How Password Managers Work

A lot goes on behind the scenes in a password manager. Here’s what happens and why it is a good idea to use them.

- Kenny Yeo

FIRST, HOW PASSWORDS ACTUALLY WORK

Most people think that when they are trying to log into their account on a website, the website simply compares the password they have input with the password that they have stored in their database. So if your password is “password123,” it is stored as such in the database and the website simply checks if you have entered “password123” against their database when you are trying to log in. This is what is known as storing passwords in plain text and it is a lazy and horrible security practice that, hopefully, no website practices today.

Instead, most decent websites store what is known as a salted hash of a password and not the actual password itself. A hash is a one-way function that is applied to the password to scramble it. This way, if the website is hacked, the hacker only gets his hands on the hash of a password and not the actual password itself.

To make things even more secure, random data is typically added to the password before it is hashed. This random data is known as a salt and is usually appended and assigned to a user’s password during account creation. The resultant hashed value is known as the salted hash. So the next time a user logs in, the website takes the password and looks for the salt associated with the account and checks if the resultant hashed value matches the salted hash that it has in its database.