A cloud password manager adds a dependency on a provider’s infrastructure, but that does not automatically mean the provider can read the vault. Some providers document end-to-end encryption performed on the device. The risks to assess are the encryption model, master account protection, authorised devices, recovery, and service availability.
The benefit and trade-off of a cloud vault
A password manager helps people create and use unique passwords without memorising or reusing them. The UK NCSC considers the benefits of password managers to outweigh their risks, while advising organisations to assess products against their needs and use.
In a cloud model, the encrypted vault is stored and synced through the provider’s infrastructure. Bitwarden and 1Password state that data is encrypted on the device before synchronisation and that their services do not have the keys to read the vault. These assurances depend on the specific service and architecture; do not assume every product offers the same model.
Risks worth checking
The master account. A vault brings important credentials together. Protect its account with a unique master password and any additional factors the provider offers. A compromised account or an already-unlocked device may expose secrets even when cloud storage is encrypted.
The service and its availability. Synchronisation relies on the provider’s infrastructure and account access. Check how export, recovery, and offline access work. If an export creates a decrypted file, treat it as a secret and remove temporary copies when finished.
Devices and account data. Vault encryption does not by itself secure an infected device, an open session, or account and diagnostic information handled outside the vault. Review what the provider says it collects and protect each device you use.
For a decision framework, read our local vs cloud comparison and password manager security audit guide.
What local-first changes
Soclyde does not store the vault in a central cloud operated by Soclyde. The encrypted vault stays on authorised devices; direct synchronisation between them is a Premium feature. This reduces reliance on a Soclyde server to store the vault, but does not remove risks from a lost or compromised device or the need for backups.
If you are considering a switch, follow our guide to moving from a cloud manager to local-first storage. The key is to choose a manager whose controls, recovery options, and responsibilities fit how you work.
