Rather than doing everything locally on the user’s machine, which is what another password manager with this feature does, Dashlane does it via their servers. The main problematic feature is their Password Changer it may look awesome, but it represents a serious security issue. This is something that every Password Manager must guarantee.ĭashlane's design choices make them unable to guarantee that they will never have access to their users' passwords. The main principle Dashlane tramples is the minimisation of their attack surface, as their design choices make them unable to guarantee that they will never have access to their users’ passwords without knowing their Master Passwords. The first feature does not respect basic security by design principles, to which any application or organisation should automatically adhere when handling sensitive data.

Specifically, I take serious issue with two of Dashlane’s features, both in the way they are designed and in the way they are presented.

However, while doing my research, I stumbled upon some concerning design choices regarding Dashlane, which pushed me to write and publish this post first. Initially, this post should have been a comparative of password managers. Hereunder the original post, for archival purposes.

This post is therefore not relevant anymore, but I’d like to think it played a role in this change happening. December 2021 update: three years (!) after this post was published, Dashlane finally updated their Password Changer to make it work locally.

Dashlane is it safe