A vendor’s corporate conduct can be a legitimate reason to switch password managers, but it is a separate question from whether the product is secure. Here is how to separate the two and migrate safely if you decide to move.
Key takeaways
- Reports that users are leaving a password manager over a corporate donation describe a reputational dispute, not a disclosed security flaw in the product itself.
- A password manager’s trustworthiness rests on its cryptographic architecture, its audit history and its transparency, and none of those change when a company makes a political or charitable contribution.
- Switching password managers is a genuine security operation in its own right, because export files are plaintext and the migration window is when credentials are most exposed.
- The strongest reasons to leave a vendor are usually structural, such as a closed protocol, a poor audit record or an ownership change that alters the incentives.
- If you switch, the migration is only finished once you have deleted the export file securely, rotated your highest-value passwords and confirmed recovery access on the new service.
What is actually happening here
A widely shared discussion claims that users of a commercial password manager are cancelling subscriptions in response to a large donation the company reportedly made. The specific amount, recipient and the company’s own account of the decision are not verifiable from the circulating summary alone, and the scale of any cancellations is not something an outside observer can measure. What can be described accurately is the shape of the event: a software vendor took a corporate action unrelated to its product, some portion of its customer base objected, and the objection was expressed as a threat to leave.
This pattern is common enough in consumer software that it is worth treating as a category rather than a single incident. The useful question for a reader is not whether this particular company deserves the criticism, which is a matter of personal values, but how to evaluate a security product when the reason you are reconsidering it has nothing to do with security.
Why this is drawing attention now
Password managers occupy an unusual position of trust. They hold, in encrypted form, the keys to a person’s email, banking, employment and identity records. That concentration makes users unusually sensitive to any signal that a vendor might not be acting in their interest, even when the signal comes from a domain — corporate giving, marketing, executive statements — with no technical bearing on the vault.
The subscription model amplifies this. Because most password managers are sold as recurring subscriptions, cancelling is the most immediate lever a dissatisfied customer has, and it is a lever people reach for quickly. Discussion threads then make the reaction visible in a way that individual cancellations never would be, which can make a dispute look larger or smaller than it is. Neither the volume of comments nor the intensity of the language tells you how many accounts actually closed.
The background a newcomer needs
A password manager stores credentials in an encrypted vault. In the widely used design, the vault is encrypted on your device with a key derived from your master password, and the provider stores only the encrypted blob. This is often called zero-knowledge or end-to-end encrypted architecture: if it is implemented correctly, the provider cannot read your passwords even if compelled to, and a breach of the provider’s servers yields ciphertext rather than credentials.
That “if implemented correctly” carries the weight. The things that determine whether a vault is genuinely protected are technical and auditable: which key derivation function is used and with what parameters, whether the client software is open source or independently reviewed, how often third-party security audits are published, how the vendor has handled past incidents, and how account recovery works — since any recovery mechanism that can restore access without your master password is, by definition, a path around the encryption.
None of those properties are affected by a donation. A company can hold views a customer finds objectionable and still ship a well-audited product; it can also hold agreeable views and ship a poorly maintained one. Conflating the two leads to switching decisions that feel decisive but leave the user no safer.
Who is affected and how
Individual subscribers are affected least in technical terms and most in practical ones. Their vault security is unchanged, but they may face a migration that takes an evening and introduces real risk if handled carelessly.
Families and shared-vault users face a coordination problem: moving means moving everyone, and a partially migrated household ends up with credentials in two places, which is worse than either place alone. Business and enterprise administrators face the largest burden, because their deployment may involve provisioning integrations, single sign-on configuration, compliance documentation and contractual terms that cannot be unwound by cancelling a card.
There is also a group affected in the opposite direction: users who are not troubled by the vendor’s conduct but who see alarmed headlines and worry their passwords have been compromised. For that group, the accurate message is that a reputational dispute is not a breach notification, and there is no indication in the circulating discussion that vault data has been exposed.
Where informed people disagree
One camp argues that where a company directs its money is a legitimate consumer signal, and that with a market full of comparable password managers there is no reason to fund a company whose choices you dislike. The switching cost is a few hours; the objection is principled; the alternatives are mature.
Another camp argues that security tooling should be selected on security grounds, and that churning between vendors on reputational news tends to degrade a user’s posture over time. Each migration creates plaintext exports, half-finished transfers and abandoned accounts, and users who move repeatedly often end up on whichever product had the best publicity rather than the best engineering.
