A loosely moderated place to ask open-ended questions
If your post meets the following criteria, it's welcome here!
Looking for support?
Looking for a community?
~Icon~ ~by~ ~@Double_[email protected]~
I use KeepassXC which is free and open-source. The passwords are stored as an encrypted file on your own system. No servers or businesses involved.
Personally I put mine in onedrive so it is synced between all of my devices though, so I guess there is still a server involved in that case
KeePass is really good. I use Keepass DX on my phone and use syncthing to sync them. Works amazing.
+1 for keepassxc + syncthing
Also generally recommebd syncthing as a replacement for cloud storage for you phone pics and music and stuff.
Samesies!
One very important word of caution (unfortunately coming from experience): Syncthing, as the name suggests, makes it so the content of one device is the same as that of another device. So, even if you have one device set to only receive data, it means that if you delete a file from the sending device, the receiving device will also delete that file to stay in sync with the sending device.
There is a way to use Syncthing as a simple backup storage program (not necessarily the best solution but much better than manually backing up your files every few months and just hoping for the best). But it means that you have to use the advanced folder option "ignoreDelete". I also use the file versioning system, so even if something is automatically deleted by mistake, it's still versioned in a special subfolder and accessible to me.
Samesies. KeePass works great for me as well, storing it on a server so it's accessible for both phones (using KeePassXC), and desktop using the web app for keeweb.info (app.keeweb.info).
KeepassXC is great, but I realised very late in the process of setting it up, that the browser extension does not support Flatpak based browsers: "Please note that in general Flatpak and Snap based browsers are not supported, Ubuntu's Firefox Snap being an exception." (https://github.com/keepassxreboot/keepassxc-browser/wiki/Troubleshooting-guide)
I hope this might change at some point.
I think I ran into that exact issue myself when I tried out fedora silverblue. I believe there was a workaround but it was quite involved from what I remember...
KeePass on sandstorm
One virtual server hosts all my open source apps, including my pw manager. It's insanely great.
https://apps.sandstorm.io/app/rq41p170hcs5rzg66axggv8r90fjcssdky8891kq5s7jcpm1813h
I use and like Bitwarden and afaik you can self host a fork(?) too
You can self host vaultwarden and use the bitwarden clients
I’m happy with Bitwarden, the iPhone app and windows software / Firefox extension all work seamlessly and easily
You can self-host Bitwarden, too. My understanding is that VaultWarden is much simpler to self-host, though. Note that VaultWarden isn’t a “fork”; it’s a compatible rewrite in Rust (Bitwarden’s codebase, by contrast, is primarily C#).
I also use Bitwarden and strongly prefer it over every other password manager I’ve tried or investigated, for what that’s worth. I’d recommend it to 99% of non-enterprise users (it’s probably great for enterprise use as well, TBF).
The only use case I wouldn’t recommend it for is when you don’t want your passwords stored in the cloud, in which case KeePass is the way to go. To be clear, that recommendation does not apply if you’re syncing your vault with a cloud storage provider - even one you’re hosting, like SyncThing - even if your vault is encrypted. At that point just use Bitwarden or VaultWarden, because they’re at least audited with your use case in mind (Vaultwarden has only been audited once afaik, though).
+1 for bitwarden
+1 for bitwarden as well
+1
Bitwarden paid version also lets you set emergency access for others in the case of your death or inability to access
Bitwarden.
You know if you need more than that and if you’re asking on lemmy you don’t need more than that.
Vaultwarden. It's FOSS Bitwarden. Host it on your own server/machine :)
I would recommend people not do that unless they know they need to and again, if you know you need to you’re not asking on lemmy.
Hosting your own secrets not only puts the burden of protecting, providing access to and preserving the secrets entirely on you, but puts a very unique set of hosting goals squarely on you as well.
Even a skilled administrator with significant resources at hand would often be better served by simply using bitwarden instead of hosting vaultwarden.
An example I used in another thread about password managers was a disaster. When your local server is inoperable or destroyed and general local network failure makes your cloud accessible backup unreachable, can you access your secrets safely from a public computer at the fire department, church or refugee center?
Bitwarden works well from public computers and there’s a whole guide for doing it as safely as possible on their website.
Use KeepassXC with Syncthing for maximum autonomy or Bitwarden for maximum ease. Both are FOSS. That's my recommendation and also seems to be the consensus among those who share your needs.
I've haven't looked at KeepPassXC before. I'll check that out today.
I'm a massive fan, and long time user, of bitwarden.
It's so much better since they updated the (IMO) ugly, dated UI design. It looks nice and fresh now. Bitwarden is the MVP.
KeepassXC. Sync the file however you want.
diy synchronizing sucks ass. i can never get anything to do it right
Syncthing. I'm not sure what I'd do without Syncthing at this point.
I recommend Keepass. It's freeware, is available on all platforms and supports biometrics (fingerprints, etc) on Android devices. It also encrypts the password file on your device, so you can keep a copy of that file on a cloud service without worrying if that service really respects your privacy or not.
This is perhaps overkill, but you can also encrypt the contents of your online cloud storage with CryFS / Cryptomater. This is particularly useful if you wish to store sensitive documents (healthcare, finances etc) in a cloud environment in case of catastrophic destruction of property (destroying computers / on site backups of data).
