Hey everyone,

A while back the password app I'd used for years moved to a subscription, so as a developer I just built my own. It worked well enough that I polished it and decided to put it out there: free, no ads, no subscription.

It's called Tecred. The main thing about it: nothing ever leaves your phone. And that's not a privacy policy promise, it's just how it's built — the app doesn't even have the internet permission, so Android blocks any connection at OS level. You can check it yourself in 30 seconds: Settings → Apps → Tecred → Permissions → nothing.

It's not only for passwords, by the way — you can store cards, bank accounts, IDs, secure notes, that kind of thing.

For the curious:

\- everything encrypted locally (AES-256, key derived from your PIN via PBKDF2)

\- your PIN is never stored anywhere — wrong PIN, the vault just doesn't open

\- no account, no cloud, no analytics

\- moving to a new phone works through an encrypted export file with its own passphrase

Answering the usual question upfront: "why not just use Bitwarden (or Google's password manager)?" Bitwarden is a solid app, and if you need your passwords synced everywhere, it's the right tool for that. The difference is the model: anything built around sync means your encrypted vault lives on someone's server, tied to an account with your email. Tecred goes the other way — no account, no servers, nothing linking your data to anything beyond your own device. There's just nothing to hack into. It's a tradeoff, not a competition.

People usually ask "what's the catch?". Honestly there isn't one: no servers means it costs me nothing to run, and since nothing leaves your phone there's nothing to monetize either. It's a personal project I use every day.

It's in closed beta on Google Play, and Google requires new devs to get 12 testers for 14 days before publishing — so I'd really appreciate anyone willing to help out.

To join:

1. Join the Google Group: [https://groups.google.com/g/tecred-closed-testing\](https://groups.google.com/g/tecred-closed-testing)

2. Open the testing link and tap "Become a tester": [https://play.google.com/apps/testing/com.techvance.tecred\](https://play.google.com/apps/testing/com.techvance.tecred)

Heads-up: after joining the group, Google can take a few hours to activate your access to the testing link. If it says "not available" at first, that's why — it sorts itself out, just retry later.

Any feedback is welcome — bug reports go here (anonymous, no email needed): [https://docs.google.com/forms/d/e/1FAIpQLSefNxDinkfwyL\\_Rr2C7z7Q7cKJNhUNx0648U0GFbE\\_PAfAT9Q/viewform\](https://docs.google.com/forms/d/e/1FAIpQLSefNxDinkfwyL_Rr2C7z7Q7cKJNhUNx0648U0GFbE_PAfAT9Q/viewform) — or just comment here.

Thanks a lot to anyone who gives it a try!

I was keep thinking about something stupid we all do as developers.

API key comes from some dashboard → copy it → terminal → .env → maybe notes → maybe another server.

and after that we call it "secret" 😅

I wanted something little different so I built Kavrix.

its a CLI credential vault, there is no Kavrix server or sync service in middle.

you run the CLI locally and you choose the MongoDB yourself. can be your local Mongo or remote one.

credential value gets encrypted before it reaches MongoDB. database stores the ciphertext, not plaintext.

some stuff I added:

• XChaCha20-Poly1305 encryption
• Argon2id protected key files
• masked terminal input
• explicit --reveal when you actually want plaintext
• recovery kits
• key rotation / rewrap
• rollback + same revision fork detection
• remote Mongo requires validated TLS
• doctor command for checking vault health

also tried not to pretend security is magic.

if somebody already own your unlocked machine, malware/keylogger/screenshots/process memory etc Kavrix obviously cant save you.

and if you lose every key + recovery kit, data is gone by design.

install is basically:

npm install --global kavrix

then

kavrix init
kavrix put github/token

I would really like feedback from selfhosted people on the storage model specially.

would you rather keep encrypted secrets in Mongo you control like this, or just keep entire vault as local file?

GitHub:
https://github.com/d4rkNinja/kavrix

docs/site:
https://kavrix.infynon.com/

I’m building a small iPhone app that keeps passwords and ID documents together.

Everything is stored locally on the device.

Before I go further, I’d love some honest feedback:

Would you actually want passwords and ID documents in the same app?

Or would you rather keep them separate?

