Or you don't host it but just keep it tight to your chest. No risk of any server being compromised then. Professional companies that care about security (I do

Or you don't host it but just keep it tight to your chest. No risk of any server being compromised then. Professional companies that care about security (I do IT security consulting so that's the group I deal with the most) are not perfectly secure. I'd argue that it's less likely that a password database is abused when hosted on a random average-security system (assuming the person is not being targeted, like if you're not a public figure or have a stalker) than if you've got it hosted with some bigcorp that has a huge target painted on their back. Some are really good at security and others a bit less, but none are perfect, and scale dictates compromises between security and usability. Not everyone in the firm will be a security expert, and much as you try to isolate the vaults / source code / other security-relevant systems from them, they're how ransomware and other groups gain a foothold to work with. I wouldn't trust my mom to set up a server secure enough for a password manager to be hosted on, but if you are comfortable around servers at all and follow normal guidelines, or use normal syncing software that is only encrypted to the server (so you pick and rely on a strong password for your vault file), you're more secure than when you use a third party and type that password into their website (even if, on a good day, the key stays local in your browser).