Intermediate · 7 minute read
Password Manager Models: Storage, Synchronization, and Store-less Generation
A comparison of local and synchronized vaults with systems that derive site-specific passwords without conventional storage.
Password managers do not all follow the same model. A local tool may offer optional synchronization, while a cloud-connected product may encrypt data on the endpoint before uploading it.
It is more useful to examine the secret-management model: Is there a vault? Where is it stored? How does a new device gain the ability to decrypt it?
1. Local vaults
An encrypted vault is stored on a device controlled by the user. After the user unlocks it, the manager temporarily decrypts the requested credential and fills it into the sign-in flow.
Advantages
- It can work without a network connection.
- The user directly controls the file and backups.
- No centralized synchronization service is required.
Challenges
- Losing or damaging the device can mean losing the vault without a backup.
- Malware on an unlocked device may capture credentials.
- Moving the vault between devices becomes the user’s responsibility.
KeePass is a familiar local-vault example. Managers built into operating systems and browsers often combine device storage with synchronization options.
2. Synchronized vaults
The vault is encrypted and synchronized through a service so that several devices can use it. This is convenient: changes reach the phone and computer, and a new device can be approved through a defined workflow.
Synchronization introduces important questions:
- Can the provider decrypt the vault?
- What does an attacker gain if an encrypted copy leaks?
- How are encryption keys derived from the primary secret?
- Is new-device enrollment protected by a strong factor?
- What are the recovery boundaries, and who can invoke them?
A server breach does not automatically reveal passwords when the design is strong. It may, however, give an attacker encrypted material to test offline—especially when the primary secret is weak.
3. Deterministic or store-less managers
Instead of retaining every site password, these systems derive a site-specific credential from a primary secret, the domain, and other parameters. Research examples include PwdHash, Password Multiplier, and newer designs such as HIPPO.
Why is this attractive? There is no conventional vault containing every password, and the credential can be re-derived when needed.
What is the tradeoff? The system must handle password-policy differences, changing one site’s password, look-alike domains, and parameter synchronization across devices. If the primary secret or user key is exposed, an attacker may be able to derive many credentials.
No category is automatically best
Local vaults provide direct control but require reliable backups. Synchronized vaults improve availability but expand the attack surface. Store-less derivation removes a central vault while moving complexity into compatibility, rotation, and recovery.
The right choice depends on encryption, recovery, endpoint security, and everyday usability—not storage location alone.
Takeaway
Before choosing a manager, ask: What is stored? Where? Who can decrypt it? How can I recover it? What happens if I lose the device or expose the primary secret? Those questions reveal the real security model more reliably than the labels “local” or “cloud.”