Kaspersky Password Manager Review

Security-focused password manager that uses AES-256 encryption, with a digital wallet and broad document storage.

We think Kaspersky Password Manager shows how a single vulnerability and a single export-control decision can outweigh otherwise solid product work. On paper the technical foundation looks reasonable. Reviewers report AES-256 encryption with a zero-knowledge architecture, meaning Kaspersky cannot read your vault server-side.

Kaspersky gained SOC 2 Type 2 certification in 2023, evidence of baseline operational security controls. Cross-device sync runs through extensions for Chrome, Firefox, Safari, Edge and Brave. Biometric login covers mobile and Windows.

A haveibeenpwned.com integration flags compromised credentials inside the vault. At roughly $14.99 a year, with a free tier covering up to fifteen entries, the pricing is modest. Two issues sit above that baseline.

Because of them, we cannot recommend the product. The first is technical. In 2020 the Donjon team at Ledger found that the Kaspersky password generator was seeded by the current time and used a non-cryptographic pseudo-random number generator.

Any password produced before the patch could be brute-forced in minutes. The flaw was assigned CVE-2020-27020. Kaspersky released a fix in late 2020, but anything generated before that point needs rotating.

This kind of mistake should not happen in a tool whose entire job is generating strong secrets. It permanently changes how we read the rest of the security story. The second is jurisdictional.

On 20 June 2024 the US Department of Commerce's Bureau of Industry and Security issued a Final Determination prohibiting Kaspersky cybersecurity products for US persons. All transactions were blocked from 29 September 2024, with the order citing Russian-jurisdiction risk across the company. For US-based readers, this is a regulatory bar on continued use.

Even outside the US, the risk the BIS described applies to anyone who has to consider nation-state actors with influence over Russian companies. Other gaps add to those two issues. Cloudwards and TechRadar both note that the consumer product lacks secure password sharing, emergency access and account recovery options, which 1Password and Bitwarden include at similar prices.

There is no built-in audit log or activity history for households. Trustpilot reviewers report vault-loss incidents after renewal and difficulty ending auto-renewing subscriptions, with support limited to generic email. AllAboutCookies notes that the privacy policy permits processing without consent where applicable law allows.

That open-ended clause adds to the jurisdiction concern. In our view, the price is low and the encryption model is sound on paper. The breach-checking feature is useful too.

Taken together, though, the PRNG flaw and the US prohibition mean we prefer managers with cleaner audit histories and friendlier jurisdictions.