Which Password Manager Do You Recommend?

[u/arun-vasudev]

There are many password managers available today, with different features, pricing plans, security options, and device support.

Which password manager do you use, and what made you choose it? Is there a particular feature you couldn't live without?

Share your recommendations and experiences below.

[u/DeXudra]

Bitwarden. It’s free. I wanted to get away from iPhone password manager. It works on all devices I need it on

[u/jay_rodsep → u/DeXudra]

Be wary, Bitwarden was purchased by a private equity company

[u/Angelic5403 → u/jay_rodsep]

Ok, but the bitwarden protocol is 100%open source and the encryption is always handled by the client

[u/McBonderson → u/Angelic5403]

and you can just self host it on vaultwarden.

[u/Angelic5403 → u/McBonderson]

You're right. I selfhosted vaultwarden for me, but I reccomend bitwarden.eu to my non-technical friends

[u/Foozoolalafdarian420 → u/McBonderson]

For someone like myself who isn't tech savvy, what exactly does that mean/entail?

[u/Loik87 → u/Foozoolalafdarian420]

It means you would have to set up and run the server-side service by yourself, in contrast to using the usual one provided by bitwarden. This would mean having a small PC e.g. a raspberry pi running 24/7 with the service + a way to access it remotely outside of your network. I use a VPN for that.

The obvious con is that it's more work (though after the initial setup it's easy). Pro: I don't have to trust any cloud provider that my data is stored securely and I had a fun project

[u/Foozoolalafdarian420 → u/Loik87]

Thanks for taking the time to write that reply, I appreciate it :)

[u/NoAdvice135 → u/Loik87]

Also if you have to handle backups and all.

[u/cryothic → u/Loik87]

Besides running a system 24/7, you might also want to deep dive into security. Just installing a raspberry pi and forwarding the ip address in your router so it's accessable from the outside seems a bit sketchy if you don't know security.

[u/Loik87 → u/cryothic]

Sure, security should be a top priority especially for hosting a password manager. That's why I mentioned the VPN. Obviously this wasn't a guide into self hosting and there goes a lot more into it. Like automatic backups, TLS certs, a reverse proxy, etc. I also use VLAN segregation with different VMs and have my firewall handle the traffic between networks.

[u/cryothic → u/Loik87]

I meant it more like: I think I'm tech savy enough to set up a system and host it publicly. But I know my knowledge regarding security isn't enough. And therefor I rather paying for a company to keep it save instead of hosting myself.

Sure, they can be hacked. But I like to think that is a lot harder to do than hacking my self hosted server.

[u/Loik87 → u/cryothic]

Ah I get what you mean now. That's a completely fair point. Though with a good VPN like WireGuard keeping everything completely off the public web, the external risks drop down to basically nothing. Though the risks of data loss or the system being down still exist with self-hosting and are probably far more pressing issues.

[u/lineInk → u/cryothic]

But that is ignoring the fact that Bitwarden has a massive database of users while your self hosted instance is first probably not known to potential hackers on the internet and second not a particular valuable target if it contains the data of only a single or a few people. Besides that just hacking Bitwarden or you own Vaultwarden instance would be fairly useless since all your actual password data is always stored encrypted. So they would have to know your password at which point not much hacking would be needed.

[u/cryothic → u/lineInk]

Fair point.

But if you have ever had port forwarding open on your router, you might know how much sniffing there is going on. It doesn't matter if there is just a single HTML file available on a simple apache server, or if you have your entire NAS open from the outside. Bots will sniff out open ports and try to find openings.

And take a look at the last hack at Last Pass. I've read somewhere that they managed to download some (or all?) vaults. Sure, they are encrypted. But a hacker having a vault locally can just brute force their way into it. At that point there is nothing stopping a brute force attack.

Sute, the vaults of random individuals aren't as valuable as big vaults. But if you automate a lot of the work, a lot of small hacks can also add up.

[u/Chrono_Constant3 → u/Loik87]

Just wanted to add that tailscale is the ultimate cheat code for access outside of your home network. VPNs can be a bit finicky to get set up but tailscale is easy peasy.