In this case you can also backup your keepass file in this encrypted virtual storage medium, on top of the prexisting encryption of the database itself.
Bitwarden.
If you want to keep it in a file you want to sync yourself: keepass
Keepass + Syncthing is an undefeated combo
I use Keepass but I recommended Bitwarden to less nerdy family members as it syncs out of the box & does what they need it to do. Sync is simple enough to set up with Keepass & the big plus for me is that it allows storage of files/documents. Last time I checked this was a limited/paid feature on Bitwarden
Definitely Bitwarden
My personal choice right now is KeePassXC (PC) / KeePassDX (Android) + Syncthing And Aegis (Android) for 2FA codes, with a yubikey for services that support FIDO keys.
Overall I like this setup because it's decentralized and does not rely on a third party server structure. The only "weak" point would be the Syncthing relay servers or the Tailscale VPN that I use, but this goes back to ensuring encryption of the database is adequate with a long password, and using an open source synchronization protocol that ideally has been vetted by a trusted third party (or yourself if you're capable)
I used to use Bitwarden, and I highly recommend it. I really appreciated it's ability to integrate with email aliasing solutions to generate new aliases from within the bitwarden UI itself. However, my main reasons for switching were the following
The only additional advice I have for both recommendations is that I do not think it advisable to add Totp 2fa information to your password manager even if it supports it. I feel like this should be separate, on a single device, and backed up in ~2 locations (one preferably off site). This is really to avoid problems if a device is compromised and if your password manager is compromised, but this is definitely in the more unlikely category I feel.
My only major issues with keepass are the potential for sync conflicts and the some feature differences between platforms. A centralized server config like vault/bitwarden prevents the sync conflict issues, at the cost of having one point of failure. The feature differences problem isn't too great, but autotype doesn't work on Linux if you install with flatpak, and you can't prevent screen capture of the app on Linux (only on Android and Windows from my understanding)
Edit: I also tried gopass, it's really fun to have an entire CLI based password manager, but frankly the state of mobile companion apps are appalling. The Android option only is good if you use a dev version, and the iOS one I thought was just ok. I also dislike the metadata leaking that is inherent to the format, and that PGP is the main form of encryption for the time being (some clients were looking at using AGE at some point). Overall it's a cool but flawed concept, and I feel my other two recommendations are superior.
I pay for a 1Password family account. I like it.
Getting the family to use it is hard, but that would be the case with any password manager.
I understand there’s a bit of of bias here, but I’ve been using 1Password for probably 10+ years and have literally never had a problem. Transferred between multiple devices, added family, etc.
Solid as hell and super reliable.
Selfhost if you want, but I’ll take the reliability.
I do selfhost everything I can, but have chosen not to do that with my passwords. It feels to much all-eggs-in-one-basket-y.
1Password also holds my SSH keys and acts as an ssh-agent on most systems, and I also just found out that you can get secrets from your 1Password vault in Python, which means my PyInfra scripts can use it as well.
KeepassXC + webdav
Keepass
I use bitwarden for unimportant ones and an offline one for important ones. specifically KeepassXC that was already mentioned.
I'd used KeepassXC + Nextcloud to sync for ~4 years.
Then I switched to Bitwarden client + self-hosted Bitwarden Server/Vaultwarden for ~2 years and I haven't looked back.
The problem you'll face with KeepassXC + any syncing mechanism is that conflicts will happen. Meaning, you'll make a change on your cellphone, your internet has a hiccup or stops working. Then you make a different change on you desktop. When everything is synced, you'll be left with a KeePass conflict file that you need to fix. This might be fine if you immediately notice it, but if you stumble upon a conflict file from a month ago - good luck merging the differences.
Bitwarden client + Vaultwarden has improved my password experience radically. I have phones, laptops, browsers, etc all talking to Vaultwarden. Any conflicts are handled automagically by the clients. Everything "just works" in offline mode (meaning I can add/update credentials while offline and it'll update the server whenever it can - without needing to do any mental gymnastics).
I can share passwords with friends and family without needing to share everything. Plus, as my instance is self-hosted, my family can get "emergency access" (would be a "premium feature") to my passwords if something unfortunate happens to me. Plus, requesting emergency access is pretty easy to do, for non-tech people.
edit: a word
Also voting for bitwarden
No one has mentioned pwsafe, which was originally created by Bruce Schneier and is still maintained.
Been a Bitwarden user for several years now, both personal and deployed at multiple small businesses.
It has been fantastic the whole time. Pricing is great, open source, runs on basically everything, and easy to use.
KeypassXC if you're uber-paranoid or a hardcore Stallmanite, otherwise, Bitwarden all day 100%
KeepassXC + syncthing
Fully under your control
iOS users, i guess the best option available is self hosted Bitwarden
Unfortunately LastPass had some issues over the past years with hacking where encrypted vaults were stolen. Between myself and my friends in tech, I know of a few conpanies that ditched it after that.
For individual/personal use, I'd reccomend KeePass (whatever fork of it is up to date and maintained lately) and using somethung like syncthing to sync it across devices. That may not be super user friendly for non-technical users though, and I'm not sure how well it works with iPhones.