Prefer tools that work offline, save locally, and only sync encrypted blobs. End-to-end encryption with audited primitives like XChaCha20-Poly1305 or AES-256-GCM preserves confidentiality even if servers misbehave. Keep plaintext keys off cloud drives, and verify that search uses local indexes so queries never reveal sensitive context to third parties.
Use long passphrases, argon2id for derivation, and hardware keys where feasible. Store printed recovery codes in separate, sealed locations. Rotate secrets on a schedule you can remember, and document your process. A simple laminated card with instructions has rescued many tired travelers after a misplaced laptop or a corrupted phone backup.