PasswordManagement: which one of these options would you choose?

Keepass on phone, desktop and tablet. Sync serverless via Syncthing.

• completely private
• always available when needed
• no dependency on services which may go away
• all open source software
• maximum security

Keepass + syncthing.

Don't let your vault go unencrypted through the cloud.

I'm very happy with self-hosted Vaultwarden.

I use option 1 with Syncthing for a distributed cloud solution

Keepass fIle in my own nextcloud instances, synced to my phone so I can also use keepass2android. This way if something happens I at least have another copy of it, beyond my backup system.

Vaultwarden behind mutual tls and reverse proxy and https://github.com/oguzhane/bitwarden-mobile until https://github.com/bitwarden/mobile/pull/2629 is merged

But honestly all services you mentioned are worthy.

Anything that fits your needs imao

I used to self host Bitwarden, but didn't want the hassle of securing it and updating it properly and consistently. So I just pay $10 for bitwarden premium and I get to support the company.

I've used Option 1 with my Nextcloud and it works perfectly. Other options seem more apropriate when you need scale, many user each with their own vault.

Option 2. It's the most robust. You'll never lose it (provided you have the redundancy), you can use it offline, you can transfer it using a USB pen, it's available in all platforms, including web. I've been using this for 8+ years, on my phone, desktop, laptop, company computer, etc. I store it on a personal cloud (and on each machine, of course, by syncing).

Option 1, KeePassXC plus SyncThing, done. Works amazing on all my devices.

I use and prefer option one, but take it a step further in that I host my own cloud service. I used to use Dropbox for years, but we got divorced.

Host your own bitwarden

Option 2: 1Password

pass https://www.passwordstore.org/

I used option 1 (KeePass synced to Google Drive) for years. It's nice that you know you have control of your passwords at all times, and as long as you can access your cloud storage account and can download a KeePass app, you can get your passwords. It works reasonably well most of the time, but I was consistently running into edge cases that weren't as smooth as I'd have liked (mostly apps on Android)

I switched to vaultwarden (option 3), and immediately fell in love with things mostly just working. However, since I was hosting it out of my house, I had a bit of a disaster recovery problem. If i had say a fire, I could easily lose all copies of my vault, which would be... suboptimal.

After reviewing the options, I switched to straight bitwarden. I've been happy with the experience, and once I have disposable income, I plan to get pro long enough to have emergency contacts available so my family can still get important passwords in case of the worst.

All options have their pros and cons, but IMO password storage is something that deserves to be given proper consideration.

Option 1

Vaultwarden. And take regular back ups. I don't trust my passwords to be safe anywhere other than my own servers. The chances of my server being hacked is very less.

Bitwarden for me. My password manager is not just for me, it's also a crucial component of my family life so if something happened to me I want my next of kin to be able to access it

For that it needs to be an easy to access solution.

Bitwarden+vaultwarden, harden the chosen VPS, set SSH to use keys only, then setup fail2ban for webserver and ssh Also consider putting ffsync on it as well for extra browser benefits.

Option 3: Vaultwarden + Wireguard.

I don't have to worry about attacks from the internet. And a single wireguard connection on my phone sometimes doesn't even appear on the battery stats.

Edit: Browser addons need valid ssl certificates, which I get by dns challenge.

Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I've seen in this thread:

7 acronyms in this thread; the most compressed thread commented on today has 4 acronyms.

[Thread #173 for this sub, first seen 28th Sep 2023, 18:45] [FAQ] [Full list] [Contact] [Source code]

Option 4: levy existing tools such as gpg and git using something like pass. That way, you are keeping things simple but it requires more technical knowledge. Depending on your threat model, you may want to invest in a hardware security key such as a yubikey which works well with both gpg and ssh.

If you work for a company that uses a reasonably good manager such as BitWarden, you should look into whether or not you get it for free or reduced. For the moment, at least, I use Bitwarden because I get it for free (and a families sub to boot!). I know 1password does the same; others might too. Do make sure you’re okay with paying the full price for a period of time in case you get laid off and have to migrate. Also make sure you’re okay with any compromises you make for the price tag. There is no price tag that makes LastPass acceptable, for example.

