Local vs cloud password managers: what actually changes

"Local" and "cloud" are usually argued as if one is safe and the other is reckless. Neither is true. They move risk around. Some threats get much smaller when your vault never leaves your machine, some get bigger, and a surprising number do not change at all.

Here is the comparison threat by threat, including the ones where local storage buys you nothing. Buddy is a local password manager, so read this with the appropriate suspicion and check the claims against your own situation.

First, what both designs have in common

Every mainstream password manager encrypts your vault with a key derived from your master password, and the vendor cannot read your data. The reputable cloud managers are not storing your passwords in plaintext on a server. Arguments that assume otherwise are attacking something nobody is selling.

The real difference is narrower and worth stating precisely: where the encrypted file lives, and how many systems have to keep working for you to use it.

Threats where local storage genuinely helps

The vendor gets breached

A cloud manager holds millions of encrypted vaults in one place. That concentration is what makes it worth attacking. When such a service is breached, the attacker gets encrypted vaults and whatever metadata the service kept alongside them, and then has unlimited offline time to attack the weakest master passwords in the set.

A local vault is not in that set. There is no server holding a copy, so there is no single event that exposes it along with everyone else's. Your vault gets attacked only if someone specifically goes after you.

The vendor changes, or disappears

Pricing changes, acquisitions, feature removals, and shutdowns all become your problem when the vault only exists on their infrastructure. With a local file plus a documented format, the company's decisions affect the software you run, not the data you already have.

Legal process and jurisdiction

A company holding your encrypted vault can be compelled to hand over what it has, and can be compelled to say nothing about it. It cannot hand over what it never received. This mostly matters for metadata: account identity, IP addresses, device lists, and access times.

Account recovery as an attack surface

Any service that lets people regain access after forgetting a password has built a mechanism for granting access to someone who cannot supply the password. That mechanism is a target, and it gets attacked through support staff as often as through code. A local vault with no account has no such mechanism, which is exactly why forgetting your master password is unrecoverable.

Threats where cloud storage helps

Losing the only copy

This is the biggest real-world risk of local storage, and it is not close. A hosted vault is backed up by people whose job that is. A local vault is backed up by you.

If you keep a local vault, set up automatic encrypted backups to a second location on day one. Buddy writes encrypted backups to any folder you choose, so pointing that at a folder your cloud drive already syncs gives you off-machine copies without the provider ever holding a readable vault. What syncs is ciphertext.

Getting the same passwords on your phone

Cloud managers solve this well. Local managers solve it badly or not at all. Buddy has no mobile app, so if you need passwords on a phone regularly, a cloud manager is the better tool and this is not a close call either.

Sharing with other people

Family and team sharing needs a coordination point. Cloud services have one. Local vaults do not, and the workarounds are worse than the real feature.

Device compromise, partially

If your laptop is stolen while powered off, both designs are fine: the attacker has an encrypted file either way. But a cloud service can also revoke a device's session, and can show you where your account has been used. Local software has nothing to revoke, which cuts both ways.

Threats where the choice changes nothing

These are the ones that matter most in practice, and they are identical in both models:

• Malware on your computer. If something is running as you while your vault is unlocked, it can read what you read. Where the file is stored is irrelevant.
• A keylogger. Your master password gets captured as you type it, in both designs.
• Phishing. You type a real password into a fake site. Autofill that matches on the URL helps here, and both models have it.
• A weak master password. A slow KDF raises the cost per guess, but a password already in a breach corpus falls regardless of architecture.
• Someone with your unlocked machine. Auto-lock timers and biometric re-prompts are the defense, and both models have those too.

It is worth sitting with that list, because it is most of the realistic risk for an ordinary person. The storage argument is real, but it is not the argument that decides whether your passwords stay yours. Using a manager at all, with unique generated passwords and a strong master password, is the decision that does most of the work.

A summary you can act on

Concern	Local vault	Hosted vault
Vendor breach exposes your vault	No copy exists to expose	Encrypted copy is in the breach set
Vendor shuts down	File and format stay usable	Depends on your saved export
You lose the device	Your backups are the only recovery	Provider restores it
Passwords on a phone	Poor to nonexistent	Solved
Sharing with family	Not supported	Solved
Forgotten master password	Unrecoverable	Sometimes recoverable, which is also a risk
Malware, keyloggers, phishing	No meaningful difference

How to choose

Pick a local manager if you work mainly on one or two desktop machines, you are willing to own your backups, and you would rather not have your vault sitting in a database that is worth attacking. Pick a cloud manager if you need your passwords on a phone, you share with family or colleagues, or you know from experience that you will not maintain a backup routine.

Choosing the second one is a reasonable answer. A cloud manager you actually use beats a local one you abandon because it does not fit how you work.

If the first description fits, Buddy is built for exactly that case, with the tradeoffs stated plainly on the homepage. The encryption is documented in how Buddy encrypts your vault, and the backup question is worth settling before you commit to any local tool.