Passwords · 9 min read

Do you need a password manager that works without the cloud?

Syncing is a feature, not a virtue. What you give up by going offline, what you get back, and who should actually choose which.

Every password manager sells you the same thing: your logins, everywhere, on every device, filled in automatically. It is genuinely one of the better pieces of software anyone has built for ordinary people, and if you are not using one you should be.

But sync is a feature, not a virtue, and it is worth separating the two. The reason a password manager works is the encrypted vault and the generator. The reason it syncs is convenience. Those are different things, and a surprising number of people would be better served by the first without the second — and never consider it, because every product in the category treats the cloud as compulsory.

What syncing actually costs you

Not much, most of the time. Reputable managers use end-to-end encryption: the vault is encrypted on your device before it goes anywhere, and the provider stores a blob they cannot read. That design is sound and it has held up.

What it costs is a set of small, permanent risks that exist because the vault is somewhere other than your hand:

Your vault is in a collection. Millions of encrypted vaults in one place is a target in a way that your phone is not. Even if the encryption holds, a breach means your vault is now offline in somebody's possession, being attacked at leisure with no rate limit and no expiry. The strength of your master password stops being a comfort and becomes the only thing between you and a bad day, indefinitely.

There is an account, and accounts get phished. A convincing email about unusual activity, a login page that looks right, and the attack never touches the encryption at all. No account means no login page to imitate.

Somebody else holds something. Even if it is unreadable, there is an entity that can be compelled, acquired, or change its policies. You are trusting an organisation's future behaviour, not just its current engineering.

Recovery cuts both ways. Anything that can restore your access if you forget your master password is, by construction, a path into your vault. Good providers make this genuinely hard. It is still a door.

None of these are reasons to avoid cloud password managers. They are reasons to notice that "offline" is not paranoia, it is a different set of trade-offs.

What you actually give up

Being fair about this matters, because the offline pitch usually skips it.

Browser autofill on a computer. This is the big one. If you work at a laptop all day, a phone-only vault means typing passwords by hand, and people who type passwords by hand start choosing typeable passwords. That is a real security regression, and it is enough on its own to disqualify offline for a lot of people.

Multiple devices. A tablet, a work phone, a partner's device. Offline means one place.

Sharing. No shared family vault, no giving a colleague access to one credential.

Effortless recovery. If the phone dies and you have no backup, nobody can help you. Not the vendor, not support, nobody. That is the deal.

If two or more of those matter to you, use a syncing manager. Bitwarden's free tier is excellent and there is no honest argument for offline over it in that situation.

Who offline is genuinely right for

People whose passwords are mostly phone passwords. A large number of people barely use a computer. Banking, shopping, government services, chat — all on the phone. Sync solves a problem they do not have.

People storing documents alongside logins. Passport scans and ID photos are not really the same category as a Netflix password, and the calculus is different. A leaked password is a bad afternoon; a leaked identity document is a slow year. Plenty of people are comfortable with logins in the cloud and want documents kept off it.

People who will not maintain a system. A vault with no account has no subscription that lapses, no master password to forget after a year of biometric unlock, and no login flow to be phished through. It fails in fewer ways because it does fewer things.

People in genuinely adversarial situations. Journalists, people leaving controlling relationships, anyone with a specific reason to prefer that no third party holds anything. Not most people — but the ones it applies to, it applies to sharply.

The backup question, which is the whole thing

Every honest conversation about offline storage ends here.

Offline means single point of failure. Phones are lost, stolen, dropped, and factory-reset by repair shops who did not ask. If your vault exists only on that device, you have swapped a small ongoing risk for a large sudden one, and that is not obviously a better trade.

So an offline vault is only responsible if it exports. Specifically:

• An encrypted file you control, protected by a passphrase that is not your PIN.
• Stored somewhere separate — a computer, a USB stick, or even a cloud drive. If the file is properly encrypted with a passphrase only you hold, putting it in cloud storage is not the same act as putting your vault in the cloud. The provider holds ciphertext and no key.
• Tested. An export you have never restored is a hope, not a backup. Restore it once, on purpose, so you know it works.
• Refreshed. Annually is fine for documents. More often if you add logins regularly.

And the passphrase written down on paper, kept with your other important papers. This feels wrong to people who have absorbed "never write down a password", but that advice was about sticky notes on office monitors. A passphrase in a drawer at home defends against a completely different threat than the one that phrase was coined for.

A reasonable answer for most people

You do not have to pick one philosophy. The split that works for a lot of people is boring and effective:

Use a mainstream syncing password manager for logins. You need autofill, you need it on the laptop, and the risk of a well-run provider holding an encrypted blob of your Spotify password is small and worth the convenience.

Keep identity documents somewhere offline. Passport, ID card, licence, certificates. These change once a decade, you need them a few times a year, they do not benefit from syncing, and they are the items where a breach is genuinely painful rather than merely annoying.

That is not a compromise between two positions. It is matching the storage to the thing being stored — which is what you would do with physical documents without thinking about it. Your passport does not live in your wallet.