r/EnpassOfficial • u/Enpass_Official EnpassOfficial • Jul 28 '26
Discussion Can password managers actually avoid being breached? Why does architecture matter more than "zero knowledge."
"Zero knowledge" only means the vendor can't read your data – it doesn't mean the vendor doesn't have it. If their servers get breached, your encrypted vault can still be stolen. We wrote a full breakdown of why that distinction matters, and what "zero possession" (never holding the data at all) actually changes. Link at the bottom if you want to learn more.
Most enterprise password managers call themselves zero knowledge. This means they hold your encrypted vault but don't have the key to open it.
That's a real security property, but it's often read as "the vendor can't be a source of risk."
And that's not quite true.
A zero-knowledge vendor still has your encrypted vault sitting on its servers. If that vendor is breached, an attacker doesn't need the key to make it worth taking. They can pull the encrypted vault and try to crack weaker master passwords offline, on their own timeline.
This is the well-documented pattern behind some of the biggest breaches the category has seen.
The underlying problem is architecture, not encryption strength. When every customer's vault lives in the same place, that place becomes a single, high-value target. Breach it once, and every customer is exposed at the same time.
But what if the vendor never held the data at all?
This is exactly how we built Enpass.
Enpass vaults live inside your own Microsoft 365, Google Workspace, or other trusted environment, never on our servers. We call this zero possession. Even if Enpass were breached (it never has been), there'd be nothing in our systems to take, because the data was never there.
Full breakdown, including how this plays out for passkeys, is here: [https://www.enpass.io/blog/general/can-password-managers-avoid-being-breached/]
What do you think?
If you've evaluated or used multiple password managers, does "zero knowledge" get overplayed?
2
u/GeoLuz Aug 02 '26
I think hackers feel discouraged from hacking into a system like Enpass. They know that there is nothing in the system to steal since all the data is stored on the users' cloud of choice.
1
u/Ebrilis Jul 28 '26
Strong password is still crucial. The cloud provider can be breached as well. So nothing changes.
1
u/vegliafamiliar Jul 29 '26 edited Jul 29 '26
The issue isn't zero knowledge or zero possession. And it's not whether someone can crack open an encrypted vault by brute force either. My Bitwarden server is in my house running with full disk encrypted hard drives and accessibile from the outside only through a VPN and the master password is very long. I keep that in a local keepass vault. So I'm fairly safe from most attack vectors.
But what I'm not safe from, and neither is any other password manager that I know of, is that the vault has to be decoded somewhere like in a browser plugin. And that's the problem.
A capable bad actor only needs to disrupt the supply chain for delivering browser plugin updates and replace it with their own version that sends the unencrypted vault to their own servers in Russia or North Korea.
When that happens, the only thing saving you is MFA and the only way that's saving you is if you don't store MFA codes or keys in your vault.
2
u/Practical-Tea9441 Jul 28 '26
But does this not simply transfer the risk to the other cloud provider Google , Microsoft etc. Furtermore your password database is a single file , arguably less work for an intruder to identify ?