> a memorized password won't

Memorized password are usually highly insecure due to being reused and short in general. So they are usually implemented as imperfect systems for most people. What is the difference to a password manager here?

The fact you remember long passwords doesn't mean everyone does.

If you're the type of person who uses no master password, and every password you would ever create is '1234', then a password manager will be a definite improvement. But if you have the ability to memorize two complex passwords, that is more secure.

My advice is solely for the person who already has a password manager, has memorized one complex password for it, and is willing to memorize another one.

Name one attack that would work against a non-cloud-based password manager like pass. Note that the encrypted passwords are stored locally and are encrypted with GPG and protected with a (hopefully) complex passphrase. If your answer depends on malware that can read the clipboard, note that the same malware can also log the keystrokes used to type the password manually.

Evil maid. Cold boot. Memory parsing. Clipboard/key event hooking. Brute force. Dictionary. Autofill hijack.

You can use the first four against typed passwords, but you either need to have malware installed, or your time window has to be very short. All of these can be used against password managers even without malware, and the time window is much longer, often due to crappy password managers not properly protecting against side channels or even cleaning up old memory.

You have the same attacks as with entering a password, plus more you wouldn't have had.

My question was specifically about pass, so your point about crappy password managers that don't clean up the clipboard is not relevant.

We can also ignore the attacks that apply to manually entering a password, as my question was about ways in which password managers are less secure compared to manually entered passwords.

What's left?

Brute force: not quite possible with the default GPG key type.

Dictionary: you'd need to guess my complex passphrase to decrypt my secret key (assuming you have access to it), and I can assure you my password if I use pass would be as long and as complex as I can make it, so I'm not sure which dictionary would contain it.

Autofill hijack: I don't use autofill for passwords.

> Brute force: not quite possible

> Dictionary: you'd need to guess my complex passphrase

Totally doable. You don't brute force the key, you brute force the passphrase that protects the key. Ask five eyes if password-protected GPG keys are impenetrable. A very large computer, smart algorithm, and good sigint can make short work of a "complex" passphrase. The difference between the password manager and memorized passwords is, if you crack the password manager, you have all the keys. If you memorize passwords, they have to intercept each key to compromise it. The most basic attack vector goes from "exfiltrate data one time" to "intercept all logins for a month".

Cold boot and evil maid also work better against someone who unlocks their gpg key for longer than a second, and extra code = extra possibility for bugs.