Password Managers: 7 Proven Checks to Find the Safest Local Vault

Introduction

Password managers solve a problem almost everyone has: too many accounts and not enough memory. Instead of reusing one password across email, banking, and social media, you remember a single strong master password and let the software create and store a unique one for every site. Security experts have recommended them for years, and for good reason. Reused passwords are one of the most common ways accounts get taken over.

But a password manager also puts all your keys in one place, so where that place lives matters. Most popular services store your encrypted vault on their servers. Local password managers such as KeePass and KeePassXC keep it on your own devices instead. That sounds safer, and in some ways it is, but it also shifts more responsibility onto you.

The risks aren’t theoretical. In 2022, attackers stole encrypted vault backups from LastPass. UK regulators later fined the company £1.2 million, and US investigators linked a $150 million cryptocurrency theft to vaults cracked after the breach. In 2025, criminals spread a fake version of KeePass through search ads and used it to launch ransomware attacks.

This review explains how local and cloud vaults differ, compares the main offline password manager options, walks through these real cases, and gives you seven checks to choose and set up a vault that protects you rather than becoming the weak point.

Local vs Cloud Password Managers: What Actually Differs

How this review was done

No software was penetration-tested for this article. The comparison draws on each project’s published security design, independent audits where they exist, publicly disclosed vulnerabilities, regulator findings, and court records. That’s how most security professionals judge password managers anyway: not by poking at the app, but by looking at its design, track record, and how quickly it fixes problems.

How cloud password managers work

Services such as Bitwarden, 1Password, LastPass, and those built into Google and Apple accounts encrypt your vault on your device and store the encrypted copy on their servers. Done properly, this is called zero-knowledge encryption: the company holds your data but can’t read it without your master password. The benefit is easy syncing across phones and computers, plus account recovery options.

The weakness is concentration. A cloud provider holds millions of vaults in one place, which makes it a very attractive target. If attackers steal those encrypted vaults, they can try to crack weak master passwords offline for as long as they like.

How local password managers work

A local password manager stores your vault as an encrypted file on your computer or phone. Nobody else holds a copy unless you choose to sync it, for example through your own cloud drive or a USB stick. There’s no central server full of vaults for criminals to target, and most popular local tools are open source, so independent experts can inspect the code.

The trade-off is responsibility. You handle backups, syncing between devices, and updates. If you lose the file and have no backup, there is no recovery. If your own computer is infected with malware, a local vault is only as safe as that device.

Which risk is right for you?

• Choose local if you’re comfortable managing files and backups, use mostly one or two devices, and prefer that no company holds your vault.
• Choose cloud if you need smooth syncing across many devices, want family sharing, or worry you might lose a local file.
• Either way, the master password, device security, and two-factor authentication matter more than the storage model.

Local Password Managers Reviewed

The KeePass vault format (.kdbx) is the common thread. A file created in KeePassXC on a laptop can be opened in KeePassDX on Android or Strongbox on an iPhone, so you aren’t locked into one app.

KeePass

KeePass is the original, created by developer Dominik Reichl and maintained for more than two decades. It was reviewed under the European Commission’s EU-FOSSA free software audit project in 2016, which found no critical issues. Its interface looks dated, and browser autofill needs plugins, which add their own risk. It’s best for people who value a long track record over polish.

One known issue: in 2023, a vulnerability (CVE-2023-32784) let someone with access to a computer’s memory dump recover most of a KeePass master password. It was fixed in version 2.54. That’s a reminder to keep even “set and forget” software updated.

KeePassXC

KeePassXC is a community-built, cross-platform app that reads and writes the same files. It has a cleaner interface, built-in browser integration, a password health report, and support for hardware keys such as YubiKey as an extra unlock factor. For most people wanting an offline password manager on a computer, it’s the sensible default.

KeePassDX and Strongbox

These bring KeePass files to phones. KeePassDX is a free, open-source Android app with fingerprint unlock and autofill. Strongbox is the popular choice on Apple devices, with Face ID unlock and system-wide autofill. Both can open a vault file you sync through a cloud drive you already use, so the encrypted file travels, but the decryption happens only on your device.

