+1 to Bitwarden, and in particular the Vaultwarden implementation.
I've been self hosting it for a number of years now and have never had to think about it ever again - it works, has clients for all my platforms, never had any issues.
It's great, but how can one trust the unofficial clients? They aren't from a well-known developer, and AFAIK, you can't check that the build is from the same code as the GitHub repo.
I wouldn't recommend it to anyone using Windows though as the one available Windows client is rather poor. I've been thinking of switching to something else after I got a Windows-based gaming PC.
I've tried pass 2 different times on 2 different versions of MacOS and both times it ends up eating tons of CPU and battery. I was never able to figure out what was happening so I just uninstalled the whole thing.
I moved away from 1Password after the developers essentially ridiculed their customers in their support forum. I realized that it's a hostile, aggressive and short sighted company. That they are engaging in this racist action against Russians helps assure me that I made the right decision.
Bitwarden has been a drop-in replacement for all intents and purposes.
People say a lot of nice things abotu Bitwarden, and it's got both self-hosting and hosted options.
TIL 1Password are also looking into a self-hosted option; maybe it'll happen if more people sign on to their survey: https://survey.1password.com/self-host/.
1Password started and currently has a self-hosted option. They are actively migrating to a SAAS model to justify monthly subscriptions instead of licenses.
Can you use your browser's native password manager? Chrome supports syncing of passwords. Just dump a bunch of gibberish into the password field when you register and let the browser do the rest.
Last year, CtrlBlog reviewed these password savers and found KeePassXC to be usable for a self-hosted password saver server and widest-platform client usages.
- Windows
- KeePassXC Offline for Android
- iOS
- Linux
I don’t need to use KeePass, though. There are over a dozen different forks of the KeePass project to choose from. I decided on KeePassXC for my Mac, Linux, and Windows computers; and KeePass2Android Offline for my Android phone. I decided on these two because they feel more modern and I’ve confirmed that they won’t easily suffer from synchronization conflicts.
+1 for Keepass, and on iphone imho by far the best client is Keepassium. Sometimes I think that it's the most craftsmanlike software which I ever use on any platform; it's really well designed and implemented. It basically assumes that you'll keep your password file in Dropbox or similar.
Moved to Bitwarden + Vaultwarden. It's pretty good! Firefox plugin doesn't work in private browsing. Browser plugins don't auto-sync. Other than that, I was pretty happy to ditch 1password as Agile Bits circles the drain.
The UI doesn't work in private browsing but you can autofill through the right click menu assuming the vault is unlocked already. Though sometimes it's a bit flaky and takes three attempts before it works.
Also curious what issues you've had with syncing, mine definitely sync at points and only occasionally require me to do a manual sync. Usually it's only an issue if I just added an entry on another device and want to immediately use it on another.
As there are many (and good) answers here, I may have missed one point - which I will raise: Check the fallback / fail scenario(s).
Here is my example: I've been using 1password since 2008ish. I've purchased every upgrade since then and even had more than one license. All was fine: Data was local, there was some backup method and some plain text export.
Some time ago, 1Password decided to go cloud and change to a subscription for using the software for new users. The client I have on my mac still works fine, but the only option was to "rent" the password management that stored my data on their servers.
The owners sugarcoated this in every way (pet peeve: Talking in their mails about something completly different like recipes, then "by the way, subscription only in 3,2,1 ...").
I will not buy into being fully dependent on someone else when it comes to access to all of my online and offline systems. And you should not, too. Same goes for any company.
So any of the suggested tools here should do two things: Work independent on an online/sync-connection (and be able to access/modify data untill online connection has been reestablished). And be able to export data in a format that can be transformed/read by most of the others.
I switched to my own local instance of Bitwarden (Vaultwarden) and use the client for any device I own. Switch took about half a day and I never looked back.
After trying for a test period the usual famous ones, and not being happy with anything (cloud crap, no memory encrypt, no clipboard cleaning - to just name a few) I decided to take a look at a few that were open source, learned their overall intricacies and started to code my own. At beginning nothing fancy, just a SQLite DB and simply focus on name field, system-wide shortcut for my manager to pop-up and then selecting the entry. Manager would type in the username, TAB to password field, then type the password there as well and press ENTER. That was the most rudimentary one and whenever some new web/app was not working I would see why and increase from there its code/logic.
After like 3 months I was happy with all I had the need for and very rarely, something like every 6 months, I would touch its code for maximum 2 days to make it work. It's being over 5 years at this point and use it daily on my several dozens web sites / desktop apps I need. During this time I never did a full refactoring or change its underlying business logic.
So my advice for you @vasachi, if you can, do the same. The satisfaction will be huge.
I'm currently moving to it, but may be I miss something, but it's absolutely primitive.
