passit's free software, it's cli (because why should something like this have a gui?!), it uses gpg to encrypt/decrypt the password store and git to share it between machines.
https://www.passwordstore.org/
Honestly I prefer methods like SuperGenPass or Lesspass, which create passwords algorithmically based on a domain name. Nothing is stored anywhere.
It depends who you are. A fuller question would probably yield a more relevant answer. The 2 contenders from the comments are Bitwarden and Keepass*.
Summary: Most people should start with hosted bitwarden. Use that to import your old passwords from any browser or ad hoc storage method, and get into the habit of using the password manager. As you get comfortable, you will have a better context from which to understand any unmet needs. If you want to try to keepass* on top, it's not too hard.
Telling someone new to password managers to go straight to Keepass* is like telling someone who interested in getting a bike that they have to build their own fixed gear and immediately launching into a speech about how the dish of the wheel will be while truing it.
Both
- FLOSS
- You can more or less move between them. they don't work exactly the same so could be some complexities.
- pretty decent security overall as long as you use them properly
Bitwarden
- remotely hostd or you can you can run it yourself if you are that kind of nerd
- hosted is free or very low cost
- you are mostly limited to their suite of tools such as apps, browser extensions etc; not a lot of 3rd party stuff going on
- has sync via app/extensions without having to download and unlock your entire database on every device-- for example a work/public computer.
- has some organizational features like being able to share credentials with other people; handy if a family/work situation
- You will be able to use your own experience to show people around you they can use a password manager
- There is a business in charge of this project, which is good because it gets regular attention including security audits, but bad because the needs of business customers often et priority
- I believe there is/was some issues with components/upstream code being non-libre
KeePass*
- No hosting, no sync included
- It is a file you must keep track of. If you want to share your credential database on your phone and your computer, you need to figure out how to do that.
- Options: Syncthing, webdav (eg nextcloud), ?dropbox, ?google drive --- whatever you choose it must be reliable and available 100% of the time on every device you might need your passwords on. And not just a web interface. You will need a live synced file on every device on which you might need to make changes. And you must install or have a portable application that can decrypt and make use of the file on each device. You must have the ability to manage your chosen syncing across platforms and environments. Including any and all problems that could arise.
- It is a much larger ecosystem of tools so more options to find something you like to use.
- I don't think there are any/many businesses involved and the development is more community-oriented
- Whatever you get working is unlikely to be suitable for anyone else you know who isn't already a giant nerd
Bitwarden.
I love self-hosted Bitwarden, whenever my server goes down or there's a power outage and I'm out of town, my extensions and sometimes apps stop working and now I can't access my passwords. Currently experiencing this right now, I might switch to KeepassXC after this
Do the clients not download the required data from the server to be able to work offline? That'd a bit strange.
- KeepassXC: local storage, you're responsible for backing up and keeping your password database file safe. (Keepass is a open standard for passwords, so you can use any client that supports keepass files, not just KeepassXC)
- Bitwarden/Vaultwarden: web-based server-client password manager. You can use bitwarden.com if you want to just set it up and leave it.
Stay away from any password manager that's sponsored on YouTube or that's proprietary (if you can't find the source code anywhere, stay away!)
If you want to manage your own password vault, KeepassXC for desktop and KeepassDX for mobile, using syncthing for syncing. Vaultwarden is a option for a more involved self-hosted set up.
If you want someone else to manage your password vault, Bitwarden for desktop and mobile.
Those are the only meaningful options that I'm aware of if you want an open-source solution.
If you want to manage your own password vault, KeepassXC for desktop and KeepassDX for mobile, using syncthing for syncing.
Seconded.
oh snap you already mentioned syncthing. My whole ass post was irrelevant. Good taste. Good post.
Best of the best.
Stay away from those online password managers. Look into Syncthing (https://github.com/syncthing/syncthing) for synchronising your database(s) across your devices without needing to rely on cloud services. It works similarly to bittorrent tech afaik.
In 15 years when it suddenly becomes important for you to need the password so some site you logged into once with an email address you haven't used in 10 years, KeePassXC will still work on whatever OS you are on and probably look the same as it does now and your password database will just be a file you have saved on a bunch of your devices and probably some USB drives lying around even if you long ago got lazy about maintaining your backup synchronization etc.
None of the password as a service sites will still be around or if they are they will ransomed your passwords if you didn't pay some fee or other bullshit. The self-hosted ones you might still have a backup of but when you spin up the host there will be some out-dated dependencies or other bullshit that will make it a colossal effort just to retrieve a simple line of text.
Keep it simple use Keepass
If you're worried about that then you can export your bitwarden passwords on a regular basis and back that up however you want
I use bitwarden
I keep telling myself I'll switch to KeePassXC after I tell myself I'll switch to Linux
This, plus "oh, I'll set up a NAS, too, soon - I just need to save up for the equipment"
The equipment doesn't have to be crazy, a discarded laptop connected to AC power with an ethernet cord can act as a NAS.
Dedicated NAS hardware seems overkill.
I have a NAS and a server and I still use BitWarden. I'm not hosting email or passwords.
just like me fr (i'm gonna get myself the NAS stuff for christmas tho)
Depends on your level of technical skill. Avoid LastPass like the plague, their security is laughable. I used to use them until I got burned in their 2022 breach. Otherwise the two main ones I know of are Bitwarden/vaultwarden and the various forks of KeePass.
I use Bitwarden and I'm fairly happy with it. I use it hosted, but there's the option to self host via the official server or vaultwarden. Neither of which I have experience with, but it's nice that they exist in case of enshittification.
KeePass I'm less familiar with. Seems like you have to self host, and there's a few different forks floating around. Seems like a fairly significant investment of time and energy and I honestly don't trust myself to keep a self hosted solution secure anyway.
I think nextcloud also has a password module, but I know next to nothing about that.
Not only has LastPass had a couple of data breaches in recent years, they also changed their pricing so you now have to pay if you want to use their app on desktop and mobile. Basically, they're charging for what Bitwarden offers for free.
You don't "host" keepass, it's an encrypted file you keep synced however you want.
