The Complete Digital Nomad Security Stack: VPN + Password Manager + Encrypted Everything
Build a complete security stack for digital nomad life. VPN, password manager, encrypted email and storage — specific tools, pricing, and step-by-step setup.
A freelance developer in Bali logs into a client’s staging server over coworking WiFi. A marketing consultant in Medellin opens a proposal containing pricing details at a cafe. A content writer in Lisbon accesses their WordPress admin from a hotel lobby. All three are working over public networks. None of them know who else is on that network or what tools they are running.
Digital nomads face a unique combination of security threats that office workers never encounter. You are constantly on public WiFi. You work from shared spaces where anyone can sit next to you. You cross borders where customs officers can demand device access. You carry everything you own — and everything your clients trust you with — in a single backpack.
The good news: protecting yourself is neither expensive nor complicated. It requires five specific tools, configured once, running quietly in the background. Together they form a security stack that blocks the vast majority of attacks you will encounter as a nomad.
After three years of remote work across 25+ countries, testing every security tool on the market, we have refined this stack to its essentials. No bloat, no paranoia theater — just the tools that actually matter, configured for real-world travel.
Why Security Matters More for Digital Nomads
Before we get to the tools, it is worth understanding why nomads face elevated risk compared to someone working from home:
Public WiFi Is Inherently Hostile
Every cafe, hotel, airport, and coworking space shares one network among dozens or hundreds of users. Tools for intercepting traffic on shared networks are freely available and require minimal technical skill. Man-in-the-middle attacks, packet sniffing, DNS hijacking, and evil twin networks (fake hotspots that mimic legitimate ones) are not theoretical — they happen daily in popular nomad hubs.
Shared Workspaces Mean Shared Risks
Coworking spaces are better than random cafes, but not immune. Other members can see your screen. Shared printers and network drives can be attack vectors. USB charging stations can be compromised (juice jacking). Even the act of typing passwords in a crowded space creates exposure.
Border Crossings and Device Searches
Immigration officers in many countries can demand to inspect your devices. Some countries (US, UK, Australia, Canada) have explicit legal authority to search electronic devices at the border without a warrant. If your device contains client data, financial records, or sensitive communications, encryption is the only protection.
Device Theft and Loss
Backpack stolen in a hostel. Laptop swiped from a cafe table during a bathroom break. Phone pickpocketed on public transit. These are not rare events in nomad life. Without encryption, the thief has access to every account you are logged into, every password saved in your browser, every document on your hard drive.
Jurisdictional Complexity
If your accounts are compromised while you are in Thailand, but your bank is in the US, your client is in Germany, and the attacker is in Russia, the legal process for recovery is a nightmare. Prevention is infinitely easier than remediation across international borders.
The 5 Layers of the Digital Nomad Security Stack
A complete security stack has five layers. Each addresses a different attack vector. Skipping any one of them leaves a gap that attackers will find.
Layer 1: VPN — Encrypt All Network Traffic
A VPN encrypts every byte of data between your device and the VPN server. Anyone on the local network — the coworking space operator, the person at the next table, the hotel IT admin — sees only encrypted gibberish. They cannot see which websites you visit, what data you send, or what credentials you enter.
This is the single most critical tool for nomad security. Without it, every public WiFi session is an open invitation.
What to Look For in a Nomad VPN
- WireGuard protocol support — modern, fast, minimal speed loss (5-10%)
- Kill switch — blocks all traffic if VPN drops, preventing data leaks
- 6,000+ servers worldwide — ensures fast connections wherever you are
- No-logs policy — independently audited, not just claimed
- Router support — configure once on a travel router, protect all devices automatically
- Multi-device support — laptop, phone, tablet, e-reader
Our VPN Recommendations
NordVPN is our top pick for most nomads. It is the fastest VPN we have tested (400+ Mbps with NordLynx/WireGuard), has 6,400+ servers in 111 countries, supports 10 simultaneous devices, and has been independently audited three times for its no-logs policy. The kill switch works reliably, and the travel router support (WireGuard config files) is excellent.
At $3.39/month on a 2-year plan, it is remarkably affordable for what you get.
Get NordVPN — $3.39/monthProton VPN is the best choice for maximum privacy. Swiss-based, open-source code, subject to Swiss privacy laws (among the strongest in the world), and built by the same team behind Proton Mail. It supports WireGuard, has 4,000+ servers in 90+ countries, and includes Secure Core (multi-hop routing through privacy-friendly jurisdictions). Slightly slower than NordVPN in our testing but still excellent for daily use.
