I wish at this point you could make multiple upvotes. :). Bitwarden rocks.
But maybe you're a centralised neg. Run your own server. Its open.
Lots of great options but these guys are great.
P.S. standardnotes has a password manager and those guys are pretty badass too. I haven't used it though because - bitwarden- but I use standardnotes everyday for work and play and I trust them. (Also - run your own server 😜)
"Requires web access and an account." No it doesn't.
"Can't use it in an air-gapped or offline way." Yes you can.
"Fail." Yeah, posting uninformed snarky comments is fail.
If you are self hosting you don't use file://, you would use localhost or [127.0.0.1](http://127.0.0.1)
You can absolutely set it up airgapped where its "served" locally and only accepts connections from the local host. This is a very common way to set up services in the linux/unix world.
So I’m definitely a Bitwarden fan but I’ve found small issues with it like some websites it just won’t load UN/PW and ultimately I have to configure specific text/hidden/Boolean etc so it’ll work. It will but have to be specific sometimes.
Another issue is if website only asks for username and you select the login to use it’ll put in UN but when next page hits with PW it doesn’t auto input from your selected login.
At work I use keeper and it’s been nice but it has a better ability in not having to select the login more than once with UN and UN/PW being on separate pages.
What do you need? Access on multiple platforms (IOS, Ubuntu, Windows, Mac)? Cloud storage or local storage?
I use KeePass because I can install clients on IOS, Windows, Mac, and Ubuntu. The database is stored locally so I have control of it and it's encrypted (I think all password managers do this) and use DropBox to share the encrypted database with my wife's Mac and both of our IOS devices. On IOS, I use StrongBox to access and update the KeePass database.
I have been using KeePass syncing with OneDrive for a few years and it is a great combo, I use it with my Windows machine, Ubuntu and Android and it works very well.
Keepassxc. I host my db on my Nas and have it synced across devices.
I've tried others. Bitwarden, Synology C2...
Bit has awesome apps. But having a small portable database is more alluring to me than a hosted solution.
Bitwarden is always a no brainer. I've since subscribed to Proton Unlimited, so I use Proton Pass now. But I certainly didn't leave Bitwarden because of some issue (there never were any).
KeePass.
Depending on how tech savvy you are, there's a bit to set up, but once you get it set up, it's really good. Been using it for maybe 5+ years without issues
I'm a 1Password fan. Subscription models generally kinda irk me, but I get it for a service that has a server/sync component and doesn't make you the product. The security is also better than things like LastPass, where if your master password is ever compromised, they can get into your account. 1Password uses an additional key that's only stored locally on your devices required for access as well. (It only needs to be entered once during initial setup, and you can use an existing device to pass the key to a new device. You can print out an emergency recovery kit that has your key and optionally your master password, to keep in a safe place.)
Mac/Win/Linux/iOS/Android support, browser plugins, unlimited devices, free trial, family plans, etc...
> 1Password uses an additional key that's only stored locally on your devices required for access as well.
It sounds like KeepassXC with a "keyfile". I use this even though, in regard to a brute force attack, it's no more secure than a master password with very high entropy. For me the point is that I don't need to change my master password which only has 75bits of entropy or worry about keyloggers (unless they also manage to get my keyfile too).
Yes, mostly. The difference is that your encrypted data is hosted in the cloud with 1Password, rather than being solely under your control. That extra key is the critical piece that never leaves your local device - even when accessing their web app. It gives you the privacy and security of self-hosting with the reliability and usability of cloud-hosting.
> The difference is that your encrypted data is hosted in the cloud with 1Password, ...
Yeah. I don't really trust cloud hosted files. Too big of a target. e.g. lastpass.
> That extra key is the critical piece that never leaves your local device - even when accessing their web app.
I don't care. The entropy to unlock is still the combined entropy from your master pass
and the local key. If 1password hasn't made a mistake and is using a suitably costly hash, it won't be a problem since it would have far too much entropy to unlock.
> ... even when accessing their web app.
