I understand the rough idea that a password manager stores encrypted data, but there is one part I cannot make intuitive.
When I type the master password, the manager can suddenly reveal all the individual passwords. Yet the websites I log into only receive their own password, not the master password.
Is the simplest explanation that the master password is used locally to derive a key that unlocks the vault, and the website never participates in that step at all? I am mainly trying to understand where the “trust boundary” is rather than the exact cryptography.