Talk:Password manager

comment

The purpose for starting this article is to seperate password managers from password generators and form fillers, which are often confused as one in the same software. The fact is that these are different software and may exist on their own without having the other two functionalities. Some software like Roboform has all three. — Preceding unsigned comment added by ProfessorBaltasar (talk • contribs) 16:12, 11 April 2006 (UTC)

@ProfessorBaltasar

Nowhere do I see a password manager that I have used for well over a decade, and as far as I know have never been hacked! is there some reason that you don't identify Keeper? is there a reason why they are not listed? should I worry about using them? Chicago Chilibob (talk) 22:22, 13 May 2024 (UTC)

Comparison

We need a page comparing password managers password generators and form fillers. Mathiastck 23:05, 7 January 2007 (UTC)

Might be useful to mention USB-based password management products (IronKey www.ironkey.com, ID Guard www.identityguard.com/#slide6) and standalone password management devices (Atek Logio Secure Password Organizer www.atek.com/logio-secure-password-organizer.html and Mandylion Labs www.mandylionlabs.com).205.214.237.254 (talk) 17:59, 10 July 2009 (UTC)

Bitwarden is missing, someone should add info for this one: https://bitwarden.com/ — Preceding unsigned comment added by Eclectic99 (talk • contribs) 16:39, 29 September 2017 (UTC)

e–Business translation

This is a new term to mean the facilitation of the transformation of an existing business or business idea to the Internet. It involves the use of business systems analysis and other software and tools to map the business structure to the Internet. —Preceding unsigned comment added by Raphaelval7 (talk • contribs) 10:38, 8 March 2010 (UTC)

Clarification?

Article says:

"Some password managers include a password generator. Generated passwords may be guessable if the password
manager uses a weak random number generator instead of a cryptographically secure one."

You can create millions and millions different passwords even with weak random number generator. And if you don't know previously generated (with same seed) passwords, this "weakness" doesn't help in any way to crack in. Is this really a problem or just theoretical speculation? In other words, is there even one example of so badly made password generator that you can guess it's output? 62.134.199.5 (talk) 09:31, 26 May 2011 (UTC)

Flag as advertisement?

"OhMyPass is an Online Enterprise Password Manager that securely stores login details. It is a web-based version of more conventional desktop-based password manager. But also it has a Portable Application for Desktop Password Management: Omp2Go. With this Portable Application for Desktop version you can take your online stored accounts everywhere. Get your passwords or register new account on your desktop." — Preceding unsigned comment added by Treppo (talk • contribs) 09:45, 28 February 2012 (UTC)

Saving to Hard Disk

The article mentions (correctly) that saving unencrypted data to disk is dangerous, but then says "Turning off swap can prevent this risk"

I don't think it can. Modern desktops can hibernate, where they save their state to disk, or suspend to RAM where it may also be backed by disk. In these situations, unless the password manager receives notifications of the pending events, it wont even get the opportunity to erase its memory structures. And, if you look at the windows documentation of WM_POWERBROADCAST, it implies that there are no guarantees that a registered application will be told of an impending power change (emergency power options can trigger a suspend/hibernate without notification).

There's a simple test: suspend and resume the laptop -if you are reprompted for your password then the password manager may have erased it (or it is reacting on wakeup). Then repeate for hibernate.

Now: who is going to write that up in a way that doesn't constitute original research. — Preceding unsigned comment added by SteveLoughran (talk • contribs) 20:40, 22 April 2015 (UTC)

Definition?

"Password managers offer greater security and convenience for the use of passwords to access online services." Many things probably do that. Should not the first sentence define exactly what a password manager is? Is it software, an online service, something else entirely, or a combination of these?

Also, the phrasing is odd. "Password managers offer greater security and convenience" than what? A comparative must have a listed alternative; you can't say, "That's a bigger volcano," when you hadn't been talking about any other volcano before. This sounds more like marketing lingo than an encyclopedia.

208.124.64.14 (talk) 00:32, 26 April 2020 (UTC)

History

I'm the author of PassKeeper, a password manager for Windows 3.1 and Windows 95 which predates Bruce Schneier's Password Safe by a couple years. I published the first version around December 1995. The New York Times even wrote an article mentioning it in August 1996.

I'm not sure if PassKeeper was truly the first password manager, but I haven't heard of another (I actually came here wondering if there was something that predated it).

Anyway, I'm not sure what the etiquette is for updating this entry. It feels wrong to add it myself. Bdgreenlee (talk) 15:28, 15 May 2024 (UTC)

Clarification needed

"While password managers offer robust security for credentials, their effectiveness hinges on the user's device security. If a device is compromised by malware like Raccoon, which excels at stealing data [...]"