Is it possible to store anything but website/username/password there? I can shoehorn my ssh password like "ssh 1.2.3.4"/"username"/"password" into that scheme, but it's ugly.
Is it possible to store bank card PIN code? I'm storing it as fake website right now which is far from ideal.
I need to access all the necessary information from iPhone.
Use https://www.lesspass.com/#/ - I've found the approach very fresh. Of course, you have to be sure that master password is not leaked, but the same is true for any stateful password manager.
The real problem though is that it does not support hardware security tokens at the moment.
I've looked into this approach in the past. For me it really breaks down if any of your sites require you to ever change or rotate your password. Then you have to memorize or record the differences.
> Of course, you have to be sure that master password is not leaked, but the same is true for any stateful password manager.
I don’t think this comparison is accurate. With a vault-based password manager, an attacker would need the master password AND the vault. The vault is usually protected separately, either because it’s a file that’s non-public (e.g. Keepass), or because it’s a web service that’s rate-limited or otherwise monitored (e.g. 1Password Cloud).
Ah nice, I had this idea and was thinking of implementing it. This is probably a very scary idea for a lot of people, but the reality is that it's no different with regards to security than other approaches, but it's vastly simpler (which should be a win).
I can't speak to this specific implementation, but the reality is that if your master password is leaked you have to rotate every credential no matter what.
I’ve been using CodeBook for several years and have been pretty happy with it. One time cost (per OS) and can sync over WiFi or to Dropbox/google drive. No browser plugins, instead it provides a global hot key activation which authenticates you (Touch ID or password), lets you search for the account then auto-types the password. On iPhone it integrates well for providing passwords to sites and they just recently added a feature which will also auto-copy 2FA TOTP into clipboard if one exists.
I use gopass and Gopass Bridge for password filling in firefox. It works great, and for the keys I'm using yubikeys gpg mode, so my passwords are actually locked with a hardware key.
I’ve been using an app called Secrets for iOS and macOS for close to a year. A one time purchase, easy syncing, and other items like secure notes and software licenses can be stored. They also have import from 1Password. Excellent experience so far, almost a complete 1:1 analog of 1Password. Command + \ to auto-populate fields works, maybe not as smoothly. For the money Secrets charges I’m satisfied knowing that after a year, I’m saving.
Personally I'm not sure that low price is a decision factor for secrets management. :)
I'm willing to pay good money for a good product in this area. (I've said elsewhere I'd probably even be happy to pay 1P subscription if they didn't also do everything they could to prevent me using anything but their cloud.)
[+] [-] elliotpage|4 years ago|reply
I've been self hosting it for a number of years now and have never had to think about it ever again - it works, has clients for all my platforms, never had any issues.
[+] [-] 2dvisio|4 years ago|reply
[+] [-] ohCh6zos|4 years ago|reply
[+] [-] Pooge|4 years ago|reply
I'd recommend setting a very strong password, with a key (you can generate one when you create the database) and a long decryption time.
If you need help setting strong passwords, I recommend EFF Dice-Generated Passphrases[1].
[1]: https://www.eff.org/dice
[+] [-] wildrhythms|4 years ago|reply
[+] [-] GTP|4 years ago|reply
[+] [-] enricozb|4 years ago|reply
There are also (unofficial) iOS and Android clients that sync to a git repo.
[+] [-] joconde|4 years ago|reply
[+] [-] avh02|4 years ago|reply
[+] [-] m4lvin|4 years ago|reply
[+] [-] Hamuko|4 years ago|reply
[+] [-] frogperson|4 years ago|reply
[+] [-] andreareina|4 years ago|reply
[+] [-] keeperofdakeys|4 years ago|reply
[+] [-] lifthrasiir|4 years ago|reply
[+] [-] someotherperson|4 years ago|reply
I moved away from 1Password after the developers essentially ridiculed their customers in their support forum. I realized that it's a hostile, aggressive and short sighted company. That they are engaging in this racist action against Russians helps assure me that I made the right decision.
Bitwarden has been a drop-in replacement for all intents and purposes.
[+] [-] deepsun|4 years ago|reply
https://en.wikipedia.org/wiki/Eugene_Kaspersky
[+] [-] vasachi|4 years ago|reply
[+] [-] rcarmo|4 years ago|reply
(In short, I’ve switched to Secrets while keeping an eye on new KeePass apps, because I don’t want to use or run any kind of service)
[+] [-] bradley_taunt|4 years ago|reply
[+] [-] kmfrk|4 years ago|reply
TIL 1Password are also looking into a self-hosted option; maybe it'll happen if more people sign on to their survey: https://survey.1password.com/self-host/.
[+] [-] nahname|4 years ago|reply
[+] [-] mstef|4 years ago|reply
pro: it has much stronger security guarantees than the rest, it's self-hosted, but you can use other peoples servers!
cons: there is no UI frontend for macs, and UI integration in browser could also be improved.
