Short answer
Storing passwords in Google Drive is safe only if they are encrypted on your device before they are uploaded. A plain document, spreadsheet or note is not safe, because anything in it is readable by whoever gets into your Google account or opens a shared link.
Secure It Password Manager is a zero-knowledge password manager that stores your encrypted vault in your own Google Drive: no company servers, not even ours. I'm the developer, so read this page with that in mind. Most of it applies to any encrypted vault in Drive, whichever tool you use.
| Plain doc or sheet | Encrypted file in Drive | Password manager that encrypts the vault | |
|---|---|---|---|
| Who can read the contents | Anyone with access to your Google account or the file link | Only someone with the key | Only someone with your master password |
| Protection if the account is taken over | None | Strong, if the password is strong | Strong, if the master password is strong |
| Autofill, generator, breach checks | No | No | Depends on the app |
| Effort | Lowest | High (manual) | Low |
What can go wrong with passwords in Docs, Sheets or Notes
Google encrypts Drive files in transit and at rest by default. Google's Drive help describes this, and it also describes client-side encryption as a separate, opt-in Workspace feature where the organisation holds the keys. In the default setup Google manages the keys, so that encryption protects you from someone stealing a disk. It doesn't protect a document from anyone who is signed in as you.
That leaves a few practical risks:
- Account takeover. If someone signs in to your Google account, every unencrypted file is open. One phished or reused Google password is enough.
- Shared links. A file set to "Anyone with the link" can be opened by anyone who has the URL, with no sign-in. Links get forwarded, pasted into chats and sometimes indexed. Stanford's IT team has a plain explanation of how easy it is to share more than you meant to.
- Copies everywhere. Drive syncs to every device you're signed in on. A spreadsheet of passwords ends up in caches, downloads and backups you never think about.
- No field protection. A password sits in a cell as visible text. Anyone looking over your shoulder, or any screen-sharing session, sees it.
- No help from the tool. There are no breach alerts, no strength checks, no autofill and no way to tell which passwords you've reused.
So can you store passwords in Google Docs? You can, but you shouldn't. If you must keep something in a document, encrypt the file first.
What "encrypted first" means
Encrypting first means your device scrambles the data before anything goes to Google. Two steps do the work:
- Key derivation. Your master password is run through a slow, memory-hungry function to produce an encryption key. The slowness is deliberate. It makes each guess expensive for an attacker. Argon2id is the current standard choice: RFC 9106 says implementations must support it, and libsodium has used it as its default since version 1.0.15. OWASP lists it first in its password storage guidance.
- Authenticated encryption. The vault is encrypted with a cipher such as AES-256-GCM. "Authenticated" means any tampering with the file is detected when you open it.
Zero-knowledge, defined in one line: the service that stores your data never has the key, so it can't read your data even if it wants to or is forced to.
That definition matters because of cases like the LastPass 2022 breach. In its December 2022 update, LastPass said the attacker copied backups of customer vault data. Website URLs were stored unencrypted. Usernames, passwords and notes were encrypted. Encryption did its job, but it left stolen vaults exposed to offline guessing against weak master passwords. The lesson is that encryption on the device is necessary, and the strength of your master password decides how long it holds.
What Google can and can't see with an encrypted vault
As of October 2026, for an encrypted vault file stored in your Drive:
| Item | Visible to Google? |
|---|---|
| That the file exists, and its name | Yes |
| File size and timestamps | Yes |
| That your account created or changed it | Yes |
| Your passwords, usernames, notes | No, if encrypted on the device with a key Google never gets |
| Your master password | No |
There is one honest caveat. Anyone who copies the encrypted file, whether through a hijacked Google account or a Google-side incident, can try to guess your master password offline, with unlimited attempts and no lockout. A long, unique master password plus a slow key-derivation function is what makes that impractical. NIST SP 800-63-4 sets a minimum of 15 characters for a password used as a single factor, and says not to force composition rules like "one symbol and one capital". Length beats complexity.
Ways to keep a vault in Google Drive
| Approach | How it works | Good for | Trade-offs |
|---|---|---|---|
| KeePass-family app plus Drive sync | An encrypted database file that you sync through Drive with a plugin or a compatible app | People who like open formats and are comfortable troubleshooting sync | You set up and maintain the sync yourself, and conflicts between devices are your problem |
| A manager with its own cloud (Bitwarden, 1Password, Proton Pass and others) | The vendor stores your encrypted vault on its servers | Sharing, teams, polished apps on every platform including iOS | Your vault lives on the vendor's servers. Some subscriptions apply. Bitwarden also lets you self-host |
| Secure It | One encrypted vault file in your own Google Drive | People who want no vendor-held copy and no subscription | Needs a Google account. Not independently audited yet. No iOS app (see limits below) |
KeePass and its relatives are mature, widely reviewed and free, and for some people they are the better choice. A manager with its own cloud is the better choice if you need iOS, family sharing or an audited product today.
How Secure It does it
Here is what the app does, as plainly as I can state it. For the wording we keep in one place, see Secure It at a glance and the security page.
- Key derivation: Argon2id, through libsodium, from your master password.
- Encryption: AES-256-GCM, done on the device. The key never leaves it.
- Storage: a single encrypted file,
vault.enc, in your own Google Drive. There are no company servers for user data. - Narrow permission: the app asks for Google's
drive.filescope. Google classes it as non-sensitive and describes it as access to files the app creates or that you open with it, not your whole Drive. - Recovery: a 12-word BIP-39 recovery phrase, plus an Emergency Kit PDF that includes an offline recovery script.
I haven't published the exact Argon2id cost parameters on this page. When they're on the facts page, that's where to check them.
Where you can use it today: a Windows app (free on the Microsoft Store, unlocked by the Android purchase) and a Chrome extension (free on the Chrome Web Store, also unlocked by that purchase; it installs in Edge, Brave and Opera too). The Android app is a one-time purchase of US$4.99 (local prices vary by country on Google Play) with no subscription, but it is currently in closed testing, so it isn't on sale yet. The app has 12 languages. See downloads for current status and pricing for details.
Limits, stated plainly
- A Google account is required for sync. The vault sits in your Drive, encrypted. If you don't want any Google dependency, this isn't the right tool.
- No independent security audit yet. The cryptography uses well-known, named primitives, but nobody outside the project has reviewed our implementation.
- Small independent developer. I'm one person, not a large security company with a response team.
- Platforms. Android is in closed testing and there's no iOS app. The Edge Add-ons listing is still in review, so Edge users install from the Chrome Web Store for now.
Checklist: keeping a vault in Drive safely
- Use a long, unique master password. A passphrase of several random words, at least 15 characters, used nowhere else.
- Turn on 2-Step Verification for your Google account, and consider passkeys or a security key. An attacker who can't get into your account can't copy the file.
- Keep the recovery phrase offline. Write it on paper and store it somewhere separate from your devices. Don't photograph it or save it in Drive.
- Don't share the vault file. If a link to it exists, remove it.
- Check your Google account's security settings now and then, including signed-in devices and third-party access.
- Keep a recovery route that doesn't depend on Google. Store the Emergency Kit offline too.
If you have questions about any of this, the FAQ covers common ones, or you can email talhaaslamdev@gmail.com.