# What is a deterministic password manager?

> A password manager that recomputes each password on demand from a master key and site name instead of storing it.

Last reviewed: 2026-09-01

## Deterministic password manager

Category: Passwords

Also called: stateless password manager, vault-free password manager

Canonical page: https://moolkey.com/glossary/deterministic-password-manager

A deterministic password manager recreates each password by calculation rather than retrieving it from storage. The same Master Key plus the same site name always produces the same password, so a stored list of generated credentials is not required. Hosted products may still keep non-secret account metadata.

### How it differs from a vaulted manager

A vaulted manager encrypts your passwords and syncs the encrypted blob between devices. A deterministic manager does not store generated passwords, though a hosted product may keep non-secret metadata such as the site name and a version number. A breach of a vaulted manager exposes an encrypted vault; a breach of a deterministic one can expose account metadata instead of a stored credential list.

### The honest trade-offs

Changing a password requires a version counter, since the calculation would otherwise always produce the same result. Importing existing passwords is impossible because they were not generated by the formula. A forgotten master key is unrecoverable because there is no encrypted copy to fall back on.

Further reading: [How deterministic password management works](https://moolkey.com/how-moolkey-works)

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.