I encourage you to think critically about this and re-evaluate your decision. I would say that for at least 99.99% of people a password manager is significantly more secure overall.
Browser-integrated password managers will avoid filling your password into the wrong site. This is a great barrier to phishing.
Allows a unique password per-site which greatly mitigates the problem of password leaks which are fairly common.
Allows you to use much stronger passwords than you can memorize.
It’s quite convenient to just click “login”.
For most people phishing is a far bigger risk than some malware stealing their local password databases. To make database theft even less of a concern most password managers have the option to encrypt the local database file. This means that to steal your passwords the malware will need to extract the encryption key from the password manager process which can often be configured to forget the key quickly after the last use.
Also consider that if you have malware that can steal your password database and the encryption key it can probably just keylog all your passwords or steal your browser’s cookie jar. So the extra barrier here is minimal.
I think you are right to be suspicious of having a vault of passwords “ready to steal” but in practice the upsides far outweigh the downsides, especially if you make a security-focused choice of password manager.
I encourage you to think critically about this and re-evaluate your decision. I would say that for at least 99.99% of people a password manager is significantly more secure overall.
For most people phishing is a far bigger risk than some malware stealing their local password databases. To make database theft even less of a concern most password managers have the option to encrypt the local database file. This means that to steal your passwords the malware will need to extract the encryption key from the password manager process which can often be configured to forget the key quickly after the last use.
Also consider that if you have malware that can steal your password database and the encryption key it can probably just keylog all your passwords or steal your browser’s cookie jar. So the extra barrier here is minimal.
I think you are right to be suspicious of having a vault of passwords “ready to steal” but in practice the upsides far outweigh the downsides, especially if you make a security-focused choice of password manager.