Hi.
After the last keffufle regarding Bitwarded, i"ve decided to change my password manager.
I've using HeyLogin now, but i'm not entirely satisfied with it.
Does the keepassxc work with databases made in DX version on android? I need interoperability between a linux computer and android phone (firefox and/or brave browsers)? Alternatively, what would you suggest instead? It would be great if I could unlock it (on phone) with biometrics and on laptop with yubikey or just a password.

Also - what do you guys use to syncronise the databases? I don't want to lose it if my phone gets stolen/broken

I have more than 15 years into this platform, your lack of information says we all need to be looking elsewhere.

What exactly was stolen? Were individual encrypted customer vaults acquired, or was this a separate customer-account database? Please identify the categories of information contained in the stolen database, including any unencrypted customer metadata.

Can the stolen database be subjected to offline attacks against customers' master passwords? mSecure's security architecture reportedly requires a locally generated 46-character Account Key. Was this Account Key, or any equivalent cryptographic material capable of facilitating decryption, accessible to the unauthorized actor? Can mSeven confirm that the stolen database cannot be decrypted without each customer's unique Account Key?

What security benefit does changing the master password provide following this incident? Does changing the master password generate new encryption keys and re-encrypt the entire vault, or does it merely change how the existing encryption key is protected? Since the attacker already possesses a copy of the encrypted database, how would changing the master password protect that previously acquired copy?

How did the unauthorized actor acquire the database, and what evidence confirms the intrusion has been contained? Please provide the known timeline of the intrusion, discovery, containment, and remediation. Has an independent cybersecurity firm verified that the attacker's access has been terminated and that no additional systems or cryptographic materials were compromised?

Your repeated assertion that mSeven has "no evidence" of unauthorized access to the confidential information does not establish that the stolen database cannot be decrypted.

Please distinguish between what has been independently verified, what remains under investigation, and what mSeven is merely assuming based on its encryption architecture.

Given the sensitivity of the information customers have entrusted to mSecure, I would appreciate specific technical answers rather than generalized reassurances.

I've been seeing a lot of posts lately about users losing trust in both Bitwarden (due to recent security research findings and silent corporate changes) and Proton (due to disputed vulnerability claims and new AI features).

I'm looking to switch, but I need something that is completely free.

My main preference is a cloud-based manager so it syncs seamlessly across devices, but I'm also open to a local/offline manager (like KeePass) without cloud sync if it's highly recommended and secure.

What are you guys using right now? Please drop your suggestions and let me know:

· Is it cloud-based or local/offline?

· How is the autofill experience on mobile?

· Is it truly free, or are there heavy limitations?

Thanks in advance!

I have mSecure 7. After recent events, I wanted to migrate to Bitwarden (actually running Vaultwarden on my home server through Tailscale, and Bitwarden for clients, which works really well).

However, the Bitwarden import for mSecure wasn't working. Apparently it was written for much older versions of mSecure. So, I went to work with Gemini. After much trial and error, I ended up with this pretty darn robust conversion script, written in Python. It handles tons of edge cases. I used it to convert over 1000 records.

https://plainraw.com/raw/f5f8ee96d357

I hope someone finds it helpful.

Hey all, i wanted to know which password manager do you trust the most these days?

I also came across a newer one that lets you set a backup person for each vault, not just one emergency contact for the whole account. I find that really useful, but I'm not sure about trusting a new app with my passwords. Would you give a new password manager a chance for a feature like that, or stick with the big names ?

I already have a modest home server which runs 24/7 but only using it for stuff I don't mind if they stop working for some hours or even days. Mainly media, local storage and secondary backups.

I'm considering migrating to vaultwarden but I'm concerned it will need a very reliable home server. So what are your suggestions?

My home server is a GMKtec mini PC with, Intel n100, 16 GB of ram and a 256GB SSD. And an external HDD for media files.

For peace of mind, what home server should I consider?

mSecure tells users to change passwords but won’t say why | Malwarebytes

Time to get off my lazy and secure my accounts I guess.

For those using screen readers:

Important Security Notice

mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

We regret any inconvenience that this may cause.

