Ttykuu

For convenience purposes I manage my passwords with the password manager Bitwarden on my personal computer and smartphone with autofill function (but with asking for the master password or fingerprint first every time).

I was just thinking about also adding my credit card information (which is used to log into the online banking stuff) to my vault, but since that seems like such important data, I'm not sure if it would be safe or if this even is a good idea. Any opinions?

I also saw this question on here, but it rather deals with whether that is reasonable from a law standpoint.

The question might come down to: which piece of data has a higher level of risk, your passwords or your credit card info?

Your passwords can be used without you ever knowing about it. Passwords let someone into every aspect of your life with, potentially, every secret bit of information about you that you hold. So, it is possible for someone with your password to completely take over your life without you being aware until it is too late.

Credit card use will be noticed on your next statement, or as soon as your card company posts its use. You also have several types of recourse to dispute charges and have them reversed.

One might suggest that credit cards can be used to set up new cards or other lines of credit, but the same could be said with the information provided by passwords.

Passwords are the higher risk. Credit card info has numerous mitigations in place to protect you.

So, if you trust your password manager with your passwords, there is no increased risk with trusting it with your credit cards.

Password managers can store any kind of secret. (Or at least short plaintext strings.) I have no idea how safe your specific password manager is.

A closed vault should be as secure as your password is. If the vault is opened on some computer, then that machine needs to be trusted. (No key loggers, hardware trojans, snooping super users, etc.)

A good password hashing algorithm allows no method of password cracking better than guess -and-check. The vault will be as difficult to decrypt without the password as it is difficult to guess your password. (That's not technically true because the encryption will likely have a maximum strength of 256 bits. However, that doesn't matter because your master password will be weaker than a 256-bit key and any more than 128-bit security is good enough.)

If your master password is quite strong then it's probably fine, as long as the computer used and the password manager used is secure.

You could also put information in a second vault protected by a stronger master password. That vault also could be put on a well guarded thumb drive. (Which could reduce a hacker's opportunity to break open the closed vault if the thumb drive isn't plugged in when you don't need it and the drive is well guarded.)

It's not necessary to store the vault somewhere else if your password is strong enough.

Make sure the password manager software is something you trust. (Proprietary software is automatically sketchy to me.)