1Password isn't a web-based password manager, it's an offline one that has a syncing component. Syncing is traditionally done either over WiFi (so no exposure t

1Password isn't a web-based password manager, it's an offline one that has a syncing component. Syncing is traditionally done either over WiFi (so no exposure to attackers), Dropbox, or iCloud. More recently 1Password now has an optional subscription model that gets you syncing + all updates to the app on all platforms. But the new built-in syncing uses a separate Account Key, which you provide along with your master password the first time you set up syncing on a particular device, and then you never use the account key again (until you have to set up a new device). This means you can store the account key in whatever secure manner you want without needing ease-of-access, and it means you won't ever accidentally type your account key into the wrong place and expose it to an attacker. So basically, if you use 1Password's built-in syncing, the attacker has to compromise your machine to get at your vault, just as they would have to do if you didn't do any syncing at all. If you use a third-party service for syncing (e.g. Dropbox, iCloud) they have to compromise that service. And of course in both cases they still need your 1Password master password.