What happens if your password manager shuts down?

You trust your password manager with the keys to everything. So here’s an uncomfortable question worth asking before you have to: what happens to your access if the company behind it disappears?

It comes down to one thing: whether your passwords live somewhere only that company can decrypt. With a cloud vault, a shutdown can mean a frantic export before the servers go dark, and hoping the format imports elsewhere. With a deterministic tool built on a documented standard, you’re insulated: the math outlives the company.

Why this isn’t paranoia

Software is mortal. Products get acquired and quietly retired, pricing and terms change overnight, and even healthy companies have outages. Your data’s fate isn’t always in your hands: the 2022 LastPass breach, later tied to nine-figure crypto theft, is a reminder that an encrypted vault sitting on someone else’s servers can outlive your control of it. Continuity planning for your credentials is just basic hygiene.

The lock-in spectrum

Not all managers expose you equally:

• Cloud vault. Most vendor-dependent. If it shuts down, you need a working export and a destination that accepts it.
• Local vault file you hold. Safer: the data is already on your hardware, though you own the backups and the syncing.
• Deterministic, built on a documented standard. The least lock-in of all, because there’s no stored vault to rescue and the method is public cryptography.

Why MoolKey can’t trap you

MoolKey’s continuity story is structural, not a promise. Passwords are produced by a documented function: PBKDF2-SHA256 over your master key and a few public inputs (the app name, your masked identifier, a version, a length). That algorithm doesn’t belong to us; it’s standard cryptography available in every browser.

A tool you can fully reconstruct from public math is a tool no company can take away from you. If MoolKey vanished tomorrow, you could still recompute every password by hand or with an independent implementation, as long as you know your inputs and your master key. PBKDF2-SHA256 is available in every browser, every major language, and several command-line tools, none of which we control.

The honest flip side

That durability has a condition, and we won’t hide it: it rests on you remembering your Master Key and knowing your account inputs (or keeping your non-secret list of account names). There’s no recovery if the Master Key is lost: avoiding a stored generated-credential list reduces the value of a backend breach, but it makes you the sole keeper of the one secret that matters.

A practical continuity checklist

Whatever you use today, do these:

1. Know your master key cold: it’s the root of your access in any deterministic system.
2. Keep a copy of your account list. In MoolKey it’s non-secret, so a backup costs you nothing.
3. Prefer tools built on documented, standard cryptography whose output you could reproduce without the vendor.
4. For any vaulted tool, export a backup periodically, and delete stale exports once restored.

In short

• If a manager shuts down, your access hinges on who can decrypt your passwords.
• Proprietary cloud vaults carry the most vendor risk.
• MoolKey derives from public, standard math, so there is no switch for anyone to flip off.
• The catch: no recovery, durability depends on your master key.

Frequently asked questions

What happens to my passwords if the company shuts down? With a stored vault, you risk losing access unless you exported in time and can import elsewhere. With a deterministic tool, you keep access regardless, because you can recompute passwords from the public algorithm without any server.

Can I still use MoolKey if the company disappears? Yes. Passwords are derived from a documented, standard function, so with your master key and account inputs you can regenerate them independently, even with a third-party implementation. Nothing depends on our servers staying online.

How do I avoid password manager lock-in? Favor tools built on documented standards whose behaviour you could reproduce independently, and always keep a current export of any vaulted manager. The less your access depends on one company’s servers, the safer you are.

Is a documented algorithm enough on its own? For continuity, yes, it’s the property that matters. If the function and your inputs are both known, you can reconstruct your passwords from math alone, with no server, no vault, and no app required.

Want access that doesn’t depend on us being around? See how the deterministic model works, then get started.