Evaluation of five password managers

In the end I&#x27;ve just been using the Unix pass password manager [1].<p>It&#x27;s just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don&#x27;t know &#x2F; understand.<p>[1] <a href="https:&#x2F;&#x2F;www.passwordstore.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.passwordstore.org&#x2F;</a>

I wonder, why not a single word has been spoken about Keepass&#x2F;X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.

&gt; Mac OS, Windows, Linux, Android, and iOS ... full functionality can’t be dependent on an app which is only available on Mac OS and&#x2F;or Windows. In other words, lack of full Linux support is a show-stopper for us. This ruled out 1Password...<p>...Huh? 1Password supports all of those platforms (including Linux) <a href="https:&#x2F;&#x2F;1password.com&#x2F;downloads&#x2F;linux&#x2F;" rel="nofollow">https:&#x2F;&#x2F;1password.com&#x2F;downloads&#x2F;linux&#x2F;</a>

Just idle curiosity, but I&#x27;d be curious to see BitWarden&#x27;s commit on GitHub:<p>&gt; ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix <i>seventeen minutes later</i>, and just a few days after that the fix was released to the public.

For me an important selling point of 1Password was that their software looks like native Windows software and native iOS software while Bitwarden is just Chrome wrapper or something like that for desktop and C# for mobile and I don&#x27;t want to support that kind of cross-platform software.

Glad to see Bitwarden up on top. They tick all the boxes for me - open source, transparent security (including recently published audit), feature-rich, optional self-hosted, and easy to use.

No mention of enpass.io, i found their method to be completely safe. Encrypted sqlite files, shared across Dropbox&#x2F;onedrive&#x2F;Google-drive.<p>Apps used for Mac, Linux, windows, browser integration also works fine. All boxes are checked, don&#x27;t know why isn&#x27;t it popular among masses or nerd community.

Hi folks,<p>That&#x27;s a thorough comparison. I just wanted to make an attempt on why someone should consider using Zoho Vault for password management.<p>Zoho Vault is an online password manager for teams, used by more than 20,000 small and medium sized companies across the globe. We offer client-side encryption, multi-platform support, auto-fill, auto login websites and cloud apps, fine-grained password sharing, bulk folder sharing with user groups, audit, reports, two-factor &amp; multi-factor authentication, US&#x2F;EU data centers, browser extensions (Chrome, Firefox, Safari), and mobile apps (iOS, Android, Windows), option to maintain personal vault.<p>Integrations: G Suite, Microsoft Office 365, Zoho Mail, Zoho Desk, OKTA, OneLogin, Single Sign-On for 90+ Cloud Apps, Windows Active Directory&#x2F;LDAP, Azure Active Directory<p>Disclaimer: I work for Zoho Vault. If you need a comparison document of Zoho Vault with any product, drop an email to support@zohovault.com.

&gt; Yubikey support in browser (Personal) BitWarden: no<p>huh? I use my yubikey in the Bitwarden browser extension.<p>Otherwise, a very extensive collection of comparison data. Not surprised to see Bitwarden come out on top.

What did you find changed in lastpass after the logmein acquisition? We&#x27;ve been using lastpass since before the acquisition, and i can&#x27;t say i&#x27;ve noticed any substantial changes (either positive or negative)

I rarely see it mentioned, but when 1Password changed to a subscription model I switched to Enpass (<a href="https:&#x2F;&#x2F;www.enpass.io" rel="nofollow">https:&#x2F;&#x2F;www.enpass.io</a>) and I&#x27;ve been very happy with it.

I&#x27;m surprised there was no mention of recent security audits.<p>BitWarden just famously had one.

Question about bitwarden: I found this issue saying there are no tests. <a href="https:&#x2F;&#x2F;github.com&#x2F;bitwarden&#x2F;core&#x2F;issues&#x2F;399" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bitwarden&#x2F;core&#x2F;issues&#x2F;399</a><p>Also in the comments here someone said there are no tests. Does anyone have any info about that? I am interested in the software but no tests would be worrying. (Had no time to browse the code yet.)

As I want to protect all my passwords offline at one place but have them also available mobile, I developed Authorizer.<p>It is an Android password manager based on PasswdSafe with USB HID keyboard support to enter paaawords automatically on any device. Also stores TOTP&#x2F;HOTP.<p>The idea is, to have a complete offline device (hardend android without network stack&#x2F;always flight mode on, baseband overwritten, ...).<p><a href="https:&#x2F;&#x2F;github.com&#x2F;tejado&#x2F;Authorizer" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;tejado&#x2F;Authorizer</a>

This SAAS bias is untenable. &quot;Use a big target&quot; they say. &quot;Store them with a big company&quot; they say. &quot;Give your data to someone, let them worry about it&quot; they say. Meanwhile, breach after breach tells us that regardless of security, the likelihood of successful attack comes closer and closer to 1 as the size and exposure increases.<p>It&#x27;s likely that these services have already been zerodayed, and we&#x27;re just waiting for the shell to drop on an upswing.

