There are two things that affect any security generally:
- What do you have to do.
- What do attackers have to do to overcome your security.
The second is the most obvious; the easier it is for attackers to "break" the security, the less secure you are. The first though is also important; if your security prevents you doing what you have the system for, then it's pointless but this is often a contrary pressure because you can't shut down a possible use of the system to protect it if doing so makes it pointless.
Now, let's look at two password storage scenarios:
- Passwords are stored on a server so that users can be authenticated.
- Passwords are stored so that the user can make use of them.
These two scenarios are different by both criteria:
"What do you have to do."
In the first scenario, there is no need for the password itself to be retrieved; we only need to be able to establish that a password pass to us on log-in matches it.
In the seconds scenario, we need to be able to retrieve the actual password itself.
"What do attackers have to do to overcome your security."
With reversible master-password-based encryption, attackers have to obtain the password store and either break the encryption or obtain the master password.
If the decryption itself is being done on the same server as the password checking, then in any case where attackers have gained access to the password file they are also quite likely to have gained access to wherever the master password is being stored and while that might e.g. require decompiling some code or something, they have all they need to read the passwords.
If the decryption is being done based on the user knowing the master password, then obtaining the password store does not make you any more likely to have obtained the master password, because that is only in the user's memory.
As such, encrypting passwords for the sort of uses KeePass and other stores (PasswordSafe, LastPass, etc.) are intended for is both not providing more functionality than is actually needed (unlike for verification, where retrieving the password itself is pointless) and not as weak.
They can also have greater security again by not having the computers that have a copy of the store operating as 24/7 servers where they can be attacked at a known location 24/7, though that part goes away if you use cloud storage or a repository to store the password store.
KeePass is certainly less secure than having none of the passwords stored anywhere, but almost nobody is capable of storing reasonable passwords like
d@HTS9i7S@4amk.qx4,xve1Q+W.CkocPL/,XWbky each separate service.
Having an encrypted store of passwords for such use is a reduction in security that brings with it functionality that allows us to avoid greater reductions in security.
Having an encrypted store of passwords on a server for verifying log-ins is a much greater reduction in security (because we have to be less secure with the key's storage too) that allows no increase in functionality, except for some things that are in themselves a very bad idea (telling users their passwords).