(i'm the author, ama)
[+] [-] paulryanrogers|4 years ago|reply
[+] [-] staticassertion|4 years ago|reply
[+] [-] gtf21|4 years ago|reply
[+] [-] egberts1|4 years ago|reply
- Windows
- KeePassXC Offline for Android
- iOS
- Linux
https://www.ctrl.blog/entry/keepass-vs-bitwarden-server.html[+] [-] avn2109|4 years ago|reply
[+] [-] paulryanrogers|4 years ago|reply
[+] [-] xanaxagoras|4 years ago|reply
[+] [-] pmlamotte|4 years ago|reply
Also curious what issues you've had with syncing, mine definitely sync at points and only occasionally require me to do a manual sync. Usually it's only an issue if I just added an entry on another device and want to immediately use it on another.
[+] [-] kappuchino|4 years ago|reply
Here is my example: I've been using 1password since 2008ish. I've purchased every upgrade since then and even had more than one license. All was fine: Data was local, there was some backup method and some plain text export.
Some time ago, 1Password decided to go cloud and change to a subscription for using the software for new users. The client I have on my mac still works fine, but the only option was to "rent" the password management that stored my data on their servers.
The owners sugarcoated this in every way (pet peeve: Talking in their mails about something completly different like recipes, then "by the way, subscription only in 3,2,1 ...").
I will not buy into being fully dependent on someone else when it comes to access to all of my online and offline systems. And you should not, too. Same goes for any company.
So any of the suggested tools here should do two things: Work independent on an online/sync-connection (and be able to access/modify data untill online connection has been reestablished). And be able to export data in a format that can be transformed/read by most of the others.
I switched to my own local instance of Bitwarden (Vaultwarden) and use the client for any device I own. Switch took about half a day and I never looked back.
[+] [-] BlackLotus89|4 years ago|reply
For personal use keepassxc and syncthing. Keepassdx on android.
Edit: enterprise is self hosted. Keepassxc with syncthing doesn't need hosting
[+] [-] unnouinceput|4 years ago|reply
After trying for a test period the usual famous ones, and not being happy with anything (cloud crap, no memory encrypt, no clipboard cleaning - to just name a few) I decided to take a look at a few that were open source, learned their overall intricacies and started to code my own. At beginning nothing fancy, just a SQLite DB and simply focus on name field, system-wide shortcut for my manager to pop-up and then selecting the entry. Manager would type in the username, TAB to password field, then type the password there as well and press ENTER. That was the most rudimentary one and whenever some new web/app was not working I would see why and increase from there its code/logic.
After like 3 months I was happy with all I had the need for and very rarely, something like every 6 months, I would touch its code for maximum 2 days to make it work. It's being over 5 years at this point and use it daily on my several dozens web sites / desktop apps I need. During this time I never did a full refactoring or change its underlying business logic.
So my advice for you @vasachi, if you can, do the same. The satisfaction will be huge.
[+] [-] monkeymonkey|4 years ago|reply
[+] [-] vbezhenar|4 years ago|reply
Is it possible to store anything but website/username/password there? I can shoehorn my ssh password like "ssh 1.2.3.4"/"username"/"password" into that scheme, but it's ugly.
Is it possible to store bank card PIN code? I'm storing it as fake website right now which is far from ideal.
I need to access all the necessary information from iPhone.
[+] [-] iisaev|4 years ago|reply
The real problem though is that it does not support hardware security tokens at the moment.
[+] [-] ytjohn|4 years ago|reply
[+] [-] jotaen|4 years ago|reply
I don’t think this comparison is accurate. With a vault-based password manager, an attacker would need the master password AND the vault. The vault is usually protected separately, either because it’s a file that’s non-public (e.g. Keepass), or because it’s a web service that’s rate-limited or otherwise monitored (e.g. 1Password Cloud).
[+] [-] staticassertion|4 years ago|reply
I can't speak to this specific implementation, but the reality is that if your master password is leaked you have to rotate every credential no matter what.
[+] [-] princevegeta89|4 years ago|reply
[+] [-] filt|4 years ago|reply
https://www.passbolt.com/
It's gully open source, with a AGPL license.
https://github.com/passbolt/
[+] [-] neandrake|4 years ago|reply
https://www.zetetic.net/codebook/
[+] [-] SahAssar|4 years ago|reply
[+] [-] aorth|4 years ago|reply
I am tempted to try gopass, but if pass is good enough for Jason Donenfeld it's good enough for me!
[+] [-] ppetty|4 years ago|reply
[+] [-] b3morales|4 years ago|reply
I'm willing to pay good money for a good product in this area. (I've said elsewhere I'd probably even be happy to pay 1P subscription if they didn't also do everything they could to prevent me using anything but their cloud.)