A password manager stores credentials on a company's servers while being unable to read them. The arrangement rests on where the encryption key lives.
The master password never leaves the device
The user's master password is not sent to the service. Instead the application derives an encryption key from it locally, on the device.
Everything in the vault is encrypted with that key before any data is transmitted. The server receives ciphertext and stores it without ever holding the key.
This is what makes the arrangement work: a server operator who copied the entire database would hold encrypted blobs and no means of opening them.
Key derivation is deliberately slow
Turning a password into a key uses a function designed to be computationally expensive, repeated many times over.
The delay is imperceptible when a legitimate user unlocks a vault once. It becomes prohibitive for an attacker trying millions of candidate passwords against a stolen file.
A random value unique to each account is mixed in, so identical master passwords across different users produce entirely different keys.
Authentication is separate from decryption
Logging in and decrypting are different operations. The service verifies identity using a value derived differently from the one used for encryption.
Separating them means proving who you are does not hand the server anything capable of decrypting a vault.
It also means a second factor protects account access without becoming part of the encryption itself, which is why losing the second factor does not destroy the data.
The trade-off is unrecoverable loss
Because the provider cannot decrypt the vault, it also cannot reset a forgotten master password. There is no recovery path through customer support.
Services mitigate this with emergency access arrangements or recovery codes generated in advance, but these must be set up before they are needed.
The impossibility of recovery is not a gap in the design. It is the direct consequence of the property that makes the design worth using.
The browser extension is the soft edge
Most of the practical risk sits not in the encryption but in the interface, where an unlocked vault fills credentials into web pages automatically.
Extensions match sites by address to avoid filling a credential into a lookalike domain, which is a meaningful defence against imitation login pages.
Auto-lock timers exist for the same reason: an unlocked vault on an unattended machine bypasses every cryptographic protection underneath it.