New research from ETH Zurich has found serious security flaws in popular password managers, raising fresh questions about how safely your passwords are stored online.
Why Passwords Are So Hard to Manage Today
Most of us now have dozens of online accounts for banking, shopping, social media and work. Each website wants a unique password with a mix of upper and lower case letters, numbers and special characters. On top of that, many services ask you to change these passwords every few months. It is not surprising that people reuse the same passwords, write them down or forget them completely.
To solve this problem, password managers are marketed as a simple, one‑stop solution. They store all your login details in a secure, encrypted vault that you can unlock with one master password. In theory this sounds ideal, especially for busy users and companies that manage many employee accounts. But new research suggests that the level of protection is not always what it seems.
What the ETH Zurich Researchers Discovered
Researchers at the Federal Institute of Technology (ETH) Zurich, working with colleagues from Università della Svizzera italiana in Lugano, tested three popular password manager platforms. Their goal was to check whether the services really delivered the strong security that they promise.
The team discovered serious security vulnerabilities. In some cases, they were able to view passwords stored in the vault. In other cases, they could even make changes to saved login credentials. Some systems still relied on cryptographic methods that date back to the 1990s, which makes them far easier to attack with today’s tools and computing power.
According to ETH researcher Matteo Scarlata, these attacks do not require supercomputers or massive servers. Relatively small programs that can impersonate a server may be enough to trick the password manager and open the door to an attacker.
How Weaknesses in Password Managers Put You at Risk
Password managers store a very large amount of sensitive information in one place, which makes them attractive targets for experienced hackers. If someone can break into the servers behind a password manager, they may be able to launch attacks from there, read stored passwords or insert their own data.
Professor Kenneth Paterson from ETH Zurich points out that thousands of companies, as well as individual users, rely on these systems. This means a single weakness can affect many organisations at once. The researchers informed the providers of the problems and gave them 90 days to fix the issues before publishing their results. While most providers were cooperative, not all of them moved quickly, partly because major changes can risk cutting customers off from their stored passwords if the update process goes wrong.
How You Can Better Protect Your Online Accounts
The research does not mean you must immediately stop using password managers, but it is a reminder to use them carefully. First, make sure your password manager app is updated to the latest version, as many security fixes are delivered through updates. Second, protect your vault with a strong, unique master password that you do not reuse anywhere else.
You should also enable two‑factor authentication (2FA) wherever possible, both on your password manager and on key services like email, banking and social media. This adds an extra layer of security, so even if someone learns your password, they still need a code from your phone or another device.
Finally, choose password managers that clearly explain their security design, use modern encryption and have a good track record of fixing problems when they are found. Digital security is never perfect, but informed choices and good habits can greatly reduce the chance that your passwords fall into the wrong hands.
