Every password manager is built on one of three foundations: a cloud service that syncs an encrypted vault for you, a local file that never leaves hardware you control, or an ecosystem tool baked into the platform account you already have. Here is the short answer: for most people, a cloud-based manager such as Bitwarden or Proton Pass is the right default. You get automatic sync across every device, end-to-end encryption that keeps even the provider locked out, and sensible recovery options — with far less maintenance than the other models demand.
The other two models win in specific situations. Choose a local-first manager like KeePassXC if you want your vault to exist only on hardware you control and you are comfortable handling sync and backups yourself. Choose an ecosystem manager — the password tools built into Apple, Google, or Microsoft accounts — only if every device you own lives inside one ecosystem and you expect that to stay true.
Key takeaways
- Cloud managers sync automatically and encrypt your vault end to end, so the provider stores it but cannot read it. This is the best default for most people.
- Local managers keep the vault in an encrypted file on your device. Maximum control — but syncing and backing it up is your job.
- Ecosystem managers from Apple, Google, or Microsoft are free and frictionless, until the day you buy a device from a different ecosystem.
- All three models can be genuinely secure. The real trade-off is convenience versus control versus portability.
- Whichever you choose, confirm it can export your data in a standard format. A model choice should never be a life sentence.
The three models at a glance
| Model | How syncing works | What you manage | Typical examples | Best for |
|---|---|---|---|---|
| Cloud | Provider syncs the encrypted vault | One master password | Bitwarden, 1Password, Proton Pass | Most people, mixed-device households |
| Local | You move or sync the vault file yourself | The file, sync, and backups | KeePassXC | Full-control users, offline workflows |
| Ecosystem | Your platform account syncs it | The platform account | Apple Passwords, Google Password Manager | People fully inside one ecosystem |
Cloud managers: convenience without giving up encryption
A cloud password manager stores your vault on the provider's servers and syncs it to every device you sign in from. What makes this acceptable is end-to-end (often called zero-knowledge) encryption: the vault is encrypted on your device before it is uploaded, using a key derived from your master password. The provider holds ciphertext it cannot open.
That architecture is why reputable cloud managers hold up under scrutiny. Even if servers were compromised, an attacker would still face a wall of individually encrypted vaults. Your master password never leaves your device — which also means the provider usually cannot reset it for you, so treat recovery codes seriously.
The practical strengths are hard to beat. New phone? Sign in and everything is there. Family sharing, breach monitoring, passkey support, and browser autofill tend to be more polished here than in any other model. Pricing models range from genuinely useful free tiers (Bitwarden and Proton Pass both offer one) to subscription-only products like 1Password — check the official site for current pricing.
Within this model, the meaningful differences are open source versus proprietary, audit history, and platform coverage — the criteria we score in our methodology. If you are weighing the two most common finalists, our Bitwarden vs 1Password comparison walks through the details.
Local managers: your vault, your hardware, your responsibility
A local-first manager like KeePassXC (open source) stores everything in a single encrypted database file on your machine. There is no account, no server, and no company sitting between you and your passwords. Nothing syncs unless you sync it.
That is precisely the appeal. Your vault cannot sit in anyone else's data center, cannot be affected by a provider outage, and works completely offline. The database format is open and supported by compatible apps on all major platforms, so you are never locked into a single client.
The cost is operational. Using the vault on both a laptop and a phone means moving the file yourself — typically through a file-sync service you control. Backups are also entirely on you: lose the file and the password protecting it, and no support team can help. Autofill and passkey workflows generally take more setup than their cloud rivals.
This model rewards people who enjoy owning the whole stack. If that sounds like you, our Bitwarden vs KeePassXC comparison captures the cloud-versus-local decision in its purest form. Bitwarden also blurs the line: it is a cloud product that can be self-hosted on your own server.
Ecosystem managers: free, invisible, and sticky
Apple Passwords, Google Password Manager, and the credential tools built into Microsoft Edge are the managers most people already use without ever deciding to. They come free with the platform, sync through your existing account, and autofill with almost zero friction on their home turf.
For a single-ecosystem household, that is a legitimately good deal — and far better than reusing passwords. The security engineering behind these tools is serious.
The catch is reach. Ecosystem managers work best, and sometimes only, inside their own walls. Apple's tools have limited presence on Android; Google's are weakest outside Chrome and Android. Cross-ecosystem support exists in places, but it tends to feel like a guest pass rather than citizenship. And because the vault is tied to your platform account, that account becomes an even bigger single point of failure than it already was.
Advanced features are thinner, too: secure sharing, custom fields, attachments, and detailed audit reports usually trail the dedicated apps.
How to decide
Choose cloud if you use devices from more than one ecosystem, share credentials with family or a team, or simply want the strongest feature set for the least effort. It is the default for a reason.
Choose local if you want zero third-party involvement, you already run your own sync and backup tooling, and you accept that recovery is entirely your responsibility.
Choose ecosystem if literally every device you use comes from one vendor, you want zero cost and zero setup, and your needs stop at logins and passkeys.
And remember the escape hatch: every serious manager can export to a standard format, and most can import from each other. Starting with the built-in option and graduating to a dedicated app later is a perfectly reasonable path.
Whichever model you land on, using any password manager consistently matters far more than choosing the perfect one. Features and pricing change — always check the official site before deciding, and see our best password managers roundup for current, security-scored picks.
Frequently asked questions
Is a cloud password manager safe if the provider gets hacked?
With a properly designed end-to-end encrypted manager, a server breach exposes encrypted vaults, not usable passwords. The realistic risks concentrate on your end: a weak master password or a compromised device. Pick a long, unique master password and enable two-factor authentication on the manager itself.
Can I use a local manager like KeePassXC on my phone and laptop?
Yes, but you handle the plumbing. The database file format is supported by compatible apps on all major platforms, and people commonly sync the file through a self-hosted drive or a sync service of their choosing. It works well — it just never becomes fully automatic.
Can I mix models?
Absolutely, and many people should. A common setup is an ecosystem manager for low-stakes logins plus a dedicated manager for everything important — or a cloud manager day to day with a local, offline vault for critical recovery codes. The privacy essentials mindset applies here: match the tool to the sensitivity of the data.
What is the main downside of an ecosystem password manager?
Reach: ecosystem managers work best, and sometimes only, inside their own walls, so they stop being convenient the moment you buy a device from a different vendor. Apple's tools have limited presence on Android, and Google's are weakest outside Chrome and Android. Advanced features such as secure sharing, custom fields, attachments, and detailed audit reports also usually trail the dedicated apps.