Password vault

The vault is the encrypted container ✕ A container packages an application with everything it needs to run — code, libraries, dependencies — in an isolated bundle, so it behaves the same in any environment. More in the glossary → in which a password manager keeps all your login data, and often secure notes, cards and documents too. Its entire contents are encrypted, usually with AES-256 ✕ AES-256 is a globally recognized encryption standard considered practically unbreakable. VPNs, password managers, and cloud services use it to protect your data. More in the glossary → , and only decrypted on your device after you enter the master password ✕ The master password is the one password that unlocks your password manager. It protects all the others — and must never be lost. More in the glossary → . In serious services the zero-knowledge ✕ Zero-knowledge means a provider has no access to your data or keys — only you can decrypt them. Even the provider "knows nothing." More in the glossary → principle applies: not even the provider can read your vault, because the key never leaves your hands. That is why the master password is so critical: it is the only key, and if it is lost, no one can recover it. Many vaults sync in encrypted form across devices so they are always at hand. How each manager protects the vault is covered in the best password managers comparison.