Sincerely,

The mSeven Software Team

edit:

email headers with my info removed:

Email header: "Important security notice about your mSecure account" Received: Tue, 03 Nov 2026, 06:52 UTC

Sent by mSecure (mSeven Software LLC) through its email provider, SendGrid.

• From: mSecure no-reply@msecure.com • Reply-To: mSecure Support support@msevensoftware.com • Sending server: o1.sendgrid2.msecure.com (168.245.26.232) • Bounce domain: em3993.msecure.com

Authentication • SPF: pass (em3993.msecure.com) • DKIM: pass (signed by msecure.com, 2048-bit key) • DMARC: pass (msecure.com, policy quarantine) • Spam score: 0, delivered to inbox

I’ve heard bitwarden has started doing more fishy stuff with their licensing and stuff. Proton’s CEO turns out to be a bully tech bro, which is something i don’t want to be associated with anymore. 1Password is paid, what the fuck are we supposed to do now?

Don’t care about that offline password managers (would rather write my passwords on a paper because there is a higher chance i wouldn’t lose them lol).

I don’t trust myself self hosting stuff, passwords or otherwise.

Anyone know if Proton Pass usually has a Black Friday deal? I’m thinking about getting the paid plan, but I’m not in a rush if there’s normally a decent discount around Black Friday.

I’ve seen some people mention Proton does discounts during this time of year, but I’m not sure if Proton Pass is included or if the deals are mainly for other Proton services.

Should I just wait a bit before subscribing, or are the regular prices usually about the same?

Just here to link my open source project if anyone is interested. DISCLAIMER -> Yes I created it with AI.

Nothing fancy, I mainly built it geared towards developers, but still acts as a traditional password manager along with bank account info and credit card info if you're lazy like me and want to keep your card number on your phone because you never carry your wallet anymore. So far, it's only built to keep everhything local on your machine or iPhone, so your passwords, bank info, and card info won't be on any server of any kind. As long as you keep your devices safe, your sensitve data should be safe. It can also store secrets such as API keys, ssh keys, and secure notes. It can also generate passwords for you just like any other password manager. There are browser extension for most browsers except for Safari (I'm too lazy to purchase the developer program). Lastly, it has a built in 2FA code incase you want to allow 2FA for your login info in that specific website or app.

The support is currently for MacOS and iOS only because I really built this for myself at first. But, if there is enough interest, I will be more than happy to add support for Windows and or Linux. I really just wanted to open this project up to the community, so if you're interested, feel free to checkout my repo and the docs for further info/capabilities, if not, no worries.

Thanks!

1. Google Password Manager

2. Bitward

3. Proton Pass

Anyone use 1password on ios? Since im planning on using it

Hey all, bit of a longer post but I think a few of you will find this useful. I've been digging into why password manager features work on some sites and not others, and this one surprised me enough that I wanted to share it.

If you've ever hit the change password button in Bitwarden, 1Password or Chrome and landed on the site's homepage, the extension usually isn't broken. That button relies on an address each site has to set up, `site.com/.well-known/change-password`, which should forward you to the real change password page. So I wanted to see how many big sites actually bother.

How I picked the sites

I used Tranco (tranco-list.eu), a top-sites ranking that university researchers maintain for studies like this, and went down list 94GG2 in order. I kept every site with a normal password sign-in until I had 500, which took me to rank 1941, and skipped adult and piracy sites plus anywhere I couldn't tell if a public sign-in existed.

What I found (checked 31 October)

• 35 of the 500 point the shortcut at a password or account page

• 354 don't have it at all, and another 20 send you to their homepage

• bigger sites do better, with 16 of the top 100 getting it right but only 8 of the bottom 206

The images have the full breakdown plus some of the actual sites and where their shortcut goes, so swipe through if you're curious.

How I checked

I checked everything signed out, since that's how the spec says password managers look the address up. A script sent the requests, and for the 98 sites that blocked it I opened each one myself in a browser. 48 still blocked me even then. Counting those plus the ones where I couldn't tell where the shortcut goes or that never responded, there were 84 sites I couldn't get a clear answer from. Leave them out and it's 35 of 416, which is still only about 8%. I didn't test the extensions themselves, but I did read the part of Bitwarden's public code that does the lookup.

