Type chrome://settings/passwords and click the eye icon. Enter your Windows PIN. There they all are — plain text.

That's the myth: people think Chrome, Edge, and Safari encrypt your passwords into a locked safe. They don't. They store them tied to your operating system login. Anyone who unlocks your computer unlocks every password you ever saved.

Let's break down why, and what to do instead.

Myth 1: 'They're encrypted, so I'm fine'

They are encrypted — but the key is your OS account. If someone is logged into your laptop, they see everything. No master password. No second wall.

A borrowed laptop, a repair shop, a nosy roommate, or malware running as you — all of them get the full list. On Windows, a free tool can export the whole vault to a spreadsheet in under a minute.

Myth 2: 'Syncing across devices makes it safer'

Sync spreads your passwords to every phone and tablet signed into that account. One weak account recovery — a reused email password, a SIM swap — and an attacker pulls the lot from the cloud. Convenience widened the blast radius.

Myth 3: 'A password manager is overkill for me'

A real password manager adds the one thing the browser skips: a master password that isn't your computer login. Lock the laptop screen, and the vault stays sealed even if someone is sitting at your desk.

The self-hosted fix: Vaultwarden

Vaultwarden is a lightweight version of Bitwarden you run on your own machine — a spare mini PC, a Raspberry Pi, even an old laptop. It speaks the same language as the official Bitwarden apps, so you get the polished browser extensions and phone apps for free.

Why self-host it?

  • Your vault never sits on a company's server. The encrypted database lives on hardware you control.
  • One master password unlocks everything, and only you know it. Not even the server can read your entries — they're encrypted before they leave your device.
  • It runs on almost nothing. Vaultwarden happily lives in a single small container using a fraction of the memory the full server needs.

Setup in plain steps:

  1. Install Docker on your spare machine.
  2. Run the Vaultwarden container and point it at a folder for its data.
  3. Install the Bitwarden extension in your browser and app on your phone.
  4. Set the server address to your machine, create your account, pick a long master password you'll never reuse.
  5. Import your Chrome passwords, then delete them from Chrome and turn off its password saving.

That last step matters. Leaving copies in the browser defeats the whole point.

Back it up

Self-hosting means you're the safety net. Copy the Vaultwarden data folder to an external drive weekly. If the machine dies, your passwords don't.

Do this today: open your browser's password page, look at how exposed that list is, then start moving it into a vault that a screen-lock actually protects.