&gt;How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user?<p>You don&#x27;t. Assume every online service you use subject to security holes. What defines a secure app from an unsecure one is revealed after a security incident. That&#x27;s why I continue to use LastPass simply because they exemplified their security practices during their recent scare.