Self-hosted Bitwarden (Vaultwarden)

Bitwarden is open source, and its server can be self-hosted. Vaultwarden is a lightweight, unofficial server many hobbyists run at home. This gives you Bitwarden’s polished apps without your vault sitting on a company’s servers. It’s powerful but only safe if you keep the server patched, backed up, and properly secured. For most people, that’s more work than it’s worth.

What about built-in browser and phone managers?

Google Password Manager and Apple’s Passwords app are convenient and much better than reusing passwords. They’re cloud-synced, though, and tied to your Google or Apple account, so that account’s security, especially two-factor authentication, becomes critical.

7 Proven Security Checks for Password Managers

Use these checks on any tool, local or cloud. Each one comes from a real failure described later in this article.

1. Is the code open or independently audited?

Open-source password managers let anyone inspect how encryption is done, and serious projects publish independent audit results. Closed-source tools can still be safe, but look for recent third-party audits and a public process for reporting security bugs.

2. How strong is the encryption and key stretching?

The vault should use well-known encryption (such as AES-256 or ChaCha20) and, just as important, a slow “key derivation function” such as Argon2 or PBKDF2 with a high iteration count. This makes each guess at your master password expensive, which is exactly what protects a stolen vault from cracking. The LastPass case showed that older accounts with low iteration settings were easier targets.

3. Does it encrypt everything, including website addresses?

Some services have left website URLs unencrypted, which lets attackers see which accounts are worth targeting. Check that the whole vault, including metadata, is encrypted.

4. Can you add a second factor?

For cloud services, enable two-factor authentication on the account. For local vaults, KeePassXC and others support a key file or a hardware key alongside the master password, so a stolen vault file alone isn’t enough.

5. Are you downloading the real thing?

Only install from the official website, typed in directly, or from the official app store. Never click a sponsored search ad to download security software. The 2025 fake KeePass campaign relied entirely on people trusting ads.

6. How fast are security fixes released?

Look at the project’s update history. Regular releases and quick fixes for reported vulnerabilities are a good sign. Software that hasn’t been updated in years is a red flag.

7. What happens if you lose access?

With a local vault, have at least two backups in different places. With a cloud service, set up recovery options and store emergency codes offline. Losing access to your vault can be as damaging as having it stolen.

Real Cases: When Password Managers Become Targets

LastPass: stolen vaults, a regulatory fine, and crypto thefts

In August 2022, an attacker compromised a LastPass software developer’s laptop and stole source code and technical information. Using that, and by later targeting a senior engineer’s home computer, the attacker obtained keys that unlocked LastPass’s cloud backups, including copies of customers’ encrypted password vaults and unencrypted data such as website addresses.

The vaults were still encrypted with each user’s master password. But encrypted vaults can be attacked offline indefinitely, and weak master passwords eventually give way. In March 2025, US authorities seized more than $23 million in cryptocurrency linked to the January 2024 theft of about $150 million from a Ripple co-founder’s wallet. Court filings said Secret Service agents believed the attackers obtained the private keys by cracking vault data stolen in the 2022 breach, and found no sign of phishing or malware on the victims’ devices, as reported by BleepingComputer’s coverage of the thefts traced to the LastPass breach. Blockchain analysts have tied further thefts to the same campaign.

In December 2025, the UK Information Commissioner’s Office fined LastPass UK £1.2 million for failing to have sufficiently robust security measures, after a breach affecting up to 1.6 million UK users, as covered in Infosecurity Magazine’s report on the ICO fine. LastPass also settled a US class action.

Lessons: a long, unique master password is your real protection if a vault is ever stolen. Never store cryptocurrency seed phrases or private keys in an online vault; use a hardware wallet or offline storage instead.

The fake KeePass that launched ransomware

In May 2025, security firm WithSecure reported that criminals had modified KeePass’s open-source code to build a trojanized version called KeeLoader. It looked and worked exactly like KeePass, but secretly installed a remote-access backdoor and exported users’ password databases in readable form. The fake installer was signed with legitimate certificates and promoted through Bing search ads that led to lookalike domains such as keeppaswrd[.]com and keegass[.]com.

