Password Manager Buying Guide: Vault and Recovery

What the standard actually requires

NIST Special Publication 800-63B is the document most corporate password policies claim to follow, and it uses binding language that a great deal of common practice violates:

• Verifiers “SHALL require passwords that are used as a single-factor authentication mechanism to be a minimum of 15 characters in length” — dropping to eight only when the password is one factor within multi-factor authentication.
• They “SHOULD permit a maximum password length of at least 64 characters.”
• They “SHALL NOT impose other composition rules (e.g., requiring mixtures of different character types).”
• They “SHALL NOT require subscribers to change passwords periodically” — though they “SHALL force a change if there is evidence that the authenticator has been compromised.”
• They “SHALL compare the prospective secret against a blocklist that contains known commonly used, expected, or compromised passwords.”
• They “SHALL NOT permit the subscriber to store a hint” and “SHALL NOT prompt subscribers to use knowledge-based authentication.”

Read together, that is a complete reversal of the ninety-day-rotation, one-capital-one-symbol regime most people were trained on. Length and uniqueness carry the weight; churn and character classes do not. A password manager buying guide should therefore judge tools on how well they generate long unique secrets and check them against breach data — not on how many complexity rules they can enforce.

One more line from the standard sets the ceiling on the whole category: “Passwords are not phishing-resistant.” However good your manager is, a password typed into a convincing fake site is compromised. That is an argument for autofill that matches on domain, and for passkeys. Both belong in a password manager buying guide ahead of any feature comparison.

Zero-knowledge, and how to check it

The security claim that matters is that the provider cannot read your vault: encryption and decryption happen on your device, and the provider stores only ciphertext. Every serious product claims this. The question is what evidence supports it.

Look for three things. A published, current third-party security audit naming the scope and the auditor. A documented cryptographic design — which key derivation function, which parameters, how the vault key is wrapped. And a track record of disclosing incidents promptly with specifics, because every long-lived provider has had something happen and the disclosure quality tells you more than the absence of incidents does.

Recovery is the hard part

Zero-knowledge encryption has an unavoidable consequence: if the provider cannot read your vault, the provider cannot restore it either. Losing your master credential can mean losing everything, permanently.

So evaluate the recovery path as carefully as the encryption. The mechanisms in use are a printed recovery key or kit, a designated emergency contact with a time-delayed release, biometric unlock on an already-authenticated device, and organization-level recovery for business plans. Each has a different failure mode, and a provider that offers no recovery path at all is offering you a single point of catastrophic failure. A password manager buying guide should weight that as heavily as the encryption claim itself.

Whatever the mechanism, set it up on day one and store the artifact offline — a printed key in a safe beats any digital copy, because the digital copy tends to end up in the vault it is meant to recover.

Passkeys and where they fit

Passkeys replace a shared secret with a key pair, so there is nothing typeable to phish. They are the strongest routine option available and most good managers now store them alongside passwords.

Two caveats worth knowing. NIST notes that syncable authenticators — passkeys that follow you across devices — “SHALL NOT be used at AAL3,” the highest assurance level, precisely because the keys are exportable. And adoption is incomplete, so you will run a mixed estate of passkeys and passwords for years. Choose a manager that handles both well rather than one that treats passkeys as a checkbox.

Features that matter

• Breach monitoring against known compromised credential sets — this operationalizes NIST’s blocklist requirement for you.
• Domain-matched autofill, which refuses to fill on a lookalike domain and quietly defeats most phishing.
• Export in a standard format. If you cannot leave, you are not a customer, you are a hostage.
• Genuine multi-platform clients covering every device you actually use, including the browser you actually use.
• Secure sharing if you have a household or a team, with per-item control rather than shared logins.
• Offline access to a local cached copy when the service or your connection is down.

What to ignore

Password strength meters on generated secrets. A 20-character random string is strong; the colored bar adds nothing.

Enforced complexity rules. The standard forbids imposing them, and they push people toward predictable substitutions.

Bundled extras — VPNs, storage, monitoring dashboards. Judge the vault, then decide separately whether the extras are worth anything to you.

“Military-grade encryption.” This phrase means AES and appears on every product in the category. It distinguishes nothing.

The checklist

• Confirm a recent third-party audit and read its scope.
• Set up the recovery mechanism on day one and store it offline, on paper.
• Verify export works before you migrate everything in.
• Turn on breach monitoring and act on what it reports.
• Adopt passkeys where offered, since passwords are not phishing-resistant.
• Stop rotating passwords on a schedule — rotate on evidence of compromise, as the standard says.

Follow that and this password manager buying guide reduces to two questions that actually differentiate products: can anyone but you read the vault, and can you get back in if you lose the key. Everything else in the category is marketing built on top of those two answers.