Putting every password in one place sounds like concentrating risk, and the intuition is not stupid. It is wrong because it compares the wrong two options: not a manager against perfect discipline, but a manager against what people actually do instead.
The objection, stated properly
One store, one compromise, everything gone. Email, bank, work, the lot.
That is a correct description of risk concentration, and dismissing it as technophobia is both rude and wrong. Anybody who has thought about single points of failure in any other context should arrive at exactly this worry here.
Why it is still the right trade
The comparison being made is a manager against remembering forty unique passwords. Nobody does that. It is not the alternative.
The alternative is reuse, in some form — the same password with a number on the end, a family of three variations, a pattern. Which means the concentration already exists. Every service you have used shares a credential with the others, and the weakest of them decides your exposure. A forum you forgot about in 2019 is holding a key to your email.
So the choice is not between concentrated and distributed risk. It is between concentration in hundreds of places you do not control, most of which are not in the security business, and concentration in one place you chose, designed for this, not simultaneously running a public login form.
What the architecture does that matters
The vault is encrypted with a key derived from your master password on your device. What the provider stores is ciphertext.
This is the same distinction that separates end-to-end from at-rest storage anywhere else, and it has the same consequence: a breach of the provider yields encrypted blobs rather than credentials.
It also has the same tell. Forget the master password and the vault is gone — nobody can return it to you. That is not a gap in the product. It is the evidence the property is real, and any manager offering to restore your vault without it is describing a different architecture.
The failure modes that are actually real
A weak master password. Everything rests on it, and length matters far more than punctuation.
A device already compromised. The manager decrypts on your machine, so something with a foothold there can read what you unlock. No vault design survives this.
Real-time phishing. A convincing page capturing the master password and the second factor together, used immediately. Domain-bound factors resist this; codes do not.
Autofill into the wrong page. Which is why strict domain matching matters more than the convenience of filling everywhere, and why a manager that declines to fill is often working correctly rather than failing.
What this buys that is easy to overlook
Unique passwords mean a breach anywhere is contained to one account. That containment is the whole product.
But the mechanism underneath is subtler: it removes the decision. No security practice requiring a judgement every single time survives contact with a tired person at eleven at night. Generating and storing a password without being asked is not a convenience feature — it is the reason the behaviour actually happens.
How I would set it up
A long passphrase rather than a short complicated one. Length is the property that resists guessing at scale.
A strong second factor on the manager itself — a key or a passkey rather than a code, since this is the account that opens the others.
Recovery arranged before it is needed, written down, stored physically.
And the second factor for an account kept somewhere other than the vault holding that account's password. Storing both together rebuilds precisely the single point the objection was right to worry about, and it is the most common way a good setup is quietly undone.
Close
The objection was right about the shape of the risk and wrong about the baseline. You were never choosing between concentration and safety. You were choosing where the concentration sits, and whether whoever runs it is doing anything else for a living.