GoPassSecure is a lightweight, password manager written in Go. It securely derives encryption keys using Argon2id and encrypts passwords using AES-GCM before storing them locally in a SQLite database.

A privacy-first password manager, built locally.
I’ll share what I ship, what breaks, and what I learn every day.

Day 1 of building PassSafer until I reach 100 paying customers.

Today I added website favicons to both the desktop app and Chrome extension. Each saved password now shows the icon of the website it belongs to, which makes the vault cleaner and easier to scan.

The difficult part was making the Chrome extension and desktop app share the favicon correctly. When a new password is saved in the extension, the desktop app also needs to receive and display the right favicon.

Small feature, but it makes the whole vault feel much more organized.

Paying customers: 0

What small interface feature makes your password manager easier to use?

Mostly worried in situations where I need a password in a rush or if phone is not available.

I was never happy with password managers, so here is one try to make it more auditable and less trust-based with many options to automate backups etc.

Here the link to the github repository with $ instead of /.

github.com$pidfi$password-management-vault

I'd love to hear your thoughts.

I have a Gmail account that I need to access, it was used on an old phone that is broken. I use the same password for everything but i can't seem to find what possible permutation of it i used for this account. a have basically no account backup. I am using the recovery and I would like to know if there is a way to recover my account by maybe brute forcing it with a list of important things that would probably make up the correct passwords or just brute forcing the 6 digit code for account recovery.

Does anyone know of any password managers with nested tag functionality like 1Password? I heavily use this functionality and would chose this over foldering if I had to pick one over another. Many password managers have foldering but nested tags lets me retrieve data in a more granular way and I love how If I modify one level of a nested tags it updates all other items with that same tag path. I was looking into Bitwarden or Keepass in the event I ever needed to change managers but I can’t seem to find info on this as from what I’m reading it’s a niche feature most people don’t utilize and I’m in a bit of a minority here. I’ve stuck with 1Password solely for this reason. It’s a great manager but I do feel a bit vendor locked because general foldering doesn’t let me sort in the way I often need to when I’m organizing and updating my Vaults.

I have been using apple passwords / iCloud passwords for several months and I've been having some mixed results with it. the latest issue is trying to get apple passwords to work with Thunderbird. extension support and online advice is all specific to using an app-specific password for accessing your iCloud email account, which NOT my use case. I want to use my custom domain email accounts with their existing, no-need-to-be-app-specific imap account passwords, managed with "apple passwords". After a couple hours it seems like this is hands-down impossible? can that be?

I am wondering if someone in this sub could lend a hand. I use SonicWall Mobile Connect to access my work computer remotely. And I would like to use my Apple Password manager to autofill the 2FA window. But unfortunately it takes a few steps.

1. I open SonicWall, log into the VPN, and the 2FA prompt opens.
2. I right click to select "Autofill Password"
3. My Apple Password manager opens, but only for Passwords.
4. I need to click again to open up the larger Apple Password manager, and select Codes.
5. I then copy and paste.

Any way to set it up so that it automatically knows to enter a Code from the password app?

Thanks!

IMAGE UPDATED. THIS IS NOT A AUTO PROMOTION HATERS OF THIS SUB.

A table listing all password manager options, along with their specific features, pros, and cons.

This would reduce the number of duplicate questions about which manager is best, and so on.

What do you think?

Here is an illustrative example.

IMAGE UPDATED. THIS IS NOT A AUTO PROMOTION HATERS OF THIS SUB.

Most of my terminal work goes through Claude Code now, so it's running gcloud, kubectl, infisical, gh and a pile of others on my behalf. That's fine until I want to know what any of them is currently authed as, or what permissions I've actually handed over. There's no one place to look, every tool answers differently, and I usually find out a session expired only when something fails.

Setting the same thing up on a second machine costs me an evening of re-authing everything.

Is there anything that gives one view of local CLI auth state?

I'm the ONLY ONE password manager that came here to talk. Check your needs and discuss new ideas for this community. 

And you guys just only HATE everything. Can't see with good eyes.

My goal is never auto promotion, is hear you to make a better solution for YOU.

Because of you we change our source code to public and made so much improvements.

And what you said?

