Dashlane

Is Dashlane safe?

Mostly, for anyone with a strong master password. Dashlane encrypts your vault on your own devices, and the way it turns your master password into a key (Argon2d) makes guessing slow and expensive even for an attacker who holds a copy of the vault. We score it 73/100, well above LastPass (56) but clearly below 1Password (86) and Bitwarden (88).

Two things pull it down. In 2026 attackers got around the device check that protects accounts and walked off with a small number of encrypted vaults. And the iPhone app has the heaviest advertising footprint of the major password managers we have scored.

What happened in the 2026 attack

On 31 May 2026 someone began sending a flood of automated guesses to the part of Dashlane's system that adds a new phone or computer to an account. That step normally needs a 6-digit code, sent by email or generated in an authenticator app. Dashlane's controls locked the targeted accounts, which is why many users found themselves suspended that week. But before the attack was fully blocked, the guessing worked for fewer than 20 personal-plan accounts. The attacker registered a device on each and downloaded a copy of the encrypted vault.

Dashlane closed its investigation on 4 June and said it found no further impact and no sign that its internal systems were reached. On 3 September it added more checks to device registration and said it was retiring old code and endpoints faster.

The vaults are still encrypted, so their contents are safe as long as the owner's master password cannot be guessed. Dashlane's settings (Argon2d with 32 MB of memory and 3 passes) make that very slow. The lesson for everyone else is simpler: a 6-digit code is only as good as the limits on how many times someone can try it, and that limit failed here.

How Dashlane encrypts your vault

Your master password never leaves your device in usable form, and Dashlane says it stores neither the password nor anything derived from it. The vault is encrypted with AES-256 in CBC mode with an HMAC check. For business customers, single sign-on runs inside AWS Nitro Enclaves, sealed-off machines meant to keep keys out of reach of Dashlane's own staff.

Outside testing has found weak spots at the edges. In a study published in 2026, researchers from ETH Zurich and Università della Svizzera italiana tested four password managers against a hostile server, one run by an attacker who controls the company's systems. They reported 6 attacks against Dashlane, the same number as 1Password and fewer than Bitwarden's 12. On 1 August 2025 Dashlane fixed a clickjacking flaw, reported by researcher Marek Tóth, that could trick a user of its browser extension into a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary login on a website an attacker had already compromised; it says no one exploited it. In Tóth's tests Dashlane's extension did not leak saved passwords, cards or personal data this way, unlike several rivals.

Dashlane holds SOC 2 Type II and ISO 27001 certification and says it runs independent penetration tests every year. Its security page still describes a "decade-long HackerOne program", and its security documentation says rewards depend on severity. The public programme it opened on Intigriti in July 2026, though, is a vulnerability disclosure programme whose reward table lists $0 at every severity; it says strong reports may earn an invitation to a private paid bounty.

What Dashlane collects

More than you might expect from a security tool. Apple's privacy label says contact info and identifiers may be used to track you across apps and websites owned by other companies. Your email, user ID and in-app activity are linked to you for marketing, analytics and personalisation, and browsing history is collected without being tied to your name. Google Play lists user IDs shared with other companies, partly for advertising.

The privacy policy explains why. Dashlane shares hashed email addresses and device IDs with advertising partners, for instance so it does not pay to show ads to people who already use it, and its website uses cookies and pixels for interest-based ads. It says it never sells personal data, and the autofill matching of websites happens on your device. None of this touches your passwords, which stay encrypted, but Bitwarden and Proton Pass show it is possible to run a password manager without it.

Exports, recovery and the end of the free plan

Leaving is easy. You can export to an encrypted DASH file, to CSV (unencrypted) or, on recent iPhones, Macs and Android phones, straight to another password manager through the Credential Exchange format. Account deletion is self-service. Accounts inactive for more than 13 months are deleted automatically after warning emails.

Dashlane has stopped offering its free plan and monthly billing. The choice is now Premium or Friends & Family for up to 10 people, paid yearly, with a Hotspot Shield VPN included.

How to use Dashlane safely

1. Use a long master password you have never used anywhere else. After the 2026 attack, this is what stands between a copied vault and your accounts.
2. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary with an authenticator app, not email codes alone.
3. Check the list of devices on your account and remove any you do not recognise.
4. Set up a recovery key now. Without one, a forgotten master password means resetting the account and losing the vault.
5. On iPhone, turn off "Allow Apps to Request to Track" if you do not want Dashlane's identifiers used for advertising.

How we scored it

The strongest factor is the regulatory record (88), with no fines or orders found, followed by scams and harmful content (86). The weakest is privacy (64), because of tracking on Apple's label and identifiers shared with advertisers. Security (70) credits the Argon2d encryption and audits but counts the 2026 vault copies and the ETH Zurich findings against it.