[geertj]

Exactly. By default Bluepass uses a long password as well to protect the local database. However, you can opt to choose a shorter password, or no password at all. In this case you are still protected by:

* The physical security of your device. Unless someone gets access to your device, you are safe.

* The fact that the sync traffic goes over your local network only.

* Even if someone managed to sniff your local traffic, all synchronization requests are encrypted by each node's unique 2048-bit RSA key. No dictionary attack is possible - you'd have to break RSA.