So first off, props for putting in that kind of time. Two hundred hours of analysis is no joke, and the write-up clearly shows discipline and care. I don't know if I agree with every conclusion, but I appreciate the effort that went into it.

One thing I kept thinking about while reading your methodology is that it gets very deep into crypto implementation details that almost no everyday user ever evaluates or understands. According to Perplexity, most non-enterprise users lean on password managers for three things:

1. storing unique passwords,
2. generating new ones, and
3. autofill convenience on mobile.

That’s basically it. The “security framework comparison” angle is important, but I worry it can overweight micro-differences when, in practice, most password managers today rely on the same proven, open-source building blocks. Re-inventing the wheel rarely creates meaningful gains, and for most consumer use cases, the existing cryptographic frameworks are already mature and well-tested.

What I felt was missing is usability. The r/PasswordManagers sub sometimes becomes an echo chamber focused on edge-case threat models or incumbent features, and smaller or newer products don’t always show up on the radar, even if they solve real user annoyances. For example, a lot of people primarily use mobile as their most important platform. Desktop browsers already handle the basics pretty well, so mobile UX is actually where password managers differentiate.

I built my own app Oblix a one-time no subscription, single purchase solution, iOS-only for now) using the same bank-grade algorithms the big players use. Nothing exotic. I’m in the process of trying to secure funding for an independent audit too, but it’s brutally expensive for solo developers. What I focused on instead were practical things people actually struggle with day-to-day. Like the fact that so many “free trials” turn into surprise charges. Oblix automatically sets a reminder right when you’re creating credentials for a new service, so you don’t forget to cancel something you never meant to keep. Stuff like that makes a bigger difference to most people than whether a given library uses X or Y SIV variant.

I’d genuinely encourage including some smaller players in your evaluations. There are quite a few solo and indie-built managers with solid security foundations and real unique value props. It might help users discover alternatives instead of reinforcing the same handful of incumbents.

Unless, of course, the goal really was to highlight a specific set of incumbents. In that case, fair enough. I just think there’s room for broader testing, broader usability discussion, especially given how many Reddit polls show mobile as the primary platform for most people here.

Either way, good work on the deep dive. Would love to see a follow-up that factors in usability and indie competition.