So, I think in-general, the answer is that for a question like this, you need to start from doing threat modelling, and work outward. Threat modelling is the first step that must be conducted, and then you can find solutions that fit your needs from that.<p>For most people, the biggest threats that come from passwords are: data breaches (compromising reused passwords), human memory limits (you can't remember high entropy passwords easily, in general), and an ever-increasing demand for both high quality passwords and unique passwords.<p>If you look at these threats from the perspective of most people, a password manager works well! You don't have to worry about breaches, memory limits, or even password generation. You can just generate-and-store random passwords for every site that meets their requirements, and walk away.<p>But that doesn't mean that that's the end of threat modeling. Other risks that you're probably thinking of are the security of the cryptosystem involved, bugs in the application, and fear of backdoors. These are valid threats, but for the vast majority of people, they're mitigated by other reasons, or are non-factors.<p>To give an example: a password manager that most cryptographers would laugh at is writing your passwords on a sticky note. Yes, that's bad from a cryptography standpoint, but if you make a new unique password for each site, and each one is sufficiently long and complex, you've actually mitigated the threats involved with password reuse, memory, and complexity. But you've also made it impossible to steal from a cryptography backdoor, and the barrier-to-compromise involves your physical space being violated. But again, if you ask a cryptographer, or even most security professionals, this is a bad idea, because you're still risking physical compromise if...you work in an office, have kids, don't guard your home, etc.<p>A lot of people dislike 1Password's decision to store passwords in cloud storage. This is a real risk, because a cryptosystem backdoor <i>would</i> create danger. If you use a password storage app with strong cryptography, and store the passwords in a completely benign location (e.g., a network share, some random cloud storage provider), you can decouple the cryptography from the storage, which brings some safety.<p>Now, back briefly to your question: why would people trust a completely SaaS password storage provider? Well, for me, it's that I know that Google Project Zero exists, and they do a lot of research into third party apps. I sleep easier at night knowing that lots of smart people are invested in trying to break 1Password's cryptography, and have thus-far been unsuccessful. Sure, a government might have a secret backdoor that I don't know about. But in my threat model, the government could just come arrest me for violating a non-disclosure agreement I've signed, and hit me with a wrench.<p>In summary: for the vast majority of people, the threats that come from "memorizing passwords" are mitigated by password managers. Heck, you even say you have your "own methods for safe handling of passwords". I would argue that you have a password manager, it's just more DIY than something off-the-shelf, and that's fine!