Design a password manager like 1password
PremiumSecurity systemMedium
- Zero knowledge encryption
- PBKDF2
- AES 256 GCM
Quick answer
This security system interview question asks you to design a password manager like 1password. Aim for a design that protects users and data without blocking legitimate use, then explain the threats, controls, detection and trade-offs. Interviewers want to see how you model threats and layer defences.
The problem
Design a password manager for families and teams, like the vault apps that sync logins across phone, laptop and browser. The server stores every vault but must never be able to read one. The hard parts are turning a human password into strong keys, sharing items the server cannot see, and recovery without a back door.
Clients (desktop, mobile and browser extension) do all encryption and decryption. The server handles accounts, sync and sharing. Plan for a server breach: the attacker gets every encrypted vault and can test password guesses offline for as long as they like.
What must a password manager like 1password do?
- Zero-knowledge vaults: Items are encrypted on the device; the server stores only ciphertext and cannot decrypt it.
- Sign in and unlock: Users sign in on a new device with their account password plus a secret from an existing device or a printed kit, and unlock known devices with the password or biometrics.
How well must it do it?
- Breach resistance: A full copy of the server database must not let an attacker test password guesses offline, even for weak passwords.
- No keys on the server: The server never receives the account password, the unlock key or any vault key in plain form.
What scale should you design for?
Use these numbers in your estimates.
The scale numbers unlock with this questionUnlock
Key concepts
- Zero knowledge encryption
- PBKDF2
- AES 256 GCM
- SRP
- Key wrapping
- Vault sharing
How you’ll practise
- Requirements and assets
- Threat model
- Identity and access
- Data protection
- Detection and response
- Wrap-up
Lala, personalized to you, gives a hint when you ask and reviews your design when you are ready.
What do interviewers look for?
In any security system design round.
- Starts with a clear threat model
- Layers defences instead of relying on one control
- Covers authentication, authorisation and secrets
- Plans detection, alerting and response
- Protects data in transit and at rest
- Balances security against usability and cost
Questions people ask about this interview question
- Which design type is this question?
- It is a security system question. You design a password manager like 1password and explain your choices the way you would in an interview.
- Is this question asked at entry level?
- It is marked Medium. Entry-level engineers can practise it, but it expects you to reason about requirements and trade-offs, not only list components.
- What should I cover first?
- Start with what must be protected, from whom and what a breach would cost. Agree on scope with the interviewer before you design anything.
- Can I practise it for free?
- It is a premium question. Sign up and unlock it once for 10 credits; it then stays unlocked. When you finish, Lala, your personalized AI mentor, can review your design for 30 credits.
Related questions
Updated · Written by the SevyDevy team