[herbst]

Not OP but open for a chance. Last time I checked the popular password managers saved the passwords in one way or another. Which personally simply sounds like a bad idea to begin with.

Even if in theorie they are safe. Even the slight chance that a single failure could lead to all my passwords getting in the wrong hands at once just is to scary.

[mercer]

How do you propose one memorizes a properly random/secure/long password, let alone multiple ones, without trusting 'something' with it, whether a password manager of good repute, a hand-rolled version with potentially bigger security issues, or a piece of paper somewhere?

[c22]

I've memorized multiple long passwords, and routinely memorize new ones. Also phone numbers, poems, mailing addresses, digits of pi, etc. It's not really that challenging. Especially if you do it often.

[zaphirplane]

Your password doesn’t need be a long random string, just a long unguessable one and safe from dictionary attacks Ilikeapples! Is fine But You know I’m not a security researcher

[amingilani]

They do, but that's not such a bad idea. For an exhaustive read, I wrote this[1] a while back, but I'll try to make the point here too:

1. Are all your passwords unique?

2. If I discovered some of your passwords, will the rest of your passwords stay secure?

3. Were all your passwords created using at least 32 bits of entropy?

4. Are your passwords stored only in encrypted form?

5. Do you perfectly remember every single password you’ve used when signing up?

6. Do you turn up positive for a password leak at this website?

If you answer "no" to any of these questions, you'll benefit from a password manager.

About storing passwords, I use LastPass and they use client-side encryption[1], which means even they don't have the decryption key to read my passwords. So, you'll be fine as long as you have a secure passphrase and 2FA :)

https://lastpass.com/support.php?cmd=showfaq&id=6926

[1]: Please skip to "Strategy No. 1: Proper Password Management" @ https://www.toptal.com/remote/best-security-practices-for-re...

[icebraining]

So, you'll be fine as long as you have a secure passphrase and 2FA :)

And nobody hacks into your machine...

[amingilani]

Ofcourse, but at that point it doesn't matter what method of password management you're using. It's too late.

[asdsa5325]

Password managers use client side encryption. They are not stored unencrypted on the manager's servers.

[Angostura]

I must admit, I use Apple’s Keychain, I wouldn’t trust a third party app.

[chopin]

Do you have citations for this? AFAIK state of the art is to put the password through some password stretching algorithm (like PKBDF) and to encrypt the database with that. No need to store the password. I think NaCL offers out-of-the-box support for this.

EDITED to add: I am using Password Safe which is recommended by Bruce Schneier. What you describe would be an absolute noob mistake. He would be pretty embarrassed if you were right.

[icebraining]

I think herbst is saying that password managers store the passwords being managed, not the master password used to encrypt the DB.