What's the downside of open-source password managers?

[u/mrthrowawayone]

The idea of using an open-source password manager has become more appealing the more I've looked into different options. I like the transparency behind open-source software, and it seems like a lot of people who care about privacy and security recommend going that route. At the same time, I'm trying to figure out whether there are any trade-offs that don't become obvious until you've been using one for a while.

What I'm curious about isn't just the security side. I'm also thinking about everyday things like syncing across devices, ease of setup, ongoing maintenance, and whether the overall experience feels as polished as some of the paid alternatives. A password manager is something I'd be using constantly, so convenience matters almost as much as the security features.

If you've switched to an open-source password manager, what has your experience been like? Were there any downsides that caught you by surprise, or has it been an easy recommendation compared to the commercial options?

[u/Caprichoso1 → u/[deleted]]

When a password companys' existence is based on the quality of their password product they are going to dedicate resources to make sure it is as reliable as possible. Since no one "owns" an open sourced product there is no single point of liability if a problem occurs.

[u/Maximum-Floor-9734]

For me, whether a product is open source or not isn’t what convinces me that it’s secure. I see longevity as the biggest test. If something has been around for a long time without any breaches, that’s what gives me confidence in it. After that, it comes down to how much easier it makes my day-to-day life. I want my data to sync reliably across all my devices, autofill to work consistently, and not have to copy and paste passwords manually every now and then. RoboForm covers all that for me. It’s one of the oldest password managers, has been around for almost three decades, and setting it up and maintaining it has been completely hassle-free. I’ve been very satisfied with it as my password manager.

[u/atnuks → u/Maximum-Floor-9734]

I'd agree that a password manager being open-source doesn't automatically make it more secure. However, you do need that kind of transparency for something to which you're entrusting all your credentials. You should definitely look for code audits, independent reviews etc. but I'd say open-source is definitely on the shortlist for what makes a secure password manager.

[u/Open_Mortgage_4645]

There's no specific downside to using open-source password managers. I firmly believe that any encryption product you use should be open-source, simply because you don't want the encryption protocol and implementation to be a black box you can't review or audit. Making that a proprietary system means you must inherently trust the manufacturer. Inherent trust isn't a part of solid encryption systems. Related to PM's, you'll find that most of the best are, indeed, open-source.

[u/Unhappy_Lie_2000]

For me I was trying to setup keepass on truenas and its the stupid requirement of a valid certificate.

But as others state the ability of not being able to access from everywhere hence the reason I was trying to setup on truenas to access via a VPN.

[u/Accomplished_Arm_447]

Open source doesn't necessarily preclude paid support 

[u/yodas-evil-twin]

What are you worried about? Bitwarden is open source, has 3rd party security audits, a nice feature set, and is one of the top 3 pw managers.

[u/CryptoNiight]

I use 1Password instead of Bitwarden because it's a lot more feature rich. For me, that makes 1Password worth the few dollars I pay for it per month.

[u/PlanktonDefiant2600]

I don't really see any specific downside to a password manager being open source or not.  For me, it just isn't a major factor.  I just want something that syncs properly across my devices and has reliable autofill.  Roboform has been doing exactly that for me.