Password Managers & Security Tools — Category Research Report

Your passwords, your identities, your digital keys — stored in vaults owned by companies that have already been breached. This is the landscape, the data, and the opportunity.

---

The Landscape

The password manager market is worth an estimated $2.4-3.7B annually (2025), growing at 20%+ CAGR. The category was transformed by the LastPass breach of 2022 — the largest security failure in password management history — which triggered a mass migration and fundamentally changed how users evaluate trust in this space.

The market is splitting into three tiers: free built-in solutions (Google, Apple) capturing 55%+ of the US market; premium standalone managers (1Password, Bitwarden, Dashlane); and the open-source ecosystem (KeePass, Bitwarden's open core). The LastPass breach proved that "trusted" doesn't mean "secure" — and users are still paying the price.

---

The Enshittification Timeline

• 2008-2018: LastPass dominance. LastPass became the default recommendation for password management. Free tier was genuinely generous. By 2020, it held 21% market share — the largest standalone password manager.

• 2020-2021: Corporate extraction begins. LogMeIn (LastPass parent) taken private by Francisco Partners and Evergreen Coast Capital for $4.3B in 2020. LastPass restricts free tier to single device type (desktop OR mobile, not both) in February 2021. Users who used LastPass across devices suddenly need to pay.

• August 2022: The breach. An attacker accessed LastPass's development environment, stealing source code and an encrypted backup key. Between September 8-22, attackers downloaded encrypted customer vault backups from AWS S3. AWS GuardDuty detected it on October 26 — a 79-day attack window. The vector: a senior DevOps engineer's personal computer was compromised through a vulnerability in third-party media software.

• December 2022: Disclosure. LastPass reveals customer vault data was copied — encrypted passwords plus unencrypted metadata (website URLs, company names, billing addresses, email addresses, phone numbers, IP addresses). 33 million users affected.

• 2023-2025: The aftermath. Market share collapsed from 21% (2021) to 11% (2024). Attackers cracked weaker master passwords and stole $438 million+ in cryptocurrency traced to the breach. Ripple co-founder Chris Larsen lost approximately $150 million in XRP. Class-action settlement: $24.5 million (preliminary court approval February 2026). UK ICO fine: £1.2 million. A $3 million Canadian settlement is anticipated in 2026.

• September 2025: Dashlane kills its free tier. Dashlane retires its Free plan entirely. Existing free users given temporary Premium trial; those who didn't upgrade lost ability to add, edit, copy, or view stored data. The message to free users: pay or lose access to your own passwords.

• 2025-2026: The platform squeeze. Apple launches standalone Passwords app (iOS 18, free, pre-installed on billions of devices). Google Password Manager grows to 32% market share. Built-in solutions now hold 55%+ of the US market. Standalone password managers face an existential threat: why pay for something your phone gives you for free?

---

The Data Audit

What password managers store:

• Every username and password for every service you use
• Credit card numbers, bank account details, secure notes
• Website URLs (revealing which services you use — even in encrypted vaults, LastPass stored these unencrypted)
• Identity information (names, addresses, phone numbers)
• Two-factor authentication secrets (TOTP seeds)
• Passkeys and security keys
• Shared vault memberships (revealing organizational structure)

The zero-knowledge question: Most standalone password managers (1Password, Bitwarden, Dashlane, Proton Pass) use zero-knowledge encryption — they cannot access your vault contents. This is the fundamental security promise. But the LastPass breach revealed critical weaknesses in the model: even with zero-knowledge encryption, metadata (which sites you use, your email, billing address) was stored unencrypted. And attackers can — and did — crack weak master passwords offline.

Google Password Manager's gap: Google Password Manager does NOT use zero-knowledge end-to-end encryption by default. Google can theoretically access stored credentials under legal requests. On-device encryption is available but not enabled by default. Metadata about usage patterns, websites visited, and account activity contributes to Google's broader data collection.

Apple's approach: Apple's Passwords app uses end-to-end encryption via iCloud Keychain (with 2FA enabled). Apple cannot access your passwords. This is genuinely stronger privacy than Google's approach — but it only works within the Apple ecosystem.

What happens when a password manager is breached: LastPass proved the answer: attackers get encrypted vaults they can crack offline at their leisure, plus unencrypted metadata revealing your entire digital footprint. The cryptocurrency theft from the LastPass breach is ongoing — $438 million and counting as of December 2025, with new theft waves detected as recently as September 2025.

---

Vulnerability Score

Overall vulnerability: High. The trust gap created by the LastPass breach has not been filled. Users want password managers they can verify, audit, and trust — but the market offers either opaque commercial products or free built-in solutions from surveillance companies. An open, user-owned password manager with transparent security practices fills a gap that no current player fully addresses.

---

The Your 99 Blueprint

Revenue model: $2/month subscription ($24/year). Undercuts 1Password ($36/year) and Dashlane ($45/year). Competitive with Bitwarden Premium ($10/year) but includes ownership. Free tier with full password management — free users still earn stake.

Draft Contribution Map:

Economics at scale:

(Assumes $2/month subscription, ~10% operating costs, standard 1%/10%/89% split)

Per-user returns are modest for password management alone — this is a low-price, high-trust product. The real value proposition: you own the most security-critical tool in your digital life, the code is open and auditable, and no corporation can be breached, acquired, or change policies to compromise your vault. Plus ecosystem-wide earnings from the Universal Pool across all Your 99 products.

Key differentiator beyond ownership: Fully open-source and auditable (like Bitwarden, but user-owned). Zero-knowledge encryption as standard. Passkey support from day one. No metadata stored unencrypted (the LastPass lesson). Community-funded security audits. No free tier subsidized by selling data (unlike Google). Works cross-platform (unlike Apple). Self-hostable for users who want maximum control.

Minimum viable feature set: Vault storage (passwords, cards, notes, identities), browser extensions (Chrome, Firefox, Safari), mobile apps (iOS, Android), autofill, password generator, zero-knowledge E2E encryption, export/import. Phase 2: passkey management, family sharing, 2FA authenticator. Phase 3: enterprise features (SSO, SCIM, audit logs), security monitoring.

---

Open Questions

• Can a Your 99 password manager compete with free built-in solutions from Apple and Google? The differentiator must be trust and transparency, not features — Apple Passwords is "good enough" for most consumers. The audience may be privacy-conscious users and small businesses, not the mass market.
• Bitwarden already occupies the "open-source password manager" position with 10M+ users. How does a Your 99 alternative differentiate? Ownership and profit sharing are the answer — but is that enough when Bitwarden is $10/year?
• Should security vulnerability bounties be the primary Contribution Map item? A user-owned password manager where security researchers earn stake for finding vulnerabilities creates aligned incentives that no corporate product can match.
• How do passkeys change the equation? 69% of users now have at least one passkey. 48% of top 100 websites support them. If passwords become less central, does the password manager market shrink — or does it evolve into a broader "credential manager" market?
• Is this the right category for a Your 99 product? The economics are thin ($2/month), the competition from free built-in solutions is intense, and Bitwarden already serves the open-source niche. But the trust argument is powerful, and the data sensitivity is extreme.