Is there a reason we directly name&shame Raccoon here? My surface level research on this group leads me to believe it was simply another run-of-the-mill MAaS group that popped up during the peak of Covid. Why not just mention infostealers in general and link to the article about them? --nora // 🌠 // meow at me 09:49, 1 December 2024 (UTC)

POV

The "Vulnerabilities" section is basically a Wikipedia:Criticism section, and it's weighted against password managers even though there is significant secondary coverage about benefits and strengths. Just some sources in case anyone feels like working on this:

• Alsharaya, Hussein (2025-09-30). "Password managers: a critical review of security, usability, and innovative designs". Journal of Computer Sciences Institute. 36: 328–335. doi:10.35784/jcsi.7725. ISSN 2544-0764.
• Gasti, Paolo; Rasmussen, Kasper B. (2012). Foresti, Sara; Yung, Moti; Martinelli, Fabio (eds.). "On the Security of Password Manager Database Formats". Computer Security – ESORICS 2012. Berlin, Heidelberg: Springer: 770–787. doi:10.1007/978-3-642-33167-1_44. ISBN 978-3-642-33167-1.{{cite journal}}: CS1 maint: periodical has ISBN (link)
• Glaser, April (2016-01-24). "You Need a Password Manager. Here Are Some Good Free Ones". Wired. ISSN 1059-1028. Retrieved 2026-06-29.
• Newman, Lily Hay (2018-01-03). "Get a Password Manager. No More Excuses". Wired. ISSN 1059-1028. Retrieved 2026-06-29.
• Key, Kim (2026-02-26). "Protect Your Accounts Instantly With This One Simple Password Tool". PCMAG. Retrieved 2026-06-29.

Dreamyshade (talk) 00:43, 29 June 2026 (UTC)

The following discussion is closed. Please do not modify it. Subsequent comments should be made on the appropriate discussion page. No further edits should be made to this discussion.

---

This review is transcluded from Talk:Password manager/GA1. The edit link for this section can be used to add comments to the review.

Nominator: AdaCiccone (talk · contribs) 02:20, 17 September 2026 (UTC)

Reviewer: H2so4aq (talk · contribs) 20:22, 10 October 2026 (UTC)

This review is part of my pledge for the review at Talk:SEFOR/GA1. H2so4aq (talk) 20:22, 10 October 2026 (UTC)

Hope to finish the review this week.

Hey thanks for taking this. Just FYI, I plan to bring this to FAC in the future, so I really hope for a high-quality review from you. AdaCiccone (talk) 02:07, 11 October 2026 (UTC)

Okay, I've done them all, please check again @H2so4aq, thank you. AdaCiccone (talk) 08:06, 16 October 2026 (UTC)

GA review (see here for what the criteria are, and here for what they are not)

1. It is reasonably well written.

   a (prose, spelling, grammar, and understandability): b (MoS for lead, layout, word choice, fiction, lists, and tables):

   Fully compliant with the specified MOS sections. Wording is sometimes unclear or could be improved.

• Change "Cloud-based services" to "Cloud-based password managers" in Operation and features  Done
• PassKeeper was available by March 1996.: Move establishing context here: Something like "PassKeeper, a Windows-based utility, was available by March 1996. It allowed users to organize credentials and notes in an encrypted file." flows better. (Make sure to keep source-text attribution)  Done
• Cloud storage, sharing, and recovery: The description of the 2024 study is too vague to be useful to the reader without some establishing context. A single sentence at the beginning of the paragraph, like "Cloud-based services are also vulnerable to injection attacks involving items shared between accounts." would suffice.

 Done, but I wouldn't want to say Cloud-based services are also vulnerable to injection attacks... because that's broader than the source. The study is about weaknesses in particular password-manager designs and features, not cloud storage itself. It even includes one password manager that doesn't rely on cloud, the KeepassXC. Also, injection attacks involving items shared between accounts doesn't say why sharing creates an opportunity for an attack. For that, I changed the wording so that what the attack is about is made clearer.

• Usability and human factors: ...involves choices about trust, handling master password, password generation, and synchronization. It's not clear what this sentence is referring to, please clarify/rewrite.  Done
• To the extent of my knowledge, NIST guidance isn't binding or a certification, so requires seems out-of-place. Replace with "instructs" or "encourages". Push back if you think I'm wrong here.

 Done, but I think "requires" is okay because the source says: Verifiers SHALL allow the use of password managers and autofill functionality. It says that "SHALL" means a requirement that must be followed to conform to the publication, and no deviation is permitted. I changed it to "must allow" and made the scope of the requirement clearer.

