Are Password Managers Quantum-Safe?
Short answer: a password manager is not a magic “quantum-safe” wrapper, but it leaves you in good shape. Its value against quantum attacks is twofold — it generates long, fully random passwords (high entropy that resists Grover), and it encrypts your vault with AES-256, which Grover only weakens to a ~128-bit-equivalent search. Neither is broken by any foreseeable computer.
Two separate protections, two separate threats
People conflate “the manager” with one security property. It is really two layers, and quantum computing touches each differently.
| Layer | What it does | Quantum exposure | Verdict |
|---|---|---|---|
| Generated site passwords | Random 16–32 char strings, max entropy | Grover halves bit-strength only | Safe with length |
| Vault encryption (AES-256) | Encrypts stored secrets at rest | Grover → ~128-bit effective | Safe |
| Master password / KDF | Derives the vault key from your phrase | Grover speeds guessing; KDF slows it | Safe if the master is strong |
| Sync / TLS transport | Protects data in transit | Public-key parts vulnerable to Shor | Mitigated by PQC rollout |
Why AES-256 survives Grover
AES-256 has a 256-bit key. Grover’s quadratic speedup turns a 2^256 search into roughly 2^128 iterations. A 2^128 brute force is the same wall that 128-bit symmetric crypto already sits behind — sequential, un-parallelisable beyond √M, and utterly infeasible. This is exactly why standards bodies treat AES-256 as quantum-resistant for confidentiality and did not rush to replace it, unlike RSA and ECC.
Where the genuine quantum risk lives
The vulnerable part is public-key cryptography, not your stored passwords. TLS handshakes and some sync protocols use RSA/ECC key exchange, which Shor’s algorithm breaks exponentially (a different beast from Grover). The “harvest now, decrypt later” worry is that captured traffic could be decrypted once large quantum computers arrive. The fix is migrating to NIST’s standardised post-quantum key exchange and signatures — see Post-Quantum Cryptography, Explained.
Practical checklist
- Pick a long, unique master password — it is the one secret the manager can’t generate for you. Make it a high-entropy passphrase.
- Enable a slow KDF (Argon2 or high-iteration PBKDF2) so master-password guessing stays expensive even with Grover.
- Turn on MFA for the vault account.
- Let it generate everything else at 20+ random characters; test the result in our password checker.
Generated length is the whole game on the client side — the same point we make in How Long Does It Take to Crack a 16-Character Password?.