I use option 1, I host my keepass db file on a free secure nextcloud storage account, and use nextcloud client to keep it synced to all my devices. It's available offline on all of my devices too, in case the server goes down. I use KeepassXC on my PCs and KeepassDX on Android, to open the files.

I do keypassXC and Syncthing. It’s cross platform with only a couple bucks needed for lifetime access to all all necessary features depending on platform. Besides I use Syncthing for a bunch of other stuff as well, so it fits right into my flow. I’m considering moving to a command line tool simply called Pass, and still syncing with Syncthing, but I’ve yet to pull the trigger on that switch yet.

I use keepassXC and sync across my devices with nextcloud and VPN to my home network with wire guard and this setup has never failed me.

I've toyed around with passbolt, and I really want to try because it just looks cool to me, but I keep having trouble with it playing nice with my reverse proxy.

My personal preference is hosting it myself on my own server and using a VPN to get to it. It gives me peace of mind because I'm not a big enough target for someone to try that hard to get my passwords and I'm not exposed to bitwarden or dashlane getting breached.

Personally I'm running option 2 with self hosted bitwarden. Sure, it's a bit more effort to make it work and while it's not perfect that's what I've ended up with. The most convinient thing with that is that I can access my passwords whenever I have internet access with a browser without any need to install any software on the thing I'm using. Obviously that doesn't mean that I'll happily access the vault with whatever free-to-use endpoint I happen to encounter but it also gives an option to access whatever even if I'm borrowing a computer from a (trusted) friend and once I close the private window I used it's gone. And even more often, when I'm accessing my credentials from a family shared computer, I can just log out and I don't need to do any cleanup on the host which might get infected by our kids browsing something malicious or some other breach of security.

With keepassxc I'd need to worry about the database file, which is a bit different than logging out and closing browser. Your usage patterns might be different, but web-based hosting solution works for me.

Having gone through all of these options I have thoughts.

Option 1 sounds awesome but will almost always leave you in a situation where you can’t get your logins when you need them in an emergency. You’re always depending on a chain of things. Depending on your situation it may not be a big deal. But this option sucks, imho.

Option 3 sounds amazing because it gives you the control of option 1 with the ease of option 2. But… unless you’re the kind of person that enjoys hosting their own email server you really don’t want this option. Fun in theory but not so much when you realize you now have a 3rd job.

So that leaves option 2. It’s great but you’re depending on someone else. This is the option that most people should choose too, imo. However it lacks some of control and trust that option 1 and 3 have.

Sooooo, that leaves us with option 4, the onion option. Breaking up your data into layers and using different tools for them.

So first and foremost I want my password storage to always be available. For me that means Bitwarden, (though I’m evaluating protonpass currently.) this is the outer layer. Things that can and should be stored here are stored here. I use it to manage web logins and 2FA tokens for those sites. I also use it for storing autofill data eg credit cards. I don’t use it to hold things like my gpg keys.

Next layer is pass. This layer is mostly things that I need to have logins or other information on headless/remote servers. Think self hosted lab services like a mariadb/postgres or backups. This is easily kept in sync with git. This is the layer where I’ll store things like gpg keys and other VERY sensitive data that I need to sync around.

For other things on this layer I use ansible vault. This is mostly used for anything where I need automation and/or I don’t want too or can’t easily use my yubikey for gpg. This is kept in sync with git as well.

Lastly the inner layer I use AGE or PGP. This is for anything else I can’t use the above for. So my Bitwarden export/backups are in this level too. I also use this layer for things that I need to use to bootstrap a system. Think sensitive dotfiles. This can be kept in sync with git as well.

Git is the best sync solution imo because you can store it anywhere and use anything to sync that repo. Just throw that raw repo on Dropbox, use ssh with it on a vps, rsync it, etc. you’ll always have it somewhere and on something.

My work flow goes like this Bitwarden -> Apple/Google/Firefox -> Pass -> Ansible -> AGE/PGP

This allows for syncing things as needed and how needed. It also gives you the option of having an encrypted text file if/when everything fails.

Option 2 would be your best bet. Great balance between security and convenience. Bitwarden is my go to because afaik it stores every detail encrypted (unlike mainstream PWs) and when you open your vault, the database gets transferred to your pc and is decrypted locally. Its essentially the same as option 1, just 1000x more convenient.

