Comment by mnm1

I wouldn't trust any password service that uploads my data anywhere, with or without the key (though especially with the key like here). I wouldn't trust it if it uploaded the password data to Dropbox or any similar service under an account I own. Even if the data is encrypted, someone can get access to it and work on decrypting it offline. That's simply too big of a risk considering the power of state actors, although I assume state actors would just get the data directly from each website and not need my passwords. Still, can't assume anything about any adversary. Others could certainly be capable of cracking an encrypted file offline.