At $4.49/month on a 2-year plan (standalone) or included in Proton Unlimited at $7.99/month.
Get Proton VPN — from $4.49/monthFor a detailed comparison, see our NordVPN review and Proton VPN review.
Layer 2: Password Manager — Eliminate Password Reuse
The average person has 100+ online accounts. Digital nomads have more — airline accounts, booking platforms, ride-hailing apps in every city, local banking interfaces, coworking portals, foreign government visa sites, and the dozens of SaaS tools required for remote work.
Without a password manager, you are either reusing passwords (a single breach compromises every account) or using weak passwords you can remember (trivially crackable). Both approaches are catastrophically insecure.
A password manager generates, stores, and autofills strong, unique passwords for every account. You remember one master password. The manager handles everything else — across every device, even offline.
What to Look For
- Zero-knowledge encryption — the company cannot access your vault
- Cross-platform sync — works on Mac, Windows, iOS, Android, browser extensions
- Offline access — works without internet (essential for travel)
- Breach monitoring — alerts you when your credentials appear in data breaches
- 2FA integration — stores TOTP codes alongside passwords
- Emergency access — lets a trusted person access your vault if you are incapacitated
Our Password Manager Recommendations
NordPass uses XChaCha20 encryption (stronger than the AES-256 industry standard), offers cross-platform sync, breach monitoring, offline vault access, and a clean interface. It integrates naturally with NordVPN if you are already in the Nord ecosystem. The NordVPN Complete plan bundles NordPass Premium for $5.99/month total.
Get NordPass — $1.49/monthProton Pass is the privacy-focused alternative. End-to-end encrypted, open-source, built by Proton. Its standout feature is email alias generation — it creates unique email addresses for each account, hiding your real email from services that might be breached. Included in Proton Unlimited or available standalone from $1.99/month.
Get Proton Pass — from $1.99/monthLayer 3: Encrypted Email — Protect Sensitive Communications
Standard email providers (Gmail, Outlook, Yahoo) encrypt email in transit but not end-to-end. The provider itself can read your messages, and governments can compel the provider to hand them over. For most casual email, this is fine. But for client contracts, financial details, health information, legal communications, and sensitive business discussions, end-to-end encryption is essential.
Proton Mail is the gold standard. Swiss-based, end-to-end encrypted by default for Proton-to-Proton emails, with an option to send encrypted emails to non-Proton recipients (password-protected links). Zero access to your inbox — even Proton cannot read your messages. Used by journalists, activists, and security professionals worldwide.
Proton Mail’s free tier gives you 1GB of storage and a @proton.me email address. The paid plan ($3.99/month standalone or included in Proton Unlimited) adds custom domains, 15GB storage, and advanced filters.
For nomads: we use Proton Mail for all client communication, contracts, and financial correspondence. Our regular Gmail handles everything else. This two-email approach keeps sensitive communication encrypted without disrupting casual email habits.
Get Proton Mail — Free to StartLayer 4: Encrypted Cloud Storage — Protect Your Files
Your cloud storage contains documents, contracts, tax records, passport scans, client deliverables, and personal photos. Standard cloud storage (Google Drive, Dropbox, iCloud) encrypts files in transit and at rest, but the provider holds the encryption keys. They can access your files, and governments can subpoena them.
Proton Drive provides end-to-end encryption where only you hold the keys. Files are encrypted on your device before upload. Even Proton cannot decrypt them. It integrates with the Proton ecosystem and offers desktop sync (similar to Dropbox or Google Drive).
Included in Proton Unlimited ($7.99/month) with 500GB storage, or available with 5GB free.
For nomads, we recommend keeping sensitive documents (passport scans, tax records, client contracts, bank statements) on Proton Drive, and using Google Drive or Dropbox for non-sensitive collaboration files. This pragmatic split gives you strong encryption where it matters without disrupting team workflows.
Get Proton Drive — Encrypted Cloud StorageLayer 5: Two-Factor Authentication (2FA) — The Last Line of Defense
2FA requires a second form of verification beyond your password to log in. Even if someone obtains your password (through a breach, phishing, or shoulder-surfing), they cannot access your account without the second factor.
This layer is free and has no excuse for skipping.
