Keychain syncs passwords via iCloud. Without Advanced Data Protection (ADP) enabled, iCloud backups — which contain Keychain data — are encrypted with keys Apple holds. Apple can and does provide this data to law enforcement. In H1 2024, Apple received 12,812 US account data requests and complied with the majority.
1Password: F1Password records every time you unlock your vault, create an item, or complete onboarding.
1Password added telemetry in 2023 that collects usage data including unlock events, item creation, onboarding completion, device type, and account metadata. For business accounts, telemetry is ON by default and individual employees cannot opt out — only account owners can disable it.
Google Password Manager: DGoogle can read your passwords.
By default, Google Password Manager uses server-side encryption where Google holds the encryption keys. This means Google can technically read your passwords. 'On-device encryption' is available but opt-in and buried in settings. Most of the 3+ billion Chrome users are on the default setting where Google has access.
Bitwarden Password Manager: DMost users never change defaults.
Argon2id is available but not the default — users must manually switch in settings. PBKDF2 is GPU-friendly and significantly weaker against hardware-accelerated attacks compared to Argon2id which is memory-hard. Most users will never change the default.
NordPass Password Manager: DNordVPN has been caught making exaggerated security claims in marketing.
NordPass is owned by Nord Security, which also operates NordVPN — a company with a history of aggressive affiliate marketing and occasionally misleading security claims. While the crypto is strong and Panama jurisdiction is favorable, the parent company's marketing-driven culture raises trust questions for a security product.