Local vs cloud password managers, threat by threat

Local and cloud password managers get argued about as if one were safe and the other reckless. Both move risk around rather than removing it.

What both designs share

Every mainstream password manager encrypts the vault with a key derived from the master password, and the vendor cannot read it. The reputable cloud managers do not keep passwords in plaintext on a server, and arguments that assume they do are attacking something nobody sells. Our own scheme is written up in the security model, and it is in the same class as theirs.

The real difference is narrower: where the encrypted file lives, and how many systems have to keep working before its owner can open it.

Where local storage helps

The clearest case is a breach at the vendor. A cloud manager holds millions of encrypted vaults in one place, which is what makes it a target, and a successful attacker leaves with all of them plus whatever metadata sat alongside. From then on they have unlimited offline time against the weakest master passwords in the set. A local vault is not in that set. It gets attacked only if someone goes after its owner specifically.

The vendor itself is the second case. Price rises, acquisitions, removed features and shutdowns all land on customers whose vaults exist only on the company's infrastructure. With a local file in a documented format, a company's decisions reach the software, not the data already on disk. That applies to us as much as anyone.

Legal process is a quieter version of the same thing. A company holding encrypted vaults can be compelled to hand over what it has, and to say nothing about it. It cannot hand over what it never received. In practice this matters most for metadata: account identity, IP addresses, device lists and access times.

Then there is account recovery. Any service that lets people back in after a forgotten password has built a way to grant access to someone who cannot supply the password, and that mechanism gets attacked through support staff as often as through code. Buddy has no account, so it has no such mechanism. That is also why we cannot recover a forgotten master password, even when asked.

Where cloud storage helps

Losing the only copy is the biggest risk of local storage by a wide margin. A hosted vault is backed up by people whose job that is. A local vault is backed up by its owner, or not at all. It is the weak point of our own design, which is why Buddy writes encrypted backups on a schedule to any folder, including one a cloud drive already syncs. What syncs is ciphertext.

Phones come next. Cloud managers put the same vault on a laptop and a phone with no effort. Buddy has no mobile app, and for anyone who needs passwords on a phone regularly, a cloud manager is the better tool.

Sharing needs a coordination point too. Family and team vaults work because a server sits between the members. Local vaults have nothing in that position, and the workarounds are worse than the real feature.

Device theft is split. A laptop stolen while powered off holds an encrypted file under either design. A cloud service can also revoke the lost device's session and show where the account has been used, and local software has nothing to revoke.

Where it makes no difference

For most people these are the risks that matter, and they are the same under both designs:

• Malware. Anything running as the user while the vault is unlocked can read what the user reads. Where the file is stored is irrelevant.
• A keylogger captures the master password as it is typed, in both designs.
• Phishing gets a real password typed into a fake site. Autofill that matches on the URL helps, and both models have it.
• A weak master password. A slow KDF raises the cost per guess, but a password already in a breach corpus falls regardless of architecture.
• Someone at an unlocked machine. Auto-lock timers and biometric re-prompts are the defense, and both models have those too.

Using a manager at all, with unique generated passwords and a strong master password, protects more than the choice of where the file lives.

How to choose

Pick a local manager if you work mainly on one or two desktop machines, you are willing to own your backups, and you would rather keep your vault out of a database that attracts attackers. Pick a cloud manager if you need passwords on a phone, you share with family or colleagues, or you know from experience that a backup routine will not last.

Concern	Local vault	Hosted vault
Vendor breach	No copy exists to expose	Encrypted copy is in the breach set
Vendor shuts down	File and format stay usable	Depends on a saved export
Device lost	Backups are the only recovery	Provider restores it
Passwords on a phone	Poor to nonexistent	Solved
Sharing with family	Not supported	Solved
Forgotten master password	Unrecoverable	Sometimes recoverable, which is also a risk
Malware, keyloggers, phishing	No meaningful difference

Choosing the cloud is a reasonable answer. A manager you use beats one you abandon because it does not fit how you work.

If the local description fits, that is the case Buddy is built for, and its limits are listed on the pricing page. If we have a threat wrong or missing, tell us.