Types of 2FA (Ranked by Security)
- Hardware security key (YubiKey) — best security, immune to phishing, $25-70
- Authenticator app (TOTP) — excellent security, generates time-based codes on your phone (Google Authenticator, Authy, or built into NordPass/Proton Pass)
- Push notifications — good security, sent to your phone for approval
- SMS codes — weakest option, vulnerable to SIM swapping attacks. Avoid if possible.
Where to Enable 2FA (Priority Order)
- Email accounts — your email is the master key to every other account (password resets)
- Banking and financial accounts — Wise, PayPal, crypto wallets, trading platforms
- Cloud storage — Google Drive, Dropbox, Proton Drive
- Work tools — GitHub, AWS, Slack, client dashboards
- Social media — accounts are valuable targets for identity theft
- Everything else — any account that supports 2FA
Pro tip: Store your 2FA backup codes in your password manager. If you lose your phone, you can still recover access to your accounts. Both NordPass and Proton Pass support storing TOTP 2FA codes alongside passwords.
The Nord Bundle: One Ecosystem for Speed and Simplicity
If you prioritize speed, polish, and ecosystem integration, the Nord stack is the best choice.
What You Get
- NordVPN — fastest VPN we have tested, 6,400+ servers, WireGuard (NordLynx)
- NordPass — XChaCha20 encrypted password manager, breach monitoring
- NordLocker — 1TB encrypted cloud storage (included in NordVPN Complete)
- Saily — eSIM mobile data from the same company, 150+ countries
Pricing
The most efficient way to buy the Nord stack:
- NordVPN Complete ($5.99/month on 2-year plan) — includes NordVPN + NordPass Premium + 1TB NordLocker
- Saily eSIM — purchased separately per trip, starting from $3.99
Total monthly cost: roughly $6-10/month plus eSIM costs per trip.
Get NordVPN Complete — $5.99/month Add Saily eSIM for Travel DataPros
- Fastest VPN speeds we have measured (400+ Mbps with NordLynx)
- Most polished apps across all platforms (iOS, Android, Mac, Windows, Linux)
- NordVPN Complete bundles VPN + passwords + storage at a great price
- Saily eSIM integration means one company handles connectivity and security
- 10 simultaneous VPN connections covers all devices
- NordPass XChaCha20 encryption exceeds industry standard AES-256
Cons
- Not open-source — you trust Nord Security's claims on faith (mitigated by independent audits)
- Based in Lithuania (EU jurisdiction) — not as privacy-friendly as Switzerland
- No end-to-end encrypted email offering (still need Proton Mail or similar)
- NordLocker is less mature than Google Drive or Dropbox for collaboration
- Saily coverage (150 countries) is narrower than Airalo (200+)
The Proton Bundle: Maximum Privacy for the Security-Conscious
If you prioritize privacy, transparency, and the strongest possible encryption, the Proton stack is unbeatable.
What You Get
- Proton VPN — Swiss-based, open-source, Secure Core multi-hop routing
- Proton Pass — end-to-end encrypted passwords with email alias generation
- Proton Mail — the gold standard in encrypted email
- Proton Drive — zero-access encrypted cloud storage
- Proton Calendar — encrypted calendar (included in all plans)
Pricing
The most efficient way to buy the Proton stack:
- Proton Unlimited ($7.99/month on 2-year plan) — includes VPN + Mail + Pass + Drive + Calendar
- Individual products available separately if you only need one or two
Total monthly cost: $7.99/month for the complete ecosystem.
