Norton Password Manager stores website logins in an encrypted vault and synchronizes them across supported browser extensions and mobile apps. It can fill saved credentials and generate replacement passwords. Safety Dashboard checks stored password health separately. The Norton account locates the vault, while a separate vault password creates the local encryption key used to open its contents.
Norton states that it does not store or receive the vault password or the derived key. This separation protects the vault from an ordinary account-password reset, but it also creates a recovery limit that matters before the first credential enters the vault.
The Norton account and vault password solve different problems
Opening the vault on another browser or computer requires the browser extension and a Norton account sign-in. The user then supplies the vault password. Resetting the Norton account password does not produce a new vault key or reveal the existing vault password.
The vault belongs to the Norton account without requiring a Norton 360 subscription. Norton Password Manager still needs the vault password each time its locking policy requires access again.
Desktop cannot reset a forgotten vault password
Norton cannot reset a forgotten vault password from Windows or a desktop browser. The documented exception uses a mobile device that remains signed in and on which the user already configured biometric authentication for Norton Password Manager.
This is not a recovery path that can start after every device has lost access. If no retained mobile session has the required biometric setup, the forgotten vault password can leave the stored vault inaccessible. The exception requires a mobile device that remains signed in and already has biometric authentication configured for Norton Password Manager.
Mobile approval needs one setup per browser
Mobile approval sends a passwordless access request to a registered mobile device. Each browser that will send those requests needs its own setup. Registration on one browser does not automatically approve another browser profile.
Mobile approval depends on notifications and Internet access. The device also needs correct time. Power-saving rules can delay the app. An expired notification can make the request fail, and app reinstallation requires another registration.
Closing the browser can lock the vault
Under the documented Chrome and Edge behavior, closing the browser locks the extension vault. Reopening the browser then requires the vault password again. A persistent-access option exists only in supported browser and platform contexts and stores the required keys in the extension.
Norton Password Manager limits persistent access to supported browser and platform contexts and warns against enabling it on an untrusted computer.
CSV import handles password records
The import workflow accepts CSV password records and lets the user choose which entries enter the vault. The extension must have an active account sign-in and an open vault before import.
A generic CSV migration does not transfer every other vault item type. The CSV file remains readable outside the encrypted vault after import.
The password generator can create a replacement value and save it with a login. Safety Dashboard performs a separate check on the health of stored passwords.
