# Design a password manager like 1Password: system design interview question

> Private vaults across devices: key access, offline edits, shared access removal, and recovery with explicit security limits.

Source: https://sysround.com/questions/design-password-manager-like-1password
Updated: 2026-11-05


Difficulty: hard. Levels: Senior, Staff+.

## How the interviewer opens it

"Design a password manager that stores and synchronizes encrypted vaults across devices. Protect vault contents from the service under a clear threat model. Support secure sharing and account recovery."

## What to clarify first

- Scale
- Read and write mix
- Offline use and latency
- Consistency and availability
- Durability and retention
- Security boundary
- Shared access
- Account recovery
- Visible metadata
- Product boundaries

## Scope of a strong answer

Core requirements:

- Store encrypted vaults and provide access from authorized devices.
- Synchronize offline edits without silent data loss.
- Share a vault with named users and remove their access to future edits.
- Recover vault access with a recovery secret that the user keeps.

Usually out of scope:

- Autofill and browser integration.
- Enterprise administration.
- Protection after a client compromise.
- Guaranteed freshness against a malicious server.
- Erasure of copies that former members already hold.

## What interviewers probe

### Vault confidentiality

Devices need shared secrets without direct server access to those secrets. Weak passwords still expose encrypted key envelopes to offline guesses.

### Edits from several devices

The server cannot inspect encrypted fields. Offline devices can edit or delete the same item without knowledge of other changes.

### Access to shared passwords

Removal must coordinate membership and future encryption keys. Offline edits can otherwise expose new content through keys that a former member still knows.

### Account recovery

Recovery needs a decryption route that survives device loss. That route must not give the server or an email attacker a universal secret.

## Common mistakes

- The design promises absolute secrecy despite offline guesses against weak passwords.
- The client accepts encrypted vault keys without proof of an authorized sender.
- The design separates membership removal from the key epoch change and accepts stale-epoch writes.
- The design confuses account login recovery with vault recovery.
- The sync path silently replaces concurrent edits.
- The design promises complete revocation of data that a recipient already copied.

## The bar by level

- **Senior:** Defines the key hierarchy and authenticated envelope context. Implements atomic membership and epoch transitions with stale-write rejection. Handles recovery proofs, sync retries, and deletion conflicts.
- **Staff+:** Defines identity trust and malicious-server limits. Explains revocation races, old backup exposure, and recovery authorization changes. Plans safe key migration across offline devices without silent data loss.

Practice this question with an AI interviewer: https://sysround.com/practice/new?problem=password-manager


---
SysRound (https://sysround.com) is an AI practice tool for system design interviews. It has a voice or typed AI interviewer and a shared whiteboard. At the end, you get feedback on each skill and a model answer. The AI feedback can be wrong.