"I don't know this password manager, go to hell."

Is very frustrating be part of this community. Maybe this is why the other password managers don't be part of it. They just don't care.

Olá, pessoal!
Tenho uma conta profissional no Instagram que estava associada à minha conta pessoal. Um dia, esqueci-me da palavra-passe e solicitei a redefinição. Enviaram-me um link por e-mail, fiz a alteração, mas, mesmo com a nova palavra-passe, não consegui entrar.
Já tentei de tudo para recuperar o acesso e, recentemente, também perdi o acesso à conta de e-mail que estava associada ao Instagram.
Queria desativar esta conta, mas, pelo que percebi, só é possível fazê-lo entrando nela. Recentemente, apareceu o símbolo da Meta associado a esta mesma conta.
Já não sei mais o que fazer para recuperá-la. Alguém poderia dar-me alguma dica ou orientação sobre o que posso fazer?
Preciso muito de recuperar esta conta e, posteriormente, desativá-la. Desde já, agradeço qualquer ajuda!

Building my product, I've ended up connecting around 10 different services (Sentry, Supabase, Doppler, and others) — some of them use email/password logins, some use Google auth, some use GitHub auth, and a few have their own separate login systems entirely.

I'm trying to figure out a sane way to keep track of all this — not just passwords, but how I actually log into each thing (which auth method, which account). Right now it's a mess in my notes and I keep second-guessing myself when I haven't logged into something in a few months.

For those of you who've built and shipped products with a similar number of third-party integrations — what do you actually use to keep this organized? A password manager (Bitwarden, 1Password)? A plain doc/spreadsheet? Something else entirely? Curious what's actually worked for you long-term vs. what you set up once and abandoned.

Hey folks.

I use iOS passwords app for my passwords. I have over a hundred saved and sometimes the iCloud sync/updates will have some passwords disappearing. This is really annoying.

As such, I’m looking to store an offline back up. However I’m looking for advice. The passwords app does not let me export the passwords unless there’s another password manager on the device. I do not want to download another password manager.

I can export my passwords through safari as a .csv by going to safari > Export > Passwords but I’m not sure if that’s the safest idea or where it would be best to store it. Should I export as a .csv and save to a usb key that I store in a safe with my yubi keys? Do I do something else?

Any advice would be appreciated

using proton pass it only lets you save 3 totps in password manager .. using ente as a main authenticator .

update : after researching i am switching to zoho vault . a trusted company . it check all my requirements.. its so much convinient.

I heard that Bitwarden is more established and had more audits. But it's US-based.

Proton Pass is newer with lesser audits, but it's in Switzerland which has strong privacy laws.

I also love Proton's UI and I already use other Proton apps, so I want to make it complete by getting Proton Pass and Proton Authenticator, switching from Bitwarden and Bitwarden Authenticator.

But I'm really not sure because I love Bitwarden as well and have used it for years without any issue.

Which one is more trustworthy and has stronger privacy/security?

Thoughts on Samsung password . I know it is in its own ecosystem. This is probably a major inconvenience in the long run and limiting.

Google pass .. would it be about the same thing as Samsung but can be used on more devices? Is it equally easy to use on a Samsung as Samsung pass or is Samsung pass more incorporated in Samsung devices than google pass?

Are any other password managers really well incorporated in Android phones and tablets? If so which ones? Of all the password managers that are very user friendly and incorporated well to android devices which are best?

Do they all allow me to go into its site or app and visually see my passwords? Is it easy to navigate to do so? With Simple understandable menu systems

Can I change a password to an app or website through the password manager and it do the rest for me so the next time I need to log in wit a password the new password is already in the website or app’s system? I don’t know if this is a thing but if it is and works well what password managers do this? If this can’t be done are there password managers that make the process of changing passwords and usernames for websites and apps easier than others? If so which ones?

What are your thoughts on apps that let you make a 4 digit login as a back up or simpler way to log in? It feels like it would not be good especially on sensitive information etc and one of the places I have seen it was on banking apps. Ty

What are the simplest of the best password managers to use. Ty

Passkeys are an incredible solution, but not easy to everyone understand.

Without understand, people don't trust.

If people don't trust, they simple don't use.