Breaking Password Managers: How Easy Is It and What’s Inside?

We are using longer and more complex passwords to protect our accounts. Hence, keeping track of numerous password combinations has become a task on its own. That is why more and more people are turning to password managers. Be it a free open-source tool or a commercial security architecture, many of us are using them to store our sensitive data.

However, a password manager app, besides passwords, can contain additional data sources, emails, connections, online banking details, and even documents. This data is very appealing to computer forensics. Take a look at “The Potential Importance Of Information From Password Managers” article for further reference.

Passware has recently updated its Password Managers decryption option by adding the support for Mac version of Dashlane – The Best Password Manager for 2022, according to PC Mag. In general, Passware Kit supports six password managing applications: 1Password, KeePass, LastPass, Dashlane, macOS Keychain and iOS Keychain (iTunes backup).

For the master password to reside in the app’s vault, there should be at least one successful login to the password manager on the target computer. Given this, the vault can be exported and analyzed by Passware Kit. Broadly speaking, the software recovers the master password of the application using a brute-force method with GPU acceleration where possible and afterwards extracts the contained passwords and other records.

Let’s take a closer look into the password managers, their versions, and how difficult it is to break into them.

1Password

1Password is one of the most secure and widely used commercial password managers developed for all popular platforms: Windows, Linux, macOS, iOS, and Android. Passware Kit supports all versions of 1Password including v8 for all the platforms, with some limitations.* Besides the GPU-accelerated brute-force recovery of a master password, Passware Kit is also capable of acquiring it from a live memory image for the standalone 1Password for Mac. In some cases, Passware Kit Mobile can decrypt a 1Password database instantly.

In December 2012, AgileBits introduced the OPVault format to replace the outdated Agile Keychain format. The OPVault is now the default format for syncing with iCloud and Dropbox. Passware Kit supports both OPVault and Agile Keychain vaults, as well as the Online database format used in the browser versions of 1Password.

The recovery speed on an AMD Radeon RX 6900 XT is 770,000 passwords per second for Agile Keychain and 30,000 passwords per second for OPVault.

A 1Password vault can contain multiple accounts with different encryption types, and Passware Kit is capable of handling them one by one.

If syncing with Dropbox or iCloud is enabled, 1Password stores its vaults inside the Dropbox and iTunes/iCloud backups correspondingly. Below are the general locations of 1Password vaults on different systems.

Opvault - 2012-2022

Windows (1Password 8): C:\Users\<CurrentUser>\AppData\Local\1Password\data\1password.sqlite
MacOS (1Password 8): ~/Library/GroupContainers/2BUA8C4S2C.com.1password/Library/ApplicationSupport/1Password/Data/1password.sqlite
Linux (1Password 8):
Package manager or AppImage: ~/.config/1Password/1password.sqlite
Snap Store: ~/snap/1password/current/.config/1Password/1password.sqlite

Windows (1Password 7): C:\Users\<CurrentUser>\AppData\Local\1Password\data\1Password10.sqlite
macOS (1Password 7): ~/Library/Containers/2BUA8C4S2C.com.agilebits.onepassword-osx-helper/Data/Library/Data/OnePassword.sqlite

If you use Dropbox to sync your 1Password data with 1Password on other computers and devices, the path will look like this:

AgileKeychain - 2008-2012

If you use Dropbox to sync your 1Password data with 1Password on other computers and devices, the path will look like this:

KeePass

KeePass Password Safe is a free and open-source password manager primarily for Windows. Being a handy freebie, it is widely used by small office and home users all over the world.

The location of a KeePass vault (*.KDB for v.1.x and *.KDBX for v.2.x) is specified by the user, so it might be helpful to use the “Find Encrypted Files” option in the Passware Kit to locate this file.

Passware Kit recovers master passwords for the vaults and subsequently extracts user credentials and passwords from them. The password recovery process is accelerated with NVIDIA and AMD GPU cards, as well as distributed computing. The recovery speed on an AMD Radeon RX 6900 XT is 267,000 passwords per second for v.1 and 435,000 passwords per second for v.2.

Starting from 2023 v3, Passware Kit supports KeePass Professional 2.x databases encrypted using key files. The decryption is possible for databases protected with both password and key files or key files only. In addition to the password recovery, Passware Kit detects the key files with the *.keyx extension on a computer under investigation.

Also, Passware Kit 2023 v3 and higher versions support the KDBX v4 format of KeePass Password Safe databases, which can use the ChaCha20 encryption algorithm.

The GPU acceleration on both NVIDIA and AMD is supported for all versions of KeePass, with the exception of databases encrypted using the Argon2 key derivation function. It reaches up to 30,000 passwords per second on NVIDIA RTX 4070 Ti for a database with a single key file and 435,000 passwords per second for KeePass v.2 without key files.

The path to the database is chosen upon creation.

LastPass

LastPass is a freemium password manager that stores encrypted passwords online. It is available as an extension to web browsers, including Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge, Vivaldi, and Opera.

The location of its vaults might not be obvious. Below are the paths where the LastPass vaults are stored for different browsers on Windows and macOS. The file can be called "1" or "4" without an extension, so use the Find Encrypted Files option to detect it.

Windows