• Optional changes to increase readability:
  • Link payment card in the lead  Done
  • Insert "For example," in front of Bitwarden in Deployment models  Done
  • Link autofill in Operation and features  Done
  • Link hashing in Vault protection  Done
  • Consider moving Relationship to passkeys to a subheading under Operation and features. It seems to make more sense there, as passkeys are sometimes a feature of PMs.  Done
  • Fix WP:SOB issues:
    • login credentials in Operation and features  Done

1. It is factually accurate and verifiable, as shown by a source spot-check.

   a (reference section): b (inline citations to reliable sources): c (OR): d (copyvio and plagiarism):

   Exhaustive reference list, with shortened footnotes and page numbers. Most sources are conference papers from cybersecurity researchers. All material is cited by the end of the paragraph. Source spot-check of ~50% of sources shows excellent agreement. Earwig shows no copyvio and none was seen during spot-check.

• Deployment models: The Google citation (12 as of writing) links to a Gemini help page. I recommend replacing with a more reliable and stable source.

 Done, replaced the source. Now it's the developer page.

• Relationship to passkeys: The FIDO Alliance citation only very briefly mentions password managers in the FAQ. A better source should be used here.

 Done, replaced the source with independent, secondary sources instead of a primary one.

• (Suggestion): You could consider a separate level-3 heading for "Footnotes", so that there are separate "Footnotes" and "Sources" sections. It's entirely up to you though, and is not needed for either GA or FA.

 Done, reorganised.

• Using password managers is not consistently associated with stronger passwords or less reuse.^[56] seems to conflict with Use of password managers is associated with stronger password choices, particularly when a password generator is included.^[29] from earlier. If you mean to suggest that they don't intrinsically lead to such outcomes, and are dependent on how passwords are created, stored, and entered, then clarify. Otherwise remove the sentence.

 Done, reworded. I made password generation as the important factor here.

1. It is broad in its coverage.

   a (major aspects): b (focused):

   Article covers the major aspects of password managers (description, features, security, usability, history). Sections do not run too long relative to their importance.

2. It follows the neutral point of view policy.

   Fair representation without bias:

   One minor wording issue, otherwise is a clean and neutral article.

• protected it with Blowfish encryption sounds promotional. "..., encrypted using the Blowfish algorithm, ..." is better.  Done

1. It is stable.

   No edit wars, etc.:

   No edit wars or repeated vandalism. One large WP:GF edit was reverted recently, but this isn't a problem.

2. It is illustrated by images and other media, where possible and appropriate.

   a (images are tagged and non-free content have non-free use rationales): b (appropriate use with suitable captions and alt text):

   Lead image is appropriate and serves to illustrate an example password manager interface. Image is properly tagged with a license, de minimis warning, and author information.

• The caption needs to be more succinct. Something like, "The vault interface for Bitwarden, showing a saved login entry" would be more appropriate.

 Done, simplified.

• Add appropriate alt text (some GA reviewers ignore this, but you will need to anyway for FA)

 Done, |alt= added.

1. Overall:

   Pass/Fail:

   @AdaCiccone: Excellent job on this article, it is well-researched and describes its topic well. Your references are well-formatted and consistent, and the page numbers made them easy to verify. There are several minor issues remaining; once you fix these I'll pass the article. Since you indicated you would bring this to FAC, I looked through WP:FACR during the review. Here are some thoughts:

   No issues with references, and the page numbers will make verification easier during the FAR. Most cited information is to research/conference papers, which are WP:PRIMARY. You did a good job keeping novel information from these studies attributed properly. The biggest issue with the article right now is a lack of WP:SECONDARY sources. Featured Articles need to be comprehensive, and represent a proper survey of available literature. Use secondary sources like books or review articles discussing the state of password managers. The FA version shouldn't need to rely on single research studies for topics like adoption and useability, and will instead use review papers or books to outline the state of password managers and their use. Same goes with History as well.

   All this is doable; best of luck when you decide to submit it!. H2so4aq (talk) 22:13, 16 October 2026 (UTC)

   @H2so4aq Thanks a lot for the FA suggestions. I'll look into them later. Anyway, I've done all of the review points from your final batch, please take a look again, thank you. AdaCiccone (talk) 10:34, 19 October 2026 (UTC)

   @AdaCiccone: Everything looks good to me, enjoy your new GA! H2so4aq (talk) 15:14, 19 October 2026 (UTC)

   Thank you! AdaCiccone (talk) 02:15, 20 October 2026 (UTC)

Security in memory

AdaCiccone, I see you're doing a lot of work on this article (and glancing back at the history... wow). A passing thought from skimming it (though this may be too into the weeds or technical, I'll leave that to your judgement): is it worth mentioning security in RAM as part of the threat model? E.g. , as examples from a cursory search (I'm sure I've heard stuff about using TPMs and similar as well). Just thought I would mention it, good work on the article. LittlePuppers (talk) 21:06, 15 October 2026 (UTC)

Okay, I'll take a look. AdaCiccone (talk) 07:01, 16 October 2026 (UTC)