Get Proton Unlimited — $7.99/monthPros
- Swiss jurisdiction — strongest privacy laws in the world, outside EU and US reach
- Fully open-source — all apps and code are publicly auditable
- End-to-end encrypted email (Proton Mail) included — the Nord stack lacks this
- Email alias generation in Proton Pass hides your real email from breaches
- One subscription covers VPN + email + passwords + cloud storage + calendar
- Free tiers available for all products — you can start without paying
Cons
- VPN speeds are slightly slower than NordVPN in our testing (still fast enough for daily use)
- Apps are less polished than Nord's — improving rapidly but still catching up
- No eSIM offering — you need a separate provider like Saily or Airalo for mobile data
- Proton Drive collaboration features are limited compared to Google Drive
- 500GB storage cap on Unlimited plan (vs 1TB on NordVPN Complete NordLocker)
Nord Stack vs Proton Stack: Head-to-Head Comparison
| Feature | Nord Stack | Proton Stack |
|---|---|---|
| VPN Speed | 400+ Mbps (NordLynx) | 300+ Mbps (WireGuard) |
| VPN Servers | 6,400+ in 111 countries | 4,000+ in 90+ countries |
| Password Manager | NordPass (XChaCha20) | Proton Pass (E2E encrypted) |
| Encrypted Email | Not included | Proton Mail (included) |
| Cloud Storage | 1TB (NordLocker) | 500GB (Proton Drive) |
| Open Source | No (audited by third parties) | Yes (fully auditable) |
| Jurisdiction | Lithuania (EU) | Switzerland |
| eSIM Integration | Saily (150+ countries) | None (use Saily or Airalo) |
| Monthly Cost (2yr) | $5.99/mo + Saily per trip | $7.99/mo (Proton Unlimited) |
| Free Tier | No | Yes (limited) |
| Best For | Speed, UX, and ecosystem integration | Maximum privacy and transparency |
| Visit Nord Stack | Visit Proton Stack |
Who Should Choose the Nord Stack
- Most digital nomads who want the fastest, most polished experience
- Remote workers who prioritize speed and reliability for video calls
- Travelers who want eSIM data from the same ecosystem (Saily)
- Anyone who values excellent UX and seamless cross-platform sync
- Budget-conscious nomads who want the most value per dollar
Who Should Choose the Proton Stack
- Privacy maximalists who want Swiss jurisdiction and open-source code
- Journalists and activists handling sensitive sources or communications
- Anyone who needs end-to-end encrypted email as part of their stack
- Nomads in authoritarian countries where Secure Core VPN routing adds protection
- Users who prefer free tiers to test before committing
Our Take
For the majority of digital nomads, the Nord stack is the better practical choice. It is faster, cheaper, more polished, and the Saily eSIM integration means one company handles your two biggest travel needs — security and connectivity.
For anyone handling genuinely sensitive information — journalists, human rights workers, people in countries with aggressive surveillance — the Proton stack is the safer choice. Swiss jurisdiction, open-source code, and end-to-end encrypted email provide protections that no other commercial stack matches.
You can also mix and match. We personally use NordVPN for daily internet, Proton Mail for sensitive email, NordPass for passwords, and Saily for travel eSIMs. There is no rule that says you must stay within one ecosystem.
Physical Security Tips
Software protects your data in transit and at rest. But physical security protects the devices themselves. Here are the practices we follow after three years on the road:
Enable Full Disk Encryption
- Mac: FileVault (System Settings > Privacy & Security > FileVault). Enable it. It encrypts your entire hard drive with no performance impact on modern Macs.
- Windows: BitLocker (Settings > Privacy & Security > Device Encryption). Requires Windows Pro or Enterprise.
- Phone: Enabled by default on all modern iPhones and Android devices with a screen lock.
If your laptop is stolen, full disk encryption means the thief cannot access your files without your password. Without it, they can remove the hard drive and read everything.
Use Find My Device
- Apple: Find My (enabled by default if signed into iCloud)
- Android: Find My Device (enabled by default if signed into Google)
- Windows: Find My Device (Settings > Privacy & Security)
These allow you to locate, lock, or remotely wipe a stolen device. Test that they work before you need them.
Lock Screen Discipline
- Set auto-lock to 1-2 minutes on all devices
- Use biometric unlock (Face ID, fingerprint) for convenience
- Use a strong alphanumeric passcode (not a 4-digit PIN)
- Never leave devices unlocked and unattended, even for 30 seconds
Physical Deterrents
- Use a laptop lock cable in coworking spaces and cafes (Kensington locks are cheap and effective)
- Carry a small padlock for hostel lockers
- Use a slash-resistant backpack with hidden zippers for transit (see our best anti-theft backpack guide)
- Never check bags containing electronics on flights
Border Crossing Preparation
- Enable full disk encryption before crossing borders
- Power off devices completely (not sleep mode) — this requires the encryption password on next boot
- Consider a secondary “travel” user account with no sensitive data
- Know your rights: in the US, you can decline to unlock devices, but CBP can confiscate them
- Store sensitive files on encrypted cloud storage (Proton Drive) rather than on the device
Setting Up Your Security Stack: Step by Step
Here is the complete setup process, start to finish. Budget 30-45 minutes.
Step 1: Choose Your Ecosystem (5 minutes)
Decide between the Nord stack or Proton stack based on the comparison above. Or mix and match. Either way, commit to a password manager first — it makes everything else easier.
