Your passwords can live in a provider's cloud or in a file you control. Each choice shifts the risk around. This comparison belongs to our password managers guide.
The trade-off in one table
| Question | Cloud manager | Offline manager |
|---|---|---|
| Where the vault lives | Encrypted on provider's servers and your devices | A file on your devices |
| Sync | Automatic | You set it up |
| Backups | Largely handled | Your job |
| Sharing | Easy | Awkward |
| Provider breach | Vault may be copied | Not applicable |
| Lost device | Sign in on a new one | Need your own backup |
| Skill needed | Low | Moderate |
The case for the cloud
Cloud managers work everywhere with no effort. For most people, that is what keeps them using one. The vault is encrypted before upload, as covered in how password managers work, so a provider breach is serious but survivable with a strong master password.
The case for offline
An offline tool, such as KeePassXC, keeps your vault out of any company's central database. Nobody can lock you out by closing an account, and a big target's breach does not touch you. It suits people who are comfortable managing files.
The hidden risk: losing the file
The classic offline failure is a single vault file on a laptop that dies. If you go offline, you need:
- At least two backup copies, with one away from home.
- A routine for copying changes between devices.
- A test now and then to prove that a backup opens.
Read more about backups for your password vault.
What about self-hosting?
Some tools let you run the server yourself. That gives you control, but also makes you responsible for updates, backups and uptime. It is rarely the right choice unless you already run servers.
Which should you choose?
- Most people: a reputable cloud manager.
- People who want full control and accept the work: an offline manager.
- Unsure: start in the cloud. You can move later by switching managers safely.
Neither option is a good place for a crypto recovery phrase, which should stay off your devices altogether.