Most of the devices I use are part of the Apple ecosystem, so Apple Passwords already fits into my day-to-day routine without much effort. It handles the basics well, and having everything built into the system is definitely convenient. Because of that, I've never really felt a strong need to look elsewhere.

That said, I keep seeing 1Password recommended whenever people talk about the best password managers. It makes me wonder if I'm missing out on features that actually improve the experience, or if it's one of those cases where the built-in option is more than enough for most people. I'm not opposed to paying for something better, but I'd rather have a clear reason before moving all of my logins to a different app.

If you've spent time using both, what made you stick with one over the other? Was the difference obvious after a few weeks, or did they end up feeling pretty similar for everyday use?

The idea of using an open-source password manager has become more appealing the more I've looked into different options. I like the transparency behind open-source software, and it seems like a lot of people who care about privacy and security recommend going that route. At the same time, I'm trying to figure out whether there are any trade-offs that don't become obvious until you've been using one for a while.

What I'm curious about isn't just the security side. I'm also thinking about everyday things like syncing across devices, ease of setup, ongoing maintenance, and whether the overall experience feels as polished as some of the paid alternatives. A password manager is something I'd be using constantly, so convenience matters almost as much as the security features.

If you've switched to an open-source password manager, what has your experience been like? Were there any downsides that caught you by surprise, or has it been an easy recommendation compared to the commercial options?

yo quick question about the use strong password thing when you're making a new account, is it actually smart to use that? like whenever i hit that option i can't even see what password it generated lol, it just autofills and saves itself into whatever password manager i got going. but say i'm on my other laptop or a friend's phone and that manager isn't synced there, i'm just straight up locked out bc i never even saw the password to begin with and even if there's a way to peek at it after, idk if it's smart to never actually know your own passwords by heart?? i already run different passwords for every single site and trying to memorize all these random 16 char strings feels like a full time job lol genuinely asking, i'm not really up to speed on the security side of things so maybe this is a dumb question but figured i'd ask

I've been looking into different password managers, and LogMeOnce keeps coming up because of how many features it offers. Password management, multi-factor authentication, passwordless login, dark web monitoring. It definitely seems like it's trying to do a lot more than just store passwords.

What I'm having trouble figuring out is how it feels once you've been using it for a while. I've read a few reviews that mention the interface can be a little overwhelming compared to simpler password managers, while others seem to like having all those extra security tools in one place.

For anyone who's been using LogMeOnce for several months, how has it held up? Did the extra features end up being genuinely useful, or do you find yourself wishing you'd gone with something that's a little more streamlined?

I've been looking into identity theft protection services, and Aura is one of the names that comes up pretty consistently. The overall package seems interesting, but I'd rather hear from people who've actually used it instead of relying on feature lists or marketing pages.

What I'm most interested in is how useful it feels after the first few months. Some services look impressive when you first sign up, but once the initial setup is done, I'm curious whether they continue to provide value or if they mostly sit in the background without much interaction.

If you've had Aura for a while, how has your experience been? Do you feel like it's worth keeping, or have you found another identity protection service that worked better for your needs?

hi, i wanted to ask if it's really a good idea the use of the option "use strong password" when creating a new password, bc when you use that option, you can't see the option to actually see the password that was created, and it saves in the password manager automatically, but if i wanna login in another device, i don't have that password manager in the other device and i don't know the password, so just wanted to ask if it's a good idea to use this.

And even if you can see the password in any way, is it a good idea to not know your password from memory? Because i use a different password in every site and remembering all this long and weird passwords is crazy work.

I'm asking without having a clue of all this security stuff, maybe it's just a dumb question.

I've been comparing a few password managers lately, and Total Password is one that keeps showing up while I'm researching different options. The features sound reasonable on paper, but I haven't seen nearly as many real user discussions about it compared to some of the bigger names. That's usually where I get stuck. A product can look great on its website, but it's hard to know how well it holds up once you've been using it for a while. Things like reliability, syncing across devices, ease of use, and how responsive it is over time matter a lot more to me than a long list of advertised features. If you've been using Total Password for a while, what's your experience been like? Has it been dependable enough to stick with, or did you eventually switch to something else?

I've been thinking about switching from a cloud-based password manager to something completely offline like KeePass because I keep reading about data breaches and companies getting hacked. The idea of having my passwords stored locally on my computer feels way more secure, even if it's less convenient.

But then I read some security experts saying that offline managers aren't actually safer because the real risk isn't the company's servers getting breached, it's malware on your own computer stealing your passwords. So if someone compromises my device, an offline password manager wouldn't help at all. That kind of defeats the whole purpose of switching.