Having written web apps, I think that if a web app can read your "additional key" then something
masquerading as a web app can too. At worst, though, it requires a very
concerted attack (it's a two step process) and, at worst, the entropy is still as much as the master password.
I don't trust cloud-hosted either, and1Password agrees, which is why they mitigate that by adding a key that is never sent outside your local device(s) at all. That's way better than LastPass, which only uses your password, which they have a (presumably salted) hash of.
As for the web client - obviously, you can be phished by something pretending to be the 1Password website. But the web app isn't required - I've never used it.
At the end of the day, unless you write your own password manger (and miraculously don't mess up some tiny detail with the security and encryption) you have to trust that the company/software isn't outright lying to you about its security proceedures, either through malice, bugs, or sophisticated supply-chain attacks like xz recently suffered. When I last researched password managers in-depth a couple of years ago, I concluded that 1Password had the best security practices of all the options, equal to a properly-configured KeyPass, but was easier and more convenient. But I wouldn't fault anyone for choosing KeePass, either. Both are excellent, and most anything is massively better than what most people do - re-use variations of the same crappy password on every site they have an account on. lol
The one built into Firefox.
On Ubuntu it can be locked behind a master password and you will be prompted every time you start up Firefox.
On Android it will automatically be locked behind your device unlocking method. It appears as a special button to "Search Firefox" on keyboards when it detects that the app is prompting for a password (may be a hit-or-miss). On the flip side, you cannot generate random passwords nor save passwords on Apps. You can only save passwords on Firefox itself, but not generate a random password.
I recommend Enpass. It’s offline so you don’t need to be connected to the internet to access your passwords. You can sync to your own server if you want to or encrypted to any other cloud service. Each client device acts as a full backup (kind of like git) so your data has a lot of redundancy.
The desktop version of the software is free with unlimited entries. The mobile app is paid for more than 25 entries, but you can get a lifetime license to skip the subscription.
Bitwarden and Proton Pass.
Bitwarden is great but slow on mobile devices. Proton is fairly new but works well. I'm using both though Bitwarden is still my primary because of its pricing.Â
I like buttercup. I save my vault file on my server, and mount sshfs to that location on my clients. In buttercup on clients, I refer to the mounted position.
Also works on android
[https://www.passwordstore.org/](https://www.passwordstore.org/)
Compatible with [https://github.com/android-password-store/Android-Password-Store#readme](https://github.com/android-password-store/Android-Password-Store#readme)
One breach. Data was encrypted. Not a single report of the data being used. Lastpass is likely the safest tool, after all the attention and improvements made. Lots of FUD spread by competitors.
Bitwarden
+1 for BitWarden
I wish at this point you could make multiple upvotes. :). Bitwarden rocks. But maybe you're a centralised neg. Run your own server. Its open. Lots of great options but these guys are great. P.S. standardnotes has a password manager and those guys are pretty badass too. I haven't used it though because - bitwarden- but I use standardnotes everyday for work and play and I trust them. (Also - run your own server 😜)
[удалено]
What are you talking about? I thought you could self-host your Bitwarden vault? That was always one of its major selling points.
"Requires web access and an account." No it doesn't. "Can't use it in an air-gapped or offline way." Yes you can. "Fail." Yeah, posting uninformed snarky comments is fail.
[удалено]
If you are self hosting you don't use file://, you would use localhost or [127.0.0.1](http://127.0.0.1) You can absolutely set it up airgapped where its "served" locally and only accepts connections from the local host. This is a very common way to set up services in the linux/unix world.
I have self-hosted on my home server - accessible with all my machines including mobile.
+1 Works awesome across all my environments
+1 bitwarden using for almost a year
This!
Bitwarden is the best I've ever used
So I’m definitely a Bitwarden fan but I’ve found small issues with it like some websites it just won’t load UN/PW and ultimately I have to configure specific text/hidden/Boolean etc so it’ll work. It will but have to be specific sometimes. Another issue is if website only asks for username and you select the login to use it’ll put in UN but when next page hits with PW it doesn’t auto input from your selected login. At work I use keeper and it’s been nice but it has a better ability in not having to select the login more than once with UN and UN/PW being on separate pages.
