What is a deterministic password manager?
A deterministic password manager recreates each password by calculation rather than retrieving it from storage. The same Master Key plus the same site name always produces the same password, so a stored list of generated credentials is not required. Hosted products may still keep non-secret account metadata.
- Topic
- Passwords
- Also called
- stateless password manager, vault-free password manager
- Reading time
- 1 min
- Reviewed
On this page
How it differs from a vaulted manager
A vaulted manager encrypts your passwords and syncs the encrypted blob between devices. A deterministic manager does not store generated passwords, though a hosted product may keep non-secret metadata such as the site name and a version number. A breach of a vaulted manager exposes an encrypted vault; a breach of a deterministic one can expose account metadata instead of a stored credential list.
The honest trade-offs
Changing a password requires a version counter, since the calculation would otherwise always produce the same result. Importing existing passwords is impossible because they were not generated by the formula. A forgotten master key is unrecoverable because there is no encrypted copy to fall back on.
Sources
These primary references support the terminology and current security guidance used in this definition.