WithSecure discovered it while investigating a ransomware attack on a European IT provider whose VMware servers had been encrypted. Researchers linked the infrastructure to an initial access broker associated with major ransomware groups.

Lessons: open source doesn’t protect you if you download a doctored copy. Type the official address yourself, and verify downloads where the project publishes checksums or signatures.

When the update itself is the attack

In April 2021, Click Studios, maker of the business password manager Passwordstate, warned customers that attackers had compromised its update system and pushed a malicious update that harvested stored credentials. It’s a reminder that even trusted update channels can be abused, which is why monitoring vendor security notices matters.

Credential stuffing: the attack password managers prevent

Most account takeovers don’t involve breaking encryption at all. Criminals take username and password pairs leaked from one site and try them on others, an attack called credential stuffing. It works only because people reuse passwords. Using any reputable password manager to create unique passwords for each site shuts this down almost completely.

Setting Up Local Password Managers Safely

Step-by-step setup for a local vault

1. Download from the official site only. Type keepassxc.org or keepass.info yourself, or use your phone’s official app store. Skip search ads entirely.
2. Create a strong master password. Use a passphrase of five or six random words, at least 20 characters long, that you’ve never used anywhere else. Write it down once and keep it somewhere physically secure until you’ve memorised it.
3. Add a second factor. Use a key file stored separately from the vault, or a hardware key if your app supports one.
4. Raise the key derivation settings. In KeePassXC, choose Argon2 and set the unlock delay to about one second. That makes each cracking attempt costly.
5. Set up backups. Keep at least one copy on an external drive and one in a different place, such as a cloud drive. The vault file is encrypted, so storing a copy in the cloud is reasonable as long as your master password is strong.
6. Sync carefully. If you use the vault on a phone too, sync the file through a cloud drive and avoid editing on two devices at once, which can create conflicting copies.
7. Move your passwords gradually. Start with email and banking, then change reused passwords site by site as you log in.
8. Keep everything updated, both the password manager and your operating system.

Habits that matter as much as the app

• Protect your email account with two-factor authentication, since it can reset almost every other password.
• Use passkeys where sites offer them. They can’t be phished or reused.
• Lock your vault automatically after a few minutes of inactivity.
• Never type your master password on a shared or public computer.
• Store crypto seed phrases offline, not in any password manager.

The Ethical Side of Password Managers

Responsibility shifts, it doesn’t disappear

Cloud companies are responsible for protecting the vaults they hold, and regulators have shown they will act when they fall short. But users carry responsibility too. A weak master password protecting a vault full of other people’s information, such as shared family logins or client accounts, puts more than just you at risk.

Respect other people’s accounts

A password manager may hold passwords for a spouse, parent, or former colleague. Holding a password isn’t the same as having permission to use it. Accessing someone else’s account without their consent is illegal in many countries, including under Pakistan’s PECA 2016, and it’s a breach of trust. Remove shared credentials when relationships or jobs end.

Plan for emergencies honestly

If something happens to you, can your family access important accounts? Many cloud services offer emergency access features. For local vaults, consider leaving sealed instructions with a trusted person. Planning for this is part of using a password manager responsibly.

Report, don’t exploit

If you find a vulnerability in any password manager, report it through the vendor’s security disclosure process. The security community depends on responsible disclosure, which is how flaws like the 2023 KeePass memory issue get fixed before criminals can use them widely.

Conclusion

Password managers remain one of the best security upgrades anyone can make, and local vaults like KeePassXC, KeePassDX, and Strongbox offer a strong option for people who would rather no company holds their encrypted passwords, at the cost of handling backups, syncing, and updates themselves. The real-world record shows where the danger lies: the LastPass breach proved that stolen cloud vaults can be cracked years later when master passwords are weak, leading to a £1.2 million UK fine and cryptocurrency thefts that US investigators traced to cracked vaults, while the fake KeePass campaign showed that even trusted open-source tools become dangerous when downloaded from a sponsored ad. Whichever type you choose, download only from official sources, use a long and unique master password with a second factor, keep strong key-derivation settings and regular backups, store crypto keys offline, and respect the other people whose credentials you hold.