Suppose you use a password manager having all possible features of modern password managers: encryption with a key derived from your master password, auto-filling, cloud or local storage, browser extension, web and local applications, random password generator, password auto-change, etc.
Now, suppose that you have the choice between these two options:
- storing a randomly generated strong password directly in the encrypted vault (KeePass-like, with the ability to choose how long the vault can stay unencrypted, or when to ask again the master password: before each use, etc.)
- storing only the pattern used to derive a strong password from your master password (LessPass-like, with the ability to choose when the password is derived: just after the decryption, before each use, etc.)
Finally, suppose that the round numbers used by the derivation functions (for the encryption key and the strong password) are high enough for the derivation to take roughly one second on most devices.
How to choose between those two?
What are their pros and cons?
Which one is the most secure in which case (concerning both cryptography and usability)?
Are there other parameters to take into account to make this choice (features, closed or open source, etc)?