Skip to content
Password Manager Manager

Audits and breaches, year by year

A security audit is an outside firm testing the vendor's claims. An incident is when something went wrong. Here is every one we found, with the gaps left visible.

Published audits
17
No audit found
14 of 23
Vault data or code stolen
1 of 23

The timeline

Audit, public reportAudit, report not publicVault data or code stolenOther incident

Swipe sideways to see every year.

Password manager
201620182020202220242026

Audits are counted only when the auditor and year are named. Built-in managers are usually covered by their company's wider security programme rather than a product audit.

Every incident on record

  1. LastPass logoLastPass2026

    Other

    Customer names, contact details and support case records were exposed through a breach at Klue, a third-party vendor. LastPass said vaults were not affected.

  2. Microsoft Edge password manager logoMicrosoft Edge password manager2026

    Vulnerability

    Edge loaded all saved passwords into process memory in cleartext at startup; from Edge 148 they are no longer loaded at launch.

  3. Avira Password Manager logoAvira Password Manager2022

    Vulnerability

    The browser extension autofilled credentials on phishing sites; fixed after disclosure by Stiftung Warentest.

    • Research summary (no single link)
  4. LastPass logoLastPass2022

    Vault data stolen

    Attackers copied encrypted customer vault backups; website URLs in them were unencrypted. Offline cracking of weak master passwords was later linked to cryptocurrency thefts, and the UK ICO fined LastPass £1.2M in 2025.

  5. LastPass logoLastPass2022

    Source code stolen

    Source code was stolen from LastPass.

  6. Norton Password Manager logoNorton Password Manager2022

    Account attacks

    A December 2022 credential-stuffing attack accessed some Norton accounts; Norton could not rule out that vault contents of affected accounts were accessed.

    • Research summary (no single link)
  7. Kaspersky Password Manager logoKaspersky Password Manager2020

    Vulnerability

    The password generator used weak time-based randomness (CVE-2020-27020); fixed.