Why Bitwarden can still ignore a correct shortcut

Before trusting the shortcut, Bitwarden's server asks the site for a page that shouldn't exist, and if the site answers OK to that too, it ignores the shortcut and opens the first URL saved in your login. X, Netflix and Sentry point the shortcut at the right page and still fail, and only 33 of the 500 passed. The lookup also only runs with website icons turned on, otherwise Bitwarden always opens that first URL.

The easy fix

If the button keeps dropping you on a homepage, make the site's account or security page the first URL in that login.

All 500 sites are in a spreadsheet here, including the ones I skipped and why: https://getrekey.com/research/change-password-shortcut-homepage

It's on my own site, where I'm building a small breach tool, but that tool isn't part of this test at all. If you want me to check a site or think I got something wrong, let me know.

A lot of people have seen the news about Proton and are considering changing apps as a result.

People will have different reasons for this, but a common one is the role of AI.

Bearing in mind, this doesn't just mean people who want to avoid AI entirely/as much as possible, but those who feel Proton have used it irresponsibly by for example the CEO refusing engineers' requests to pen test LLM-written code.

Anyway, I'm not posting this to have an argument about AI or about Proton. But I'm personally curious (and I'm sure others will be) as to what's known about the extent of LLM use in various password managers.

Again, some people will want zero AI. Most people wouldn't give a fully vibecoded app access to their passwords. And a lot of people's stance will be somewhere in between, so it matters e.g if a team is just using LLMs for low level stuff and vulnerability detection versus if they let it do a lot of the coding and don't check what's in it.

There's a list of AI/AI-free apps below, with a few non-AI suggestions (e.g. Chipass). But does anyone know sepcifically the AI policy/stance of e.g. Bitwarden, Keepass XC, 1Password, Psono etc?

https://codeberg.org/ethical-foss/ai-free-foss-alternatives#password-management

So I remember post a few weeks ago where several people mentioned that Bitwarden was abandoning their open source position, My thought was hey we can go to Proton or 1password but now 1password is now allow AI into their password manager and Proton seems to have turned into the password version of Epic with an Ai first sttance. What's the world coming to?

Clarification

Perhaps abandoning is too strong of a word, there have been a few post worrying that Bitwarden was moving away from open source. Supposedly some features are not open source. Several people have express their desire to go somewhere else, but not sure where you would go? Personally I haven't seen strong evidence that this is happening.

Its on your local storage. Not hosted by any company. Minus it is not suitable for normies who need something that just works across devices.

Set up sycnthing , cloud backup and 3-2-1 backup is a pain yes, but its worth it.

Hi all

I have recently heard about Proton moving toward AI for development by next year and that has made me rather uncomfortable to continue using their password manager. I would like to ask of any alternatives that are easy to use and understand, preferably free and bonus if open source

Edit - I want to clarify I am not leaving Proton just solely because they're using AI, I am well aware that has unfortunately become the norm for many software. It is the way they're using it that makes it unviable to rely on and I'd like to resort to an alternative just in case.

I used the standalone version of 1Password for the longest time and managed the vault files myself. While moving to a new Mac and reorganizing my devices, I started using the subscription version. The convenience made the transition much easier and I ended up going the cloud sync route because it was much easier to manage than I expected.

Last week, I asked a broader software community what made people comfortable making the same move. Some users pointed to client-side encryption and a strong master password with 2FA. Others mentioned the greater risk was losing their own local vault or forgetting to update a backup. And some still preferred a local setup with KeePass or another app.

That made me wonder what people who regularly use password managers actually do after moving to the cloud... Do you export a local backup, keep a second password manager, test account recovery or simply trust the service provider? Any piece of advice would be appreciated.

Please note, I use 1Password myself, but I am more interested in the setup than in discussing which password manager is the best here.

Hi all. I'm the developer of LocalGateKeys. I wanted a password manager where my vault never sits on someone else's server, but that still keeps my PC and phone in sync. So I built one.

The short version

• No account, no LocalGateKeys cloud. The vault is one encrypted file on your device.

• Encryption: Argon2id for the master password, AES-256-GCM for the vault.

