You probably heard the news. 1Password donated $300,000 to a project founded by a controversial figure, and suddenly, the digital vault holding your entire online life feels dirty. Your instinct is to pack up your thousands of saved credentials and move to a new neighborhood.
But here is the uncomfortable truth: Moving your passwords from one centralized corporate vault to another isn’t an escape. It’s just choosing a different landlord you’re willing to ignore.
Over on Hacker News, the debate is raging. Users are asking for migration guides to flee 1Password after the Omarchy donation. But someone quickly pointed out the absurdity of this outrage: the CEO of Stripe also donated $1 million to the exact same project. Are you going to rip out your entire payment infrastructure tomorrow? Are you going to stop using every tool whose leadership makes a financial decision you dislike?
The moment you rely on a third party to manage your secrets, you are engaged in a hostage situation. Password managers are designed to be invisible. They weave themselves into your corporate infrastructure, your browser, your muscle memory. The more embedded they become, the harder it is to leave. When a values break happens, you realize you don’t actually own your security. You are just renting your digital safety from people whose morals you hope align with yours.
We treat encryption like a math problem, but trust is the fundamental security parameter. A political donation isn’t just a moral issue; it’s a security threat signal. If the people holding your deepest secrets operate on a value system you don’t share, your data is at risk. Not because of a zero-day exploit, but because of a zero-day trust breach.
Most people miss that switching from one managed service to another is not a real escape from reputational risk. It just changes which hidden entanglements you are willing to tolerate. You flee 1Password for Bitwarden, only to discover Bitwarden’s cloud relies on Amazon Web Services, or their CEO sits on a board you hate. You’re playing whack-a-mole with your own ethics.
The real split isn’t between 1Password and Bitwarden. The real split is between centralized managed trust and self-sovereign responsibility.
So what do the actually paranoid do? They don’t just switch SaaS providers. They go self-sovereign. In that same Hacker News thread, the real veterans aren’t talking about migrating to another cloud vault. They’re talking about pass, the standard Unix password manager, coupled with a PGP hardware token like a NitroKey. They’re talking about hosting their own Vaultwarden instance via Docker.
It’s harder. It requires you to be moderately technical. It removes the convenience of seamless cloud sync. But it removes the hidden entanglements. True security isn’t finding a trustworthy corporation; it’s building a system where you don’t have to trust anyone but yourself.
Stop playing musical chairs with your digital secrets. If you want to escape the anxiety of uprooting your credentials every time a CEO makes a controversial donation, you have to take back the keys to the kingdom.
FAQ
Q: Isn't self-hosting your passwords actually less secure than a corporate SaaS?
A: No, it's just a different threat model. A corporate SaaS protects you from script kiddies but exposes you to corporate governance and political risks. Self-hosting protects you from the CEO's politics, but requires you to secure your own server. It's trading convenience for absolute control.
Q: Should I switch from 1Password to Bitwarden then?
A: Only if you want a different corporate overlord. If you're moving to Bitwarden's cloud, you're still renting your trust. If you're moving to self-hosted Vaultwarden or a local Unix tool like 'pass', you're actually taking sovereignty.
Q: Is a $300k donation really a security threat?
A: Yes. If your password manager's leadership makes financial decisions that actively alienate user demographics or compromise their values, the trust parameter is broken. Encryption only protects data if you trust the people and processes operating around it.