Earlier quoted context omitted.
> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (ak…
> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.
You only have to remember one password, and for that reason people can choose a longer and more complex one.
Then your passwords are encrypted using that master password.
So people cannot “reverse” your password if you pick a reasonably long master password.
For reference, my master password is a 27 character sentence which would take somewhere between a millennium and the heat death of the universe to crack. It encrypts around 500 passwords, each in itself 25-35 character long pass phrases I do not know.