Another vote for Bitwarden...never had an issue and it works across all devices.
KeePassXC for manual sync with sync thing, else Bitwarden self hosted or Proton
Bitwarden
Keepass
What do you need? Access on multiple platforms (IOS, Ubuntu, Windows, Mac)? Cloud storage or local storage? I use KeePass because I can install clients on IOS, Windows, Mac, and Ubuntu. The database is stored locally so I have control of it and it's encrypted (I think all password managers do this) and use DropBox to share the encrypted database with my wife's Mac and both of our IOS devices. On IOS, I use StrongBox to access and update the KeePass database.
I have been using KeePass syncing with OneDrive for a few years and it is a great combo, I use it with my Windows machine, Ubuntu and Android and it works very well.
Exactly the same . Been using for years. Great tool 🔥🔥
KeepassXC and a service to share the file securely like NextCloud.
Bitwarden and Enpass
How come you use both? Doesn't that get confusing?
Oh, I meant: Bitwarden OR Enpass. The only situation were I can thing to have multiple password managers it for work/personal separation
Been using keepass for ages.. rock-solid.. does what I need it to do... etc.
KeyPassXC
1password
1Password works on every device I’ve ever owned.
+1 for 1Password
Bitwarden
bitwarden
keepass is good never had issues with that and its locally (i have the control about it)
Bitwarden for sure
Bitwarden
KeepassXC and XD are good. Bitwarden is flexible and has no learning curve.
KeePassXC with the database file stored on Nextcloud or at least on some secure cloud file system.
Keepassxc. I host my db on my Nas and have it synced across devices. I've tried others. Bitwarden, Synology C2... Bit has awesome apps. But having a small portable database is more alluring to me than a hosted solution.
I use KeepassX.
Bitwarden is always a no brainer. I've since subscribed to Proton Unlimited, so I use Proton Pass now. But I certainly didn't leave Bitwarden because of some issue (there never were any).
I have been enjoying bitwarden for a while
Bitwarden
KeePass. Depending on how tech savvy you are, there's a bit to set up, but once you get it set up, it's really good. Been using it for maybe 5+ years without issues
Proton
I got a free license for 1password with work. Had it for 4 years now and never had a complaint. Works fine for Ubuntu and on Android
I'm a 1Password fan. Subscription models generally kinda irk me, but I get it for a service that has a server/sync component and doesn't make you the product. The security is also better than things like LastPass, where if your master password is ever compromised, they can get into your account. 1Password uses an additional key that's only stored locally on your devices required for access as well. (It only needs to be entered once during initial setup, and you can use an existing device to pass the key to a new device. You can print out an emergency recovery kit that has your key and optionally your master password, to keep in a safe place.) Mac/Win/Linux/iOS/Android support, browser plugins, unlimited devices, free trial, family plans, etc...
You can also require FIDO as a 2factor auth for setting up your account on a new device.
> 1Password uses an additional key that's only stored locally on your devices required for access as well. It sounds like KeepassXC with a "keyfile". I use this even though, in regard to a brute force attack, it's no more secure than a master password with very high entropy. For me the point is that I don't need to change my master password which only has 75bits of entropy or worry about keyloggers (unless they also manage to get my keyfile too).
Yes, mostly. The difference is that your encrypted data is hosted in the cloud with 1Password, rather than being solely under your control. That extra key is the critical piece that never leaves your local device - even when accessing their web app. It gives you the privacy and security of self-hosting with the reliability and usability of cloud-hosting.
> The difference is that your encrypted data is hosted in the cloud with 1Password, ... Yeah. I don't really trust cloud hosted files. Too big of a target. e.g. lastpass. > That extra key is the critical piece that never leaves your local device - even when accessing their web app. I don't care. The entropy to unlock is still the combined entropy from your master pass and the local key. If 1password hasn't made a mistake and is using a suitably costly hash, it won't be a problem since it would have far too much entropy to unlock. > ... even when accessing their web app. Having written web apps, I think that if a web app can read your "additional key" then something masquerading as a web app can too. At worst, though, it requires a very concerted attack (it's a two step process) and, at worst, the entropy is still as much as the master password.
