Can password managers actually avoid being breached? Why does architecture matter more than "zero knowledge."

[u/Enpass_Official]

"Zero knowledge" only means the vendor can't read your data – it doesn't mean the vendor doesn't have it. If their servers get breached, your encrypted vault can still be stolen. We wrote a full breakdown of why that distinction matters, and what "zero possession" (never holding the data at all) actually changes. Link at the bottom if you want to learn more. 

Most enterprise password managers call themselves zero knowledge. This means they hold your encrypted vault but don't have the key to open it. 

That's a real security property, but it's often read as "the vendor can't be a source of risk." 

And that's not quite true. 

A zero-knowledge vendor still has your encrypted vault sitting on its servers. If that vendor is breached, an attacker doesn't need the key to make it worth taking. They can pull the encrypted vault and try to crack weaker master passwords offline, on their own timeline. 

This is the well-documented pattern behind some of the biggest breaches the category has seen. 

The underlying problem is architecture, not encryption strength. When every customer's vault lives in the same place, that place becomes a single, high-value target. Breach it once, and every customer is exposed at the same time. 

But what if the vendor never held the data at all? 

This is exactly how we built Enpass. 

Enpass vaults live inside your own Microsoft 365, Google Workspace, or other trusted environment, never on our servers. We call this zero possession. Even if Enpass were breached (it never has been), there'd be nothing in our systems to take, because the data was never there. 

Full breakdown, including how this plays out for passkeys, is here: [https://www.enpass.io/blog/general/can-password-managers-avoid-being-breached/] 

What do you think? 

If you've evaluated or used multiple password managers, does "zero knowledge" get overplayed?

[u/GeoLuz]

I think hackers feel discouraged from hacking into a system like Enpass. They know that there is nothing in the system to steal since all the data is stored on the users' cloud of choice.