Going Offline Doesn't Remove Password Risk. It Swaps It.

Offline password managers make a simple pitch: your vault physically cannot leave your phone, because the app has no way to send it anywhere. Vaultis, an Android password manager built by Kore Industries, the same team behind GENZ TECH, is one concrete example: no account, no cloud, no Android INTERNET permission, vault sealed with AES-256-GCM. We asked three security practitioners whether that pitch holds up, and whether the standard offline-versus-cloud framing is even asking the right question.

The short answer is that it's a real guarantee, and a narrower one than the marketing usually implies. What's actually being traded isn't security for convenience. It's one category of failure for another, and which one you'd rather live with depends on who you are.

RelatedVaultis: An Offline Password Manager With No Cloud and No Account

What Are You Actually Choosing When You Go Offline?

Evgenii Arsentev, PhD and AI transformation executive, frames the decision as a bet on which failure mode you're more likely to survive. "You are choosing which failure you would rather survive," he said. "A synced vault gives you recovery, multi-device access and a vendor whose whole business is keeping that vault encrypted, and in exchange you accept a permanently interesting target and a supply chain you do not control. A local-only vault removes the remote attacker almost entirely and hands you a new risk that is far more common in practice: the phone is lost, the backup was never made, and the passwords are simply gone. For most people the realistic threat is not a breach at the provider, it is losing access. That is the part the privacy conversation keeps skipping."

Srinivas Chippagiri, a senior member of technical staff at Salesforce with 15 years in cloud and AI infrastructure, points at a real-world case that shows both sides of the trade at once. "Zero-knowledge designs mean a breach leaks only encrypted vaults, but LastPass showed the real danger: offline brute-force of stolen vaults with weak master passwords," he said. "Offline local-only removes remote-breach and mass-targeting risk entirely. The cost is no seamless sync and no vendor recovery, so you own your backups." The LastPass breach didn't fail because the encryption was broken. It failed because attackers could take the stolen, encrypted vaults home and guess at them for as long as they wanted, a risk offline storage removes by never handing the vault to anyone in the first place.

Does Skipping the Android INTERNET Permission Actually Guarantee Anything?

Both sources independently landed on the same answer: yes, narrowly. "It is a real guarantee, and a narrow one," Arsentev said. "It means the app itself cannot open a socket, which rules out silent exfiltration by that process and makes the claim auditable, which matters more than the claim itself. What it does not cover is everything around the app. The clipboard is readable, the accessibility and autofill paths involve other processes, screenshots and device backups can carry the vault off the phone, and anything with root or a compromised OS makes the permission model irrelevant." Chippagiri's read matches almost line for line. "With no INTERNET permission the app physically cannot open a socket, so it can't exfiltrate your vault over the network, and the OS enforces that, not the vendor," he said. "It doesn't stop local leakage via clipboard, other apps, or a rooted device, and an update could add the permission. Strong reduction, not a total guarantee."

Where Do AES-256-GCM and Argon2id Implementations Actually Fail?

Neither source disputes that AES-256-GCM with Argon2id key derivation is the right modern baseline. Both immediately redirect the conversation to where real vaults actually break. "The failures are almost never in the primitive," Arsentev said. "They are in the parameters and the plumbing: Argon2 tuned so low it barely slows a GPU, nonces reused with the same key after a restore or a sync, keys kept in memory longer than the screen is unlocked, no rate limiting on the unlock attempt, and secrets ending up in logs, crash reports or the clipboard. If I were reviewing one of these apps, I would spend ten minutes on the algorithm names and the rest of the day on key lifetime and the restore path."

David Osipov, a core maintainer and open-source contributor at Telemt, adds a failure mode neither of the other two raised: integrity, not just secrecy. "Encryption alone is not enough," he said. "If the encryption mode allows controlled modification, an attacker may be able to change encrypted data without knowing the key. With AES-GCM, the application can detect that the encrypted vault was modified and reject it instead of trying to use manipulated data." Password-vault file formats aren't secret, he noted, so an attacker can install the same app and study exactly how the data is laid out. Authenticated encryption is what stops that knowledge from turning into a usable tampering attack.

RelatedOne GitHub issue, RCE on Claude Code and Gemini CLI runners

Is There a Third Option Between Fully Offline and Fully Cloud?

Osipov's sharpest point is that the debate skips a real middle ground. "The real choice is not only between somebody else's cloud and a completely offline vault," he said, pointing to self-hosted options like Bitwarden as a category most coverage ignores. "With self-hosting, you reduce your dependence on the vendor's infrastructure, but you become responsible for patching, backups, TLS, monitoring, availability and server security." That's not a free upgrade, it's a different job description, trading vendor risk for operational risk you now own directly.

He circles back to a point that cuts against pure security purism: none of this matters if people don't actually use it. "A more secure tool can create a worse security outcome if it is so inconvenient that people stop using it," he said. "Password reuse is a much bigger real-world problem than the small additional attack surface introduced by a well-designed synchronized password manager." His framing for anyone choosing a tool isn't which architecture is theoretically strongest. It's "which reasonably secure system will the user actually use every day."

Our Take

Strip away the marketing language on both sides and the three sources agree on more than the "offline versus cloud" framing suggests. The security question was never really about which architecture is stronger in theory, it's about which failure mode fits the person using it. A journalist or activist facing targeted exfiltration is choosing correctly by going offline. Someone who has never once tested their own backup is quietly choosing a different, more common failure: the day they lose the phone. Arsentev's fix, an explicit, user-controlled escape hatch like a printed recovery key, is the detail that determines which of those two people a zero-knowledge design actually serves. A tool like Vaultis makes a specific, honest bet, no account and no network permission at all, in exchange for making backup discipline entirely the user's job. Whether that's the right trade depends on the same answer Chippagiri gave: it's for people whose real risk is a targeted breach, not the ordinary person who mostly needs to stop reusing passwords.

Quotes gathered directly by GENZ TECH from sources who volunteered to comment on this story, with full attribution as agreed with each. Disclosure: Vaultis is built by Kore Industries, the same team that publishes GENZ TECH.