Password Managers vs. Encrypted Vaults: Understanding the Difference

If you already use 1Password or Bitwarden, good. You've thought about your digital security more deliberately than most people. 

‍

You may also be under the impression that you're sorted, but you aren't. A password manager and an encrypted vault are different tools, and most people who own one assume it does the job of the other. 

‍

This post is about what each one is for, where they overlap, where they don't, and how to decide whether you need both.

‍

What a Password Manager Does

‍

A password manager has one job: store and autofill credentials. It generates long, random passwords for every site you log into, remembers them so you don't have to, and types them in when prompted. The good ones do a handful of related jobs – store credit cards, hold two-factor authentication codes, share a Netflix login with your partner – but the core function is credentials.

‍

This is real security infrastructure. If you've ever reused a password across two sites and one of those sites got breached, a password manager is the thing that would have stopped your other account from being compromised. The average person has somewhere between 80 and 150 online accounts, and remembering 80 unique strong passwords is not a thing a human brain can do. A password manager solves that.

‍

What a password manager is not designed for: storing your actual stuff. Your tax returns, your kid's medical records, your passport photo, the spreadsheet of every account number you have, a copy of your will. Some password managers will let you upload files, but most limit you to a few hundred megabytes, charge extra for it, and treat it as a secondary feature. The interface is built around "find this password fast", not “store different types of important information here in a secure and organized way”.

What an Encrypted Vault Does

‍

An encrypted vault is built for the second job. It's where your documents, photos, notes, and personal data live, with strong encryption wrapped around all of it. Think of it as a digital filing cabinet that nobody – including the company providing the vault – can open without your key.

‍

The right vault should let you:

‍

- Store documents of any kind (PDFs, images, videos, spreadsheets)

- Search the contents, not just the filenames

- Organize things in a way that makes sense to you, not the software

- Share specific items with specific people, securely

- Sync across your devices without exposing anything to the cloud provider's servers

‍

There's a slice of functionality both tools handle. Both encrypt their contents. Both require a master password. Both offer secure notes – short text snippets you want kept private. Both will let you store a credit card number.

‍

This is where the confusion comes from. If both tools store secure notes, why do you need both?

‍

The answer is that secure notes in a password manager are a courtesy feature. They were added because users were already pasting sensitive information into the password field of fake entries. Their product teams noticed and built a slightly more dignified place for it. They are not the main feature, and the tooling around them – search, organization, linking, viewing photos inline, attaching multiple files – reflects that. If your "secure notes" section in your password manager has more than a dozen entries, you're probably using the wrong tool.

‍

Compare that to how a vault handles the same content. A vault assumes you'll keep thousands of items. It lets you search across them, connect them, view them properly, and pull them up on any device. A password manager treats that same information as an afterthought.

‍

The "Even From Us" Phrase -– What Does That Mean?

‍

There's a more important distinction underneath all of this, and it's the one most product comparisons skip.

‍

Password managers, as a rule, use zero-knowledge architecture for your passwords. Your master password never leaves your device. The encrypted vault of passwords lives on their servers, but the keys to unlock it don't. 1Password, Bitwarden, and others have built their reputations on this type of security architecture.

‍

Encrypted vaults are mostly zero-knowledge too, but not all of them. Some cloud storage services advertise themselves as "encrypted" because your data is encrypted on their servers, but they also hold the encryption keys, which means they can – technically and legally – both see your data and potentially be compelled to hand it over. When you're choosing a vault, the question to ask isn't "is it encrypted?" Everything is encrypted. The question is whether the company has access to your keys and can read what you store, if they wanted to.

‍

If the answer is yes, you don't have a true encrypted vault, you just have a digital filing cabinet.

‍

Where Thinkspan Sits

‍

Thinkspan is an encrypted vault built on zero-knowledge architecture, which means we cannot read what you store. We don't hold the keys. If a court asked us to produce your data, we couldn't, because the only thing on our servers is encrypted gibberish that requires a key you alone hold to decrypt.

It's not a password manager (yet!) – keep using the one you already trust for that. We're built for the second job: the actual stuff. Documents, photos, medical records, family papers, the spreadsheet of every account number you have. The on-device AI assistant can search across all of it and surface what you need, without any of that data ever touching a server in readable form.

How to Decide What You Need

‍

You probably need a password manager. If you're online at all, you have credentials, and unique strong passwords are the cheapest, biggest improvement you can make to your security. Pick one. Use it.

‍

Whether you need a separate vault depends on what you have to protect.

‍

You probably want a vault if:

‍

- You handle sensitive documents (medical records, financial paperwork, legal documents, tax returns)

- You have photos or videos you'd rather not see on a stranger's phone

- You're self-employed and have client information you're contractually obligated to keep private

- You have family records – passports, certificates, insurance policies – that need to be accessible but private

- You want one place to find any of the above, not seven different cloud services

‍

You can probably skip a dedicated vault if:

‍

- Your sensitive information is limited to about a dozen passwords and one or two PDFs you reference twice a year

- You're already happy with whatever cloud storage you're using and don't have privacy concerns about it

- You don't store medical, financial, or family records digitally

‍

Most people end up with both tools. A password manager for credentials, a vault for everything else. It’s a great division of roles, and you end up with only two tools, each being used for its core purpose, and all of your important information has a secure, encrypted place to live.

‍