Some password managers use a user-selected master password or passphrase to form the key used to encrypt the protected passwords. The security of this approach depends on the strength of the chosen password (which might be guessed or brute-forced), and also that the passphrase itself is never stored locally where a malicious program or individual could read it. A compromised master password renders all of the protected passwords vulnerable.