Right but that metadata (like password rules) is pretty much public information so it doesn't matter if an attacker gets it so it doesn't have to be as secure as a "vault".
Once you're assuming 1) you trust your master password or encryption key to provide sufficient security to generate passwords based on the domain and 2) you have a file you're synchronizing that contains metadata for each site like passwords changes and usernames well, guess what?
Just go ahead and generate random passwords for each site, encrypt them with the master key, and store them in the metadata file! Since they're encrypted, the encrypted passwords are no longer more sensitive than the other metadata in the file and you just reinvented a normal password manager.
The biggest problem with password managers is that you become completely dependent on them (and therefore completely helpless without them) once you start using them. This scenario still allows you to remain decoupled from that dependency. You could print out a copy of your metadata to take with you on your trip to Europe without worrying that you'll be completely hosed if someone steals your phone/password manager.
> You could print out a copy of your metadata to take with you on your trip to Europe without worrying that you'll be completely hosed if someone steals your phone/password manager.
I can take a copy of my pwd vault with me. I'm using pass, so the vault is a directory of files encrypted with a private key, which itself is encrypted with a strong passphrase. Even if I do end up losing that copy; What are the chances that someone breaks todays encryption standards, and does so before I notice the loss and simply change all my passwords?
