> You can't get more security by trusting more intermediaries with your passwords. I would agree, were it not for the fact that every worthwhile password manag

> You can't get more security by trusting more intermediaries with your passwords. I would agree, were it not for the fact that every worthwhile password manager never sends your passwords to any intermediary. There is of course some risk related to the strength of the encryption, software updates/supply chain attacks, client backdoors, etc; however, in most scenarios that is far outweighed by the additional security on a "link in the chain" which is much more likely to be attacked (better credentials - higher entropy, better rotation, and so on). > The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious. You're right, it is obvious, that's why those entities don't have access to them! > Why not just remember your passwords? There is an infinite number of strategies and secret rules which you can use to easily remember your passwords. That is incredibly low entropy. This will likely prevent you from falling victim to a simple dictionary or credential-stuffing attack, but not much else. > Or for low-importance services, why not just use your browser's built-in password manager? You have to trust the browser maker anyway. Well, that IS a password manager. And as to why not use it, because in an enterprise environment you should probably have automatic/encrypted/signed sharing, as well as logs of who accessed a password, who modified a password, etc. By the way, I just want to point out that your "password manager" could be "rot13 and write it down in a notebook and put it in a locked cabinet". Or it could be "put it in a text file and GPG-encrypt it". There are plenty of options available which don't involve even trusting the code of any third-party.