RoboForm

Is RoboForm safe?

Yes, for most people. RoboForm encrypts your vault on your own device, its iPhone app reports collecting nothing but crash and performance data, and no breach of user vaults has been reported in more than 25 years. We score it 82/100, level with NordPass (82) and a little behind Keeper (85).

What holds it back is how little you can check. The code is closed, the one recent outside test is published only as a three-page summary, and the company's best-known security story is a password generator that was quietly fixed in 2015.

How RoboForm protects your vault

RoboForm's white paper says your data is encrypted with AES-256, using a key made from your master password with PBKDF2-SHA256 and a random 32-byte salt. The default is 1,000,000 iterations, which slows down anyone trying to guess the password and matches Keeper. Decryption happens only on your device; RoboForm's servers store encrypted data and one-way hashes. Shared items are protected with RSA-2048 public-key encryption.

Your account can be protected with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, a hardware security key or an authenticator app, as well as weaker email or SMS codes. Pick one of the first three.

What outside testers found

Between August and September 2024, the security firm Secfault Security spent 20 person-days testing RoboForm's Windows, Mac, Android and iOS apps, its browser extensions, its web portal and the source code of its password generator. It found "several vulnerabilities of varying criticality", which RoboForm fixed; retests in November 2024 and February 2025 found no directly exploitable issues in scope. Only a summary is public, so you cannot see what the flaws were.

Independent researchers have found more. Marek Tóth's 2025 study of browser extensions showed that a malicious page could trick RoboForm, with one click, into filling card details, personal data or logins. RoboForm fixed it in extension 9.7.6 on 25 July 2025, before he presented the research. In May 2026 Japan's JPCERT/CC published CVE-2026-47782: the Android app, up to version 9.8.6.3, could be made by another installed app to download files silently. It scored 3.3 (low) under CVSS 3.0 and 4.6 (medium) under CVSS 4.0, and did not affect iPhone.

RoboForm runs its own bug bounty through support tickets, with rewards "at RoboForm's sole discretion". The policy also forbids researchers from going public without written permission, which is stricter than most rivals.

The old password generator flaw

In 2024 the hardware hacker Joe Grand and a colleague recovered a lost 20-character password protecting 43.6 bitcoin, worth about $3 million. The owner had made it with RoboForm in 2013. They found that the generator in that version, and later ones until 2015, built "random" passwords from the computer's date and time, so knowing roughly when a password was made narrowed the guesses enough to find it.

Siber told WIRED the issue was fixed in version 7.9.14, released on 10 June 2015, but would not say how. WIRED found no sign that customers were told to replace passwords made before the fix. The flaw is more than ten years old, so it does not lower our score, and Secfault's 2024 test covered the current generator. If you still use passwords RoboForm generated before mid-2015, change them.

What RoboForm collects

Apple's privacy label is one of the shortest we have seen: crash data, performance data and other diagnostics, not linked to you, and no tracking. Google Play lists more, all marked optional except diagnostics: your name, email, phone, address and user ID for your account, device IDs for analytics, and web browsing history used for app functions. Nothing is listed as shared.

The privacy policy is undated and still mentions Internet Explorer. It says Siber keeps customer data in a US data centre, passes billing and email details to Stripe, Mailchimp and IBM Watson, sends marketing emails you can unsubscribe from, and may show offers for "3rd party software" on the page you see after an update. RoboForm's website uses Google Analytics remarketing.

How to use RoboForm safely

1. Use a long master password you use nowhere else. RoboForm cannot reset it.
2. Protect your account with a passkeyPasskeyA way to sign in without a password. Your device holds a key tied to one website or app and unlocks it with your fingerprint, face or PIN.More in the glossary, security key or authenticator app rather than SMS.
3. Replace any important password RoboForm generated before mid-2015.
4. Keep the app and browser extension updated: the 2025 and 2026 fixes need recent versions.
5. Type roboform.com yourself instead of clicking sign-in links in emails.

How we scored it

The regulatory record (88) is the strongest factor: no fines or orders, but no regulator has examined the app. Privacy (84) benefits from a very short App Store label, held back by the broader Play listing and an old-fashioned policy. Security (80) reflects strong encryption and a recent pen test against unpublished findings and several fixed flaws. The weakest factor is transparency and control (76): closed code, a summary-only audit and a strict gag on researchers. For a fully open alternative, see Bitwarden or, for an offline vault on Android, KeePassDX.