Step 2: Set Up Your Password Manager (10 minutes)
- Sign up for NordPass or Proton Pass
- Install the app on your phone and laptop
- Install the browser extension (Chrome, Firefox, Safari)
- Import existing passwords from your browser (both managers offer one-click import)
- Set a strong master password (16+ characters, mix of words and symbols)
- Store the master password recovery key in a secure physical location (not digitally)
From this moment, every new account gets a unique, generated password. Your password manager autofills it everywhere.
Step 3: Install and Configure Your VPN (5 minutes)
- Sign up for NordVPN or Proton VPN
- Install the app on every device — laptop, phone, tablet
- Enable the kill switch in settings (blocks internet if VPN drops)
- Enable auto-connect so the VPN activates when you join any WiFi network
- Select WireGuard as your protocol (fastest)
- Connect to a server and verify at whatismyipaddress.com
If you use a travel router, also download WireGuard configuration files for router-level VPN setup (see our travel router setup guide).
Step 4: Set Up Encrypted Email (5 minutes)
- Create a Proton Mail account (free tier is fine to start)
- Install the app on your phone
- Forward sensitive correspondence to your Proton address
- Use Proton Mail for client contracts, financial communications, and anything you would not want a third party reading
- Keep your existing Gmail/Outlook for casual communication
Step 5: Set Up Encrypted Cloud Storage (5 minutes)
- Sign up for Proton Drive (5GB free, 500GB with Proton Unlimited)
- Install the desktop sync app
- Move sensitive files to Proton Drive: passport scans, tax documents, client contracts, insurance policies, bank statements
- Keep collaborative work files on Google Drive or Dropbox as needed
Step 6: Enable 2FA Everywhere (15 minutes)
- Start with email accounts (Gmail, Proton Mail)
- Then banking and financial (Wise, PayPal, your home bank)
- Then work tools (GitHub, AWS, Slack, client platforms)
- Then everything else
- Store backup codes in your password manager
- Use authenticator app (built into NordPass or Proton Pass) — not SMS
Monthly Cost Breakdown
Nord Stack (NordVPN Complete + Saily)
| Item | Monthly Cost (2-Year Plan) |
|---|---|
| NordVPN Complete (VPN + NordPass + 1TB NordLocker) | $5.99 |
| Saily eSIM | $3.99-14.99 per trip |
| 2FA app | Free |
| Full disk encryption | Free (built into OS) |
| Total | ~$6-10/month |
Proton Stack (Proton Unlimited)
| Item | Monthly Cost (2-Year Plan) |
|---|---|
| Proton Unlimited (VPN + Mail + Pass + Drive + Calendar) | $7.99 |
| Travel eSIM (Saily or Airalo) | $3.99-14.99 per trip |
| 2FA app | Free |
| Full disk encryption | Free (built into OS) |
| Total | ~$8-12/month |
Mixed Stack (Our Personal Setup)
| Item | Monthly Cost (2-Year Plan) |
|---|---|
| NordVPN ($3.39/mo) | $3.39 |
| NordPass ($1.49/mo) | $1.49 |
| Proton Mail (Free tier) | $0 |
| Proton Drive (Free tier 5GB) | $0 |
| Saily eSIM | $3.99-14.99 per trip |
| Total | ~$5-8/month |
Any of these options costs less than a single cup of specialty coffee in Bali. For the protection you get, it is the best value investment in your nomad toolkit.
Common Mistakes to Avoid
Relying on “I have nothing to hide”
You may not think your data is valuable, but your clients’ data is. A breach of your email, file storage, or credentials can expose every client and project you have worked on. Security is not just about you — it is about everyone who trusts you with their information.
Using the Same Password Everywhere
One breach, one password, every account compromised. The 2024 “mother of all breaches” exposed 26 billion records. If any of your passwords were in that dataset and you reused them, every account with that password was vulnerable. A password manager eliminates this risk entirely.
Skipping VPN “Because the Site Uses HTTPS”
HTTPS encrypts the content of your communication with a specific website. It does not hide which websites you visit, does not protect DNS queries, and does not prevent the network operator from seeing your traffic patterns. A VPN encrypts everything — including the metadata that HTTPS leaves exposed.
Using SMS for Two-Factor Authentication
SMS-based 2FA is vulnerable to SIM swapping attacks, where an attacker convinces your carrier to transfer your number to their device. Use an authenticator app instead. Both NordPass and Proton Pass include built-in TOTP authenticators.
