# What is a password vault?

> The encrypted file or database in which a traditional password manager stores your saved credentials.

Last reviewed: 2026-09-01

## Password vault

Category: Passwords

Also called: encrypted vault, password database

Canonical page: https://moolkey.com/glossary/password-vault

A password vault is the encrypted container holding the credentials a traditional password manager has saved. It is decrypted locally with a key derived from your master password, then synced between devices in encrypted form. The vault makes autofill and recovery possible. It also makes the provider a target.

### Why a vault is a concentration of risk

A vault is valuable enough to attack patiently. When the encrypted vaults themselves leak, as happened in the 2022 LastPass incident, the attacker gets unlimited offline attempts against every vault. The strength of your master password and the iteration count in use at the time become the remaining barriers.

### What a vault buys you in return

Autofill, secure notes, credit cards, TOTP codes, sharing, and account recovery all depend on there being something stored. These are real benefits, and for many people they outweigh the concentration risk. The choice is a genuine trade-off, not a right answer.

Further reading: [Vaulted versus deterministic](https://moolkey.com/compare)

### Sources

- [OWASP: Password Storage Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Password_Storage_Cheat_Sheet.html): Practical guidance for salts, peppers, PBKDF2, Argon2id, and password hashes.
- [NIST: SP 800-63B-4: Authentication and authenticator management](https://csrc.nist.gov/pubs/sp/800/63/b/4/final): Current requirements for passwords, authenticators, recovery, and rate limits.
- [NIST: Computer Security Resource Center glossary](https://csrc.nist.gov/glossary): Canonical terminology used across US computer security guidance.