A password manager using Trezor as a hardware key, with a scheme similar to Deterministic Signature, generates different key pairs for each piece of information that needs to be encrypted. This greatly mitigates the risk of master password leakage faced by traditional password managers. You only need to keep the BIP39 seed safe.