I like the functionality comparison but I&#x27;m really curious how they stack up to each other security wise.

I&#x27;m using Chrome&#x27;s built-in password manager. What are the drawbacks besides it being Google?

One feature I didn&#x27;t see mentioned—LastPass has a Bookmarklet that can be used in leu of a proper extension. This means that if I ever decide to start using a random niche web browser, I won&#x27;t have to start copying and pasting from a web vault in order to log in to sites.<p>The freedom to do this is important to me regardless of whether I ever actually use it.

My personal password manager: GNUPG-encrypted text file (org-mode). No extra fuss.<p>Reason? I have too much code to look&#x2F;trust to add more and I do not keep log-in anywhere during my day, I do my best to avoid web-(cr)app as much as I can and try to live asynchronously connects via Emacs, being capable of operate as much as I can offline...

No keepass? Disappointed.

Has anyone gone through the process of switching? I use Keeper for personal stuff, and I suppose there&#x27;s always the chance to switch if one turns out to be technically or politically much superior, but there are dozens and dozens of passwords in there to transfer...

I only found out about Bitwarden a few weeks ago and it got me to change from KeepassXC and I&#x27;m overall very happy with the change.<p>The main selling points for me were that it&#x27;s open source and they allow you to host it yourself.<p>Apart from these, I really enjoy the browser addons which don&#x27;t require any jumping through hoops[1] and that they provide their own Android client and you don&#x27;t have to play Play Store Columbus to find a decent one. It can also be used as an autofill service which allows it to interact with other apps which is incredibly useful.<p>But because nothing in this world is perfect, the downsides so far are:<p>1. Lack of shortcuts to copy only the username or only the password and forcing me to reach for the mouse. That&#x27;s really annoying.<p>2. With KeepassXC you could have a keyfile that you was necessary to unlock your database while Bitwarden doesn&#x27;t have that option. They do provide 2FA[2] but only TOTP and email for the free version (although $10&#x2F;year for the premium subscription, arguably, is not much).<p>1: <a href="https:&#x2F;&#x2F;keepassxc.org&#x2F;docs&#x2F;keepassxc-browser-migration&#x2F;" rel="nofollow">https:&#x2F;&#x2F;keepassxc.org&#x2F;docs&#x2F;keepassxc-browser-migration&#x2F;</a> 2: <a href="https:&#x2F;&#x2F;help.bitwarden.com&#x2F;article&#x2F;setup-two-step-login&#x2F;" rel="nofollow">https:&#x2F;&#x2F;help.bitwarden.com&#x2F;article&#x2F;setup-two-step-login&#x2F;</a>

I&#x27;ve been using masterpassword [1] which is stateless and requires no sync. I wonder what the HN crowd thinks of its features. Another option with the same paradigm is lesspass [2].<p>1. <a href="https:&#x2F;&#x2F;masterpassword.app&#x2F;" rel="nofollow">https:&#x2F;&#x2F;masterpassword.app&#x2F;</a> 2. <a href="https:&#x2F;&#x2F;lesspass.com&#x2F;#&#x2F;" rel="nofollow">https:&#x2F;&#x2F;lesspass.com&#x2F;#&#x2F;</a>

i find it hilarious, hilarious i tell you, that he felt the need to put a quasi-legal disclaimer at the bottom of his <i>medium post</i>. i suppose it is demanded by the field he is in (investment banking) but it just strikes me as nonsense.<p>too bad the article is quite thin.

If someone is still looking for a good one, I use Keepass and can very much recommend it.

i was using dashlane for a while. The features were great, but one thing really bothered me:<p>On macOS everytime I opened safari it launched a dashlane.com page reminding me to install the plugin. I did not want the plugin, and after much googling never was able to prevent this behavior. I had to uninstall it.<p>Switched to KeepassXC, its good.

Here&#x27;s a plug for DPG (zero storage password manager). I wrote it years ago and it meets my needs well.<p><a href="https:&#x2F;&#x2F;github.com&#x2F;w8rbt&#x2F;dpg" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;w8rbt&#x2F;dpg</a>

<a href="https:&#x2F;&#x2F;pwsafe.org&#x2F;" rel="nofollow">https:&#x2F;&#x2F;pwsafe.org&#x2F;</a> by Bruce Schneier

anyone use passbolt[0]?<p>interested to know your experience good&#x2F;bad&#x2F;etc...I am considering installing on a vm at home to use for family.<p>[0] <a href="https:&#x2F;&#x2F;www.passbolt.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.passbolt.com&#x2F;</a>

A comparison matrix would help.

<i>we decided that Bitwarden is the best choice for our company, and we’ve begun the process of migrating from LastPass to Bitwarden.</i><p><pre><code> whois lastpass.com LogMeIn, Inc. whois bitwarden.com WhoisGuard, Inc.</code></pre>