A password manager syncs by copying one encrypted vault between your devices. Products differ in where that copy is kept: on the vendor's servers, in a file you sync yourself, or in your own cloud storage. Secure It Password Manager keeps it in your own Google Drive, so the same vault opens on Windows and in the Chrome extension, and on Android once the app is live, without a company server.
In this guide, sync means keeping one encrypted vault identical on every device. Only ciphertext travels. The readable passwords exist only on a device you have unlocked.
The basic idea: one encrypted vault, a key that never travels
Every zero-knowledge password manager does the same three things:
- Your device turns your master password into an encryption key. Secure It uses Argon2id for this.
- It encrypts the whole vault with that key. Secure It uses AES-256-GCM.
- It stores or uploads only the result. NIST describes encryption as "the process of transforming plaintext into ciphertext."
The key is derived again on each device from your master password, so it never has to be uploaded. A storage service, whether it's the vendor's or yours, sees scrambled bytes. That is why syncing through a cloud can be safe: the protection comes from the encryption, not from trusting the place the file sits. For more on the model, see our security page.
Three ways password managers sync
| Model | Where the encrypted vault lives | Examples | What you manage |
|---|---|---|---|
| Vendor cloud | The vendor's servers | Bitwarden, 1Password, Dashlane, NordPass | An account with the vendor |
| Do-it-yourself file sync | A database file you place in a synced folder | KeePassXC | The sync service, conflicts, key files |
| Your own cloud storage | A file in your own Drive | Secure It | A Google account for multi-device sync |
Status as of 19 Oct 2026. Sources are linked below.
1. Vendor cloud
You create an account and the vendor stores your encrypted vault and pushes changes to your devices. It is convenient, but your vault sits on someone else's infrastructure:
- Bitwarden cloud accounts live in Bitwarden's cloud, in a US or EU region, and an account exists only in the region where it was created (Bitwarden).
- 1Password hosts account data in the region you pick at sign-up: US, Canada or EU (1Password).
- Dashlane's subprocessor list names AWS in Ireland and Germany for storing encrypted data (Dashlane).
The vault is encrypted in all of these. The trade-off is that every customer's vault sits in one central place. The 2022 LastPass incident shows what that can mean: an attacker copied a backup of customer vault data from its cloud storage (LastPass). Bitwarden can be self-hosted, but that means running your own server with Docker, a domain and open ports (Bitwarden).
2. Do-it-yourself file sync
KeePass-style managers keep the vault as a file. KeePassXC has no built-in cloud sync. Its FAQ tells you to store the database inside a shared cloud folder and let that sync service handle it. It also says it has no mobile app of its own and recommends third-party apps such as KeePassDX or KeePass2Android on Android (KeePassXC docs).
This works and keeps vendor servers out of the picture. But you assemble the pieces yourself: a sync client on each device, a separate app on your phone, and a key file carried across by other means if you use one.
3. Your own cloud storage
Here the app talks to your storage directly and the encrypted vault is a single file in it. No vendor holds a copy. This is the model Secure It uses, with the built-in setup that the do-it-yourself route lacks.
How Secure It syncs
Secure It Password Manager follows the model above:
- The vault is encrypted on the device with Argon2id and AES-256-GCM before it leaves.
- Sync stores one encrypted file,
vault.enc, in your own Google Drive. - It uses Google's narrow
drive.filescope. Google describes it as access to files the app creates or that the user opens with, or shares with, the app, so the app has no business reading the rest of your Drive (Google Drive API scopes). - There are no company servers for user data, not even ours.
Sync is optional. A vault works fully offline on one device without any Google sign-in. You need a Google account only to use the same vault on several devices.
That is the practical difference from the DIY route. You don't pick a sync client or point a database file at a folder. The apps come from one developer: an Android app, a Windows app and a Chrome extension.
Setting up a second device
The exact screens may change, so check the app for the current wording. The flow is:
- Create your vault on your first device and set a master password. Save the 12-word recovery phrase and the Emergency Kit PDF somewhere safe and offline.
- Turn on Google Drive sync in the app, using the Google account that should hold the vault.
- Install the second client. On Windows, get the app from the Microsoft Store. In Chrome (or Brave, Opera, or Edge via the Chrome Web Store), install the Secure It extension. The Edge Add-ons listing is in review.
- Connect the same Google account and unlock with your master password. The vault is downloaded and decrypted locally.
The Windows app and the extension are unlocked by the Android purchase on Google Play. Android is in closed testing, so it isn't on sale yet. When it is live, it will be a one-time purchase of US$4.99 (local prices vary by country). See download and pricing for the current status. There is no iOS app yet. iOS is coming soon, with no date.
Can I use two password managers during a move?
Yes. Many people run the old and new manager side by side for a week or two. Import first, then keep using the old one until you've checked that the new vault has everything. Then delete the old data once you're sure.
One risk is that two live copies mean two places to protect. When you're done, export nothing you no longer need, and remove old vaults and plaintext exports. Secure It can import saved passwords from Chrome, Edge, Opera, Brave and Firefox.
Which model is right for you?
Vendor clouds are the most hands-off, and Bitwarden's free plan is a fair choice if you're happy with the vendor storing your vault. If you'd rather keep it off company servers without running one, DIY file sync or Secure It both do that. Secure It's difference is that the storage is built in, the apps come from one developer, and it is a one-time purchase rather than a subscription.
Two honest limits: Secure It hasn't had an independent security audit yet, and multi-device use needs a Google account. The full list of current facts is on our facts page.