Should I trust online password management services like passpack.com?
swolchok: They can grab all your passwords, because you're going to type them into their service, and because it's a web service, they can switch the implementation as they please. If it's implemented as they seem to imply (server just sends you an AES-crypted blob of passwords, JavaScript AES implementation decrypts the blob client-side using the packing key), then what happens if the bad guys root them and "enhance" their JavaScript to send the packing key back to the server?I think that you are going to have to trust such a service with your plaintext passwords, because you need to recover the plaintext passwords from it. The problem is aggravated by it being a web service whose implementation can be switched at any time.