I'm not entirely comfortable with online password managers either.<p>For company use, I do use online password managers (1password), as they generally offer a good UX experience for less technical users, and there isn't strong rationale to believe companies focussed on password storage/transfer have bad practices in place. I also place some of my passwords in these password managers, generally passwords that don't do high amounts of damage if compromised.<p>Totally given the choice for a technical team, as many others have pointed to, I like pass or gopass as a team password mechanism, synchronizing passwords over git which is encrypted locally.<p>I'm pretty sure my reluctance or hesitation around cloud password managers stem from, it's hard to know who to trust. Companies pretty much universally have poor practices, missing controls, and will miss-represent or be susceptible to internal dogma about how good the tools and practices are. Allowing online sync of passwords increases the surface area, more things have to be perfect to prevent a compromise than non-online systems.<p>The really difficult part though, is it doesn't mean the cloud based manager is actually less secure than a more traditional app, a decent amount of the surface area of both applications intersect. Think of things like a compromise of the build server, unless you're running the app totally isolated from the internet, both online and offline apps can get compromised in the same way, and pick you're favourite offline app may have higher risk then pick your favourite cloud app based on internal controls that aren't talked about.<p>So with this in mind, for me it comes down to making a choice of trust on very imperfect information, only really with the public history of a vendor and how they present themselves externally. So given that imperfect information, I tend to place a higher weight on solutions with less surface area, there are less pieces for the vendor to get perfect to protect the system. And even with online password managers, I never install the browser autofill extensions, again to limit surface area.<p>That said, with password handling the choice of password manager and how it operates is also likely a smaller concern. As in most companies have bad password rotation practices when say an employee quits, or their laptop is compromised, etc. It would be cool to see a standard protocol for a password manager to be able to go in and rotate passwords automagically, and continue to see progress towards SSO and U2F/FIDO2 security keys universal adoption.