Forgetting Physical Security
The most sophisticated encryption is useless if someone watches you type your password or steals your unlocked laptop. Physical security hygiene — screen locks, awareness of your surroundings, device encryption, tracking apps — is as important as software security.
The Bottom Line
Digital nomad security is not about paranoia. It is about building a reasonable, maintainable set of protections that run quietly in the background while you focus on your work and your travels.
The five layers — VPN, password manager, encrypted email, encrypted storage, and 2FA — address every common attack vector you will encounter as a nomad. Together they cost $6-12/month and take 30-45 minutes to set up once.
Our recommendation for most nomads: Start with the Nord stack (NordVPN Complete at $5.99/month) for VPN, passwords, and storage. Add Proton Mail’s free tier for encrypted email. Enable 2FA everywhere. Install a Saily eSIM for travel connectivity. Done.
For maximum privacy: Get Proton Unlimited at $7.99/month for the complete encrypted ecosystem.
Either way, you will have professional-grade security for less than the cost of a coworking day pass. Set it up this week, and stop worrying about the cafe WiFi.
For a deeper dive into each tool, see our individual reviews: NordVPN review, Proton VPN review, NordPass review, Proton Suite review, and our complete remote work security guide.
Frequently Asked Questions
What is the most important security tool for digital nomads?
A VPN. It encrypts all internet traffic between your device and the VPN server, preventing anyone on the local network from intercepting your data. This matters because digital nomads constantly use public WiFi at cafes, hotels, airports, and coworking spaces — all of which are vulnerable to eavesdropping. NordVPN and Proton VPN are both excellent choices for travel.
How much does a complete security stack cost per month?
The Nord stack (NordVPN Complete + Saily) costs roughly $6-10/month on a 2-year plan. The Proton stack (Proton Unlimited) costs $7.99/month on a 2-year plan. Either option is less than the cost of one cafe latte in most nomad hubs. For the protection you get — encrypted internet, passwords, email, and cloud storage — it is one of the best investments you can make.
Is the Nord stack or Proton stack better?
For most digital nomads, the Nord stack is better due to faster VPN speeds, a more polished user experience, and the Saily eSIM integration. For privacy maximalists, journalists, activists, or anyone handling highly sensitive data, the Proton stack is better — it is Swiss-based, open-source, and offers the strongest privacy guarantees of any commercial provider. Both are excellent choices.
Do I really need encrypted email?
If you handle client contracts, financial information, health records, or any sensitive business communication, yes. Standard email (Gmail, Outlook) is encrypted in transit but not end-to-end — the email provider can read your messages. Proton Mail provides end-to-end encryption, meaning only you and the recipient can read the content. At minimum, use encrypted email for your most sensitive communications.
Can I use free versions of these tools?
Partially. Proton VPN has a free tier (limited servers, slower speeds, 1 device). Proton Pass has a free tier (unlimited passwords, 10 email aliases). Proton Mail has a free tier (1GB storage, limited features). NordVPN does not have a free tier. A free Proton stack gives you basic protection, but paid plans significantly expand functionality, speed, and storage.
What should I do if my laptop is stolen while traveling?
Step 1: Use Find My Device (Apple) or Find My Device (Google) to locate or remotely wipe the laptop. Step 2: Change passwords for all accounts, starting with email and banking — your password manager makes this fast. Step 3: Revoke active sessions on sensitive accounts (Google, GitHub, AWS, etc.). Step 4: Notify your employer if it is a work device. Step 5: File a police report for insurance. Full disk encryption (FileVault on Mac, BitLocker on Windows) protects your data even if the thief has physical access.
Is a password manager safe? What if it gets hacked?
Modern password managers like NordPass and Proton Pass use zero-knowledge encryption — the company cannot access your vault even if their servers are compromised. Your master password never leaves your device. The security risk of NOT using a password manager (reusing passwords, weak passwords, passwords in browser autofill) is dramatically higher than the theoretical risk of a password manager breach. Every major cybersecurity expert recommends using one.
Should I use two-factor authentication even with a VPN?
Absolutely. A VPN and 2FA protect against different threats. A VPN protects data in transit over networks. 2FA protects your accounts from unauthorized login, even if someone obtains your password. They are complementary layers, not alternatives. Use an authenticator app (not SMS) for 2FA on every account that supports it.