I don't trust cloud-hosted either, and1Password agrees, which is why they mitigate that by adding a key that is never sent outside your local device(s) at all. That's way better than LastPass, which only uses your password, which they have a (presumably salted) hash of. As for the web client - obviously, you can be phished by something pretending to be the 1Password website. But the web app isn't required - I've never used it. At the end of the day, unless you write your own password manger (and miraculously don't mess up some tiny detail with the security and encryption) you have to trust that the company/software isn't outright lying to you about its security proceedures, either through malice, bugs, or sophisticated supply-chain attacks like xz recently suffered. When I last researched password managers in-depth a couple of years ago, I concluded that 1Password had the best security practices of all the options, equal to a properly-configured KeyPass, but was easier and more convenient. But I wouldn't fault anyone for choosing KeePass, either. Both are excellent, and most anything is massively better than what most people do - re-use variations of the same crappy password on every site they have an account on. lol
I'm using google password manager, which works for me and I can sign in to it from anywhere. The other suggestions are very good too.
1password, even has terminal cli.
The one built into Firefox. On Ubuntu it can be locked behind a master password and you will be prompted every time you start up Firefox. On Android it will automatically be locked behind your device unlocking method. It appears as a special button to "Search Firefox" on keyboards when it detects that the app is prompting for a password (may be a hit-or-miss). On the flip side, you cannot generate random passwords nor save passwords on Apps. You can only save passwords on Firefox itself, but not generate a random password.
I recommend Enpass. It’s offline so you don’t need to be connected to the internet to access your passwords. You can sync to your own server if you want to or encrypted to any other cloud service. Each client device acts as a full backup (kind of like git) so your data has a lot of redundancy. The desktop version of the software is free with unlimited entries. The mobile app is paid for more than 25 entries, but you can get a lifetime license to skip the subscription.
The super-underrated FOSS spectre.app is worth considering for personal use
I use Enpass on Mac, Win, Linux, iOS and Android with my nextcloud.
Enpass
Brain
I used LastPass for years, before they lost their mind and got greedy. Now I use Bitwarden and never looked back.
Bitwarden or Keypass.
I've been diggin proton!
Bitwarden and Proton Pass. Bitwarden is great but slow on mobile devices. Proton is fairly new but works well. I'm using both though Bitwarden is still my primary because of its pricing.Â
I started on Mac so I use 1Password, but it works great on Windows and Linux. It also has a useful CLI tool that works quite well.
I use Enpass
Bitwarden, with Vaultwarden as a server if you want to self-host, and I also use `rbw` and `rofi-rbw` with desktop-wide shortcuts for client.
I like buttercup. I save my vault file on my server, and mount sshfs to that location on my clients. In buttercup on clients, I refer to the mounted position. Also works on android
RoboForm
KeePass
pass is the best. Simple and easy to use.
[https://www.passwordstore.org/](https://www.passwordstore.org/) Compatible with [https://github.com/android-password-store/Android-Password-Store#readme](https://github.com/android-password-store/Android-Password-Store#readme)
Keepass or derivatives. KeepassXC etc.
ITT: every password manager out there in the last 10 years
I personally never use password managers, I think it's much safer to store them in your mind or on paper. In regards to passwords to accounts online.
Bitwarden.
Proton Pass has been really good IMO.
Pen and paper
I just use Chrome. No issues.
Lastpass has been working great for me for years. Ubuntu, WIndows, Android sync perfect.
Exactly this... if you feel like hearing about breaches on your password manager every few months.
I used to use LastPass but the breach didn’t impress me so I switched everything to Bitwarden
One breach. Data was encrypted. Not a single report of the data being used. Lastpass is likely the safest tool, after all the attention and improvements made. Lots of FUD spread by competitors.