Generally, a discriminating factor to understand how to trust a software that has to do with the safety is to see if the developers have released or not, the source code. The availability of source code is a necessary condition so that anyone can verify the correctness of the implementation of the software.
The problem with this approach is, however, twofold:
- Open source password manager like Keepass typically have a less intuitive and comfortable user interface compared to password manager developed by companies. And because a password manager is a software that you can use multiple times per day, comfort is an essential aspect.
- As I said above, the publication of source code is a necessary condition for verifying the security of a software. Of course, it is not a sufficient condition, given that in any case someone actually does an audit of the code. Since the open source password manager are mainly developed by volunteers without large economic support, means you can not expect that the audit's work on these password managers is systematic and rigorous, but however this means greater control of the implementation.
On the other hand, the vendors of the password manager can pay a third party to do a scrupulous audit's work on code, on the architecture and the cloud platform on which they stored in the users password vault.
Unfortunately, there is always the problem that the code in this case is proprietary, and the companies hardly issue the results of the audit. There remains, therefore, a matter of trust, not indifferent. LastPass, for example, claims to have hired third-party companies to perform regular audits on their software (
LastPass - Has LastPass been audited?), but without publish the results. And the link that offers on that page about who try to prove the security of LastPass without having the source code is not, in my opinion, very useful.
In any case, I would say that generally you can trust it. Using a password manager is certainly more secure than not using it, although you can make a judgment in a definitive manner on the security of the software. From this point of view, I would say the best criteria to choose a password manager rather than another one is the personal convenience.