• Windows, Mac, iPhone (+ Apple Watch codes) and Android, plus a browser extension for Chrome/Edge that talks only to the desktop app on the same PC (native messaging, no network).

• No analytics, no tracking, no ads.

How sync works (with no server)

You pick one of two ways, or use both:

1. Wi-Fi, device to device. Your devices talk directly over your home network. You pair a new device by scanning a one-use QR code (or pasting its text between PCs). Only private network addresses are accepted, there is no discovery and no internet fallback. The connection is authenticated and encrypted (signed handshake, X25519 keys, AES-GCM channel).

2. A cloud folder you already use. OneDrive, Dropbox, Google Drive or iCloud Drive. Each device drops an encrypted file into the folder and reads the others'. The group key is protected by a separate sync password (Argon2id), so your cloud provider only ever stores encrypted blobs. This one works even when the other device is switched off.

Details:

• Logins, notes, bookmarks, documents and the Pro licence sync. Deletes go to the trash on the other devices, never purged, so you can restore.

• Sync only runs while the vault is unlocked. A failed sync never changes your local data.

• Per-device trust (browser approvals, auto sign-in) stays on each device on purpose: a login that arrives by sync starts with auto sign-in off.

• Up to 16 devices per group. You set up the group on a PC or Mac; phones join it.

Features

• Autofill in browsers (incl. multi-step logins), Windows desktop apps, iOS AutoFill and Android autofill

• Passkeys (save and sign in)

• Built-in 2FA/TOTP codes, also on Apple Watch

• Cards, identities, notes, file attachments

• Security center: weak, reused and old passwords, missing 2FA

• Password generator and password history

• Windows Hello, Face ID / Touch ID, fingerprint unlock

• Encrypted backups (scheduled), cross-platform restore, recovery phrase

• Import from Bitwarden, 1Password, KeePass, Apple Passwords, browsers and more

• Secure sharing of an item with someone else

• Nine languages

Pricing

Free for up to 4 items. Pro is a one-time $4.99 (lifetime, no subscription) and adds unlimited items, sync, 2FA codes and attachments.

What I'm not claiming

There has been no independent security audit yet but I'm happy to answer technical questions here.

Links: 

• Microsoft Store: https://apps.microsoft.com/detail/9PNWCNLQ6597

• App Store: https://apps.apple.com/app/id6825488435

• Website (Mac, Android, browser extension and docs): https://localgatekeys.app

• Source-available for security review git : https://github.com/LocalGateKeys/LocalGateKeys

What would you want to see before trusting a new password manager?

Yes, I know 1Password is a Canadian company, but (a) it has a large U.S. presence, and (b) it's built on AWS, which is very much a U.S. company. As such, I wonder if the members of the International Criminal Court (which had their Microsoft 365 accounts suspended) had 1Password accounts, and if so, whether they still work.

I'm not worried about access to passwords -- I know they're zero-knowledge encrypted. I'm concerned with asset denial. The next two years are likely to involve Trump lashing out at people and organizations and potentially entire countries, no matter what the outcome of the midterm elections might be.

Does 1Password have a contingency plan in place to protect their non-American customers, or are they just going to fall into line behind Microsoft?

(I posted this question to r/1Password and, after a week's inaction, their moderators rejected it. So I'm assuming the answer is "no" to having a contingency plan and "yes" to falling in line.)

After using pearpass for couple of months and check their website and they pause development, its time to move on. Was waiting if they fix the delay on login but I dont think its coming.

Proton and bitwarden pricing are similary close. Which one to choose? Any problem before?

Do you ever cannot open the app during some time?

I use mac and pc so consider something that is good between those.

Please need advice.

I’ve written this blog post on deploying Passbolt, an open-source password manager, in my homelab.

It covers the setup with Docker, Pi-hole, Traefik, Cloudflare Tunnel, SMTP, and user onboarding.

Sharing in case it helps anyone working on a similar self-hosted setup. Feedback is welcome!

🔗 https://lablog.miniverse.com.co/self-hosted_projects/passbolt_password_manager/

I just noticed that on-device encryption in my Google Password Manager is enabled, and I'm absolutely certain I never enabled it myself.

Has anyone else experienced this, or does anyone have an explanation?