Id only selfhost vaultwarden if you want bitwardens premium features, if you dont then youre maintaining a service which you wouldnt really need. Not to mention if you selfhost on a machine on your network, you have to deal with exposing that machine to the internet, not really worth it imo.

I've been happy with Keeper

I use option #1. Each instance of KeePass maintains a local file, but updates them automatically whenever it opens or closes. I also back up the file to my personal server automatically, so I have a copy even if the cloud service fails for some reason.

This setup has been serving me well for a long time.

I choose keepassXC stored locally

Option 1, with manual copying to mobile. I tried syncthing in the past but had problems with corrupted files

I went from Keepass synced via NextCloud (self hosted) for years... to trying out Bitwarden (their servers) and found the experience much better... then I switched to Vaultwarden via Docker going through Cloudflare Tunnel (with zero trust email authentication required) and fail2ban added. I'm content with the last option.

Why not Keepass on a webdav server? Both Keepass on the computer and Keepass2Android can open the file directly. If you save it on one it will merge the changes in any other copies you have open.

I'm currently hosting vaultwarden on my rack, mostly just because I can really. It's easy enough and I have plenty of resources.

I never understood how storing your password in an unified storage is better than just remembering it yourself

I've been using option 1 for many many years. It lets me keep control of the encryption, and it's accessible just about anywhere.

Option 1, except for the cloud bit. My KeePass file is stored in a restricted shared folder on my home file server, and auto-syncs to my phone on the rare occasion I update it from my desktop.

For highest security don't store in cloud or multiple places. Memorize them or keep a separate device that has no intermet access and keep them on that device encrypted/locked

Been using option 3 but with Bitwarden for almost 5 years at this point. First started out on a VM in a cloud provider. Now it's in a VM on unraid behind a local HAProxy or Cloudflare tunnel for remote access.

Bitwardens full docker stack provides great daily backups which I've had to restore on occasion or go back to one from months ago to dig out a password for my wife.

Been testing and hoping to move to the unified-container from them soon, assuming I can replicate encrypted backups like their solution.

Option 2, because once you start thinking about the ways your stuff could be stolen ("threat modelling") you'll see that realistically it's the easiest option.

I switched to proton pass after using bitwarden for a couple years

To improve security of option 1 you could use a keyfile, that is either only transferred manually to devices or stored at a second cloud provider.

Apple keychain. Supposedly secure, extremely convenient, may be in the Cloud but not centralized - can’t lose everyone’s credentials at once.

The plug-in for Windows works pretty well too, although I wonder if that puts my confidential data at more risk

I did option 1 for a number of years but now I'm doing option 3 off a proxmox container and some cloud scripted backup. So far so good.

We just started doing option 3 at work and just keep it behind the firewall. It is going well so far.

I like Enpass. $25 lifetime sub via Stack social. Does the trick. If they ever pull the rug out on lifetime folks, I would go to Bitwarden.

I like LessPass, essentially you choose one password and then it generates secure passwords for each website, since it uses a predefined generation algorithm it's completely offline and doesn't need syncing it's very secure. However it has the inconvenience of needing to remember the way you spelled the website, but if you stick to something like all lowercase it's fine.

I'd never store my passwords in the cloud.

I do 3 and have encrypted backups to Dropbox so I can easy restore/spin up a cloud server if I need to

Lastpass /s

I keep my passwords in Google. Unencrypted of course

I'm currently using KeePassXC. The setup that I created below gives me 3-backups of my passwords, but it's a bit to manage.

Computer

On my computer, I have my keepassxc database and key file stored in a veracrypt container. Next to my computer, I have a piece of paper that has the password for my keepassxc database and the password for my veracrypt container.

computer -> veracrypt container -> keepassxc database AND keepassxc key file

paper -> keepassxc database pw AND veracrypt pw

KeePassXC Export File (text file that contains all of my login information)

I store this file inside of a veracrypt container, on my USB LUKS. Next to my USB LUKS, I have a piece of paper that has the associated veracrypt password.

usb luks -> veracrypt container -> keepassxc export file

paper -> veracrypt pw

Cloud

I store my database in cloud service a.

I store my key file in a veracrypt container, in cloud service b.

On a piece of paper, I have the login information to both of these cloud accounts and the password for the veracrypt container.