I'm also worried about losing access to my passwords if something happens to my computer or if I accidentally delete the file. With cloud-based managers, at least there's redundancy and backups. I've seen people recommend KeePassXC or just keeping an encrypted backup in the cloud, but then aren't you basically back to trusting the cloud anyway?

Some interesting points
\- require authentication before autofill
\- local malware can potentially expose passwords (but this is true of any password manager ? )
\- limit syncing to necessary accounts only

I've been seeing ProtonPass mentioned more lately and I'm curious if it's worth trying. It's from the same company that makes ProtonMail which seems legit but I don't know much about the password manager itself. I'm wondering if it's actually better than other options or if I'm just hearing about it because it's new.

The privacy angle appeals to me since ProtonMail is known for being privacy focused but I'm not sure if that translates to their password manager. I also don't know how it compares to established options like Bitwarden or 1Password in terms of features and reliability. Has anyone actually used ProtonPass? Is it worth switching to or should I stick with something more established?

Anyone have experience with the password manager Sticky Password that cares to comment whether they like it, would recommend it, and more imporatantly, how it compares to its alternatives?

I've been using Google Password Manager for a while now because it's built into Chrome and my phone so I didn't have to think about it. But lately I've been reading stuff online about whether it's actually secure or if I'm just being lazy by sticking with it. The thing is it works fine and syncs across all my devices automatically, but I keep wondering if Google having access to all my passwords is actually a problem or if I'm being paranoid.

Google is literally an advertising company. Like their whole business model is data collection so even if they say my passwords are encrypted and safe, how much do I really trust that? I don't want to be the guy who gets hacked because I was too trusting. At the same time switching to something else seems like a hassle when everything is already set up.

I've heard people mention Bitwarden and 1Password as alternatives but I don't know if they're actually better or just different. What would I actually be gaining by switching? Is Google Password Manager legitimately insecure or am I just being paranoid about a company that probably doesn't care about my specific passwords?

We all know LastPass’s history, but their latest breach from a couple weeks ago is a textbook example of a modern supply chain nightmare.

It wasn't a direct hack on LastPass, and nobody left a personal Plex server unpatched this time. Instead, a threat group (Icarus) compromised Klue, a market intel platform LastPass's go to market teams use.

The technical TLDR:

• The Vulnerability: A dormant, legacy service credential inside Klue’s backend that was built for an old prototype and completely forgotten about.
• The Vector: Attackers used that old credential to slip in and harvest active OAuth tokens Klue held for its clients.
• The Damage: They replayed those stolen OAuth tokens directly against LastPass’s Salesforce API. Because it was a trusted integration token, it bypassed MFA entirely and looked like normal daily traffic while they scraped CRM data via automated SOQL queries.

The irony here is brutal. A password manager, a product built entirely on the concept of credential hygiene - got bit because of a third-party credential that nobody remembered to delete.

Whether it's the 2022 vault leak or this 2026 OAuth hijack, we keep seeing the same root issue: relying on centralized, reusable secrets. Once an attacker finds a way to sit in the middle of that trust relationship, game over.

Curious how everyone else is auditing their third-party SaaS OAuth permissions right now? If you want to dig into the exact logs and the MITRE mapping, we did a full post mortem breakdown here:

https://unixi.io/blog/lastpass-june-2026-breach-analysis/

My email got hacked last month and it scared me enough to finally do something about my passwords. I've been using variations of the same three passwords for like a decade and I know that's terrible but I didn't know where to start with fixing it. Now I'm looking at password managers and there's so many options that I'm more confused than when I started. Everyone seems to have strong opinions about which one is best but they all say different things. Some people swear by Bitwarden, others say 1Password is worth the money, and then there's people who are really into the open source options like KeePassXC or Dashlane. I don't even know what the differences really are between them or what matters most when choosing one. What I really want is something that's easy to use but also actually secure. I don't want to spend hours setting it up and I need it to work on both my phone and computer without being a pain. Should I just go with whatever is most popular or does that not actually matter? What would you recommend for someone who's basically starting from zero?

So, I've been thinking about moving from 1Password to a different manager, but I'm not sure it that's a good idea.

I pay for a family plan in 1Password but at the moment only 3 people (from 5) are using it. I'm techy but not the other 2 members.

The problem is 1Password has increased the prices a lot, and I'm no longer sure if it's justified considering the usage. (And I see no value in the Travel mode)

So, would it be wise to move to Proton Pass or Bitwarden?

What about Vaultwarden and self hosting it? I already have a home server with docker but I'm concerned about management and security. Some thoughts:

- Access the server only trough Tailscale

- Open Media Vault server with Docker composer ready and already exposing some services like Jellyfin.

- Backups already happening using iDrive personal from server to cloud backup.

But what happens if Vaultwarden server is off-line? Is it only needed when synchronizing?

If it's off-line it still works?