What happens to my password manager account if the company shuts down?
There is no universal guarantee here, and this is the one question in this set where we found the least direct, company-specific documentation.
What we could confirm is the individual-level safeguard: most password managers let you export
your own vault at any time, while the company is still operating, specifically so you are not
dependent on the company's continued existence. Bitwarden's documentation, for example, describes
exporting to .csv or .json formats and states: "No unencrypted data is transferred over the
internet, because data is decrypted locally by the client before exporting."
Source That's a safeguard you control now, in
advance — not something that helps if you never used it and the company disappears later.
For EU residents specifically, there is a regulatory backstop that doesn't exist in the same form in the U.S.: GDPR's right to data portability. The regulation's text states a data subject "shall have the right to receive the personal data concerning him or her... in a structured, commonly used and machine-readable format." Source That's a legal right to get your data out of a company while it's a going concern — it does not by itself specify what happens in an actual bankruptcy or unplanned shutdown, and it is EU-specific, not a U.S. protection.
What I could not verify — and this is a genuine, not just formal, gap: we could not find a primary source (from any vendor, regulator, or a documented historical case) describing exactly what happens to an existing, unexported vault when a password manager company itself shuts down or is acquired — whether there's a standard wind-down notice period, whether data is transferred to an acquirer, deleted, or held. This varies by company and by the circumstances of the shutdown (voluntary wind-down vs. bankruptcy vs. acquisition), and none of the vendor documentation checked in this research pass makes a forward-looking promise about it. The only reliable protection we found evidence for is exporting your own vault proactively, before you'd ever need to rely on the company's behavior in a shutdown scenario.
← My parent died and I cannot get into their phone or accounts. What can I do?
All fifteen questions