A third position holds that the two frames are not in conflict, because governance is a security property over the long term: a vendor’s ownership, funding and decision-making shape whether audits continue and whether the product is still maintained in five years. On this reading, corporate conduct is evidence about the company’s direction, but weak evidence compared with acquisitions, layoffs affecting security teams, or the quiet removal of published audits.
The practical implications: how to decide and how to move
Start by writing down your actual reason. If it is values-based, that is a sufficient reason on its own and does not need technical justification. If it is security-based, check whether anything technical has actually changed — a published audit, an incident report, a change to the encryption model — rather than inferring it from the controversy.
If you decide to move, treat the migration as a security operation:
Before exporting. Choose the destination first and verify it supports what you use: passkeys, two-factor codes, secure notes, attachments, shared vaults and your browsers. Confirm the export and import formats line up, because attachments and TOTP seeds are the fields most often lost in transfer.
During the export. Password manager exports are almost always unencrypted CSV or JSON. Write the file to local disk, never to cloud-synced folders, email or chat. Do the transfer on a device you control, in one sitting.
After the import. Verify a sample of entries, particularly two-factor seeds, by logging in to a few accounts. Then delete the export file, empty the trash, and be aware that on many systems deletion does not immediately overwrite the data.
Then rotate and close. Change the passwords for your email, financial accounts and any account used for recovery, since those were exposed in plaintext during the move. Set up recovery on the new service and test it. Finally, delete the old vault and close the account rather than leaving it dormant, since an abandoned vault with stale credentials remains a target.
What to watch next
Watch for anything that changes the technical picture rather than the reputational one: a new independent audit or the lapsing of an old one, a change to the encryption or recovery model, an incident disclosure, or a shift in ownership or funding. Watch also for whether the vendor responds substantively, since how a company handles criticism of its conduct is often a reasonable proxy for how it will handle disclosure of a vulnerability.
On the user side, the thing worth watching is whether reported cancellations translate into measurable change, which is generally invisible unless a company discloses it. Treat claims about the scale of the exodus with caution in either direction; discussion volume is not subscriber data.
Frequently asked questions
Does a company’s donation affect the security of my password vault?
No. The security of an encrypted vault depends on the cryptographic design, the quality of the client software, the strength of your master password and the vendor’s operational practices. A charitable or political contribution changes none of those. If you object to a company’s conduct, that is a valid reason to take your business elsewhere, but it should be described as a values decision rather than a security one.
Is it risky to switch password managers?
There is real risk, and it comes from the transfer rather than the destination. Exports are typically plaintext files containing every credential you own, and they are exposed for as long as the file exists. The safe approach is to export to local storage only, import promptly, verify the results, delete the export securely, and then rotate the passwords for your most sensitive accounts.
How can I tell whether a password manager is genuinely secure?
Look for published independent security audits with recent dates, a clear description of the encryption architecture including which key derivation function is used, open-source client code or a credible equivalent, a documented history of handling past incidents openly, and recovery mechanisms that do not quietly bypass your master password. Marketing claims about being “military grade” carry no information.
Should I use my browser’s built-in password manager instead?
Browser managers have improved substantially and are a reasonable choice for many people, particularly compared with reusing passwords. The trade-offs are that they tie you to one browser ecosystem, tend to offer weaker sharing and organisational features, and vary in how they protect the vault when your device is unlocked. Dedicated managers generally offer stronger cross-platform support and more granular controls.
What happens to my passwords if a password manager company shuts down?
With a properly designed zero-knowledge product, your data lives encrypted on your devices as well as the provider’s servers, so you retain local copies. The practical protection is to periodically confirm you can perform an export, and to keep a securely stored offline record of the handful of credentials — email, recovery accounts — you would need to rebuild access. Self-hosted and open-source options reduce this dependency further.
Do I need to change all my passwords after migrating?
Not all of them, but you should prioritise. Any password that appeared in a plaintext export has been exposed to whatever risks existed on that device during the transfer. Rotate email accounts, financial services, and anything used for account recovery first, followed by anything with payment details stored. Lower-value accounts can be rotated gradually as you sign in to them.
Sources and further reading
- Published third-party security audit reports commissioned by major password manager vendors, which describe encryption architecture and any findings in technical detail.
- National cybersecurity agency guidance on password management, which typically covers manager selection criteria and safe migration practice.
- Vendor documentation on export and import formats, which is the authoritative reference for which fields survive a transfer.
- Community technology discussion forums, useful for observing user sentiment but not a reliable source for the scale of subscriber changes.
Surfaced from the reddit:technology signal “password manager vendor backlash”. AI-assisted draft, editorially reviewed.
