You don't need to be an 'investor' to invest in Singletrack: 6 days left: 95% of target - Find out more
Hi,
I am looking at getting a password manager system for personal use. I use a variety of devices including Windows, Mac, Chromebook, Android and iPad.
Ideally want something that supports those platforms and maybe has a family option too but do not want to spend £££.
Initial searches suggest RoboForm could be good but would rather get some real feedback rather than replying on SEO results.
I used Dashlane for a long while, can't comment on Mac support but worked well across Windows, Linux, Android and various browsers.
Recently switched to Proton, as I also use their mail and cloud storage services. The free account has limits on use, just upgraded to a family account. Although each user on the family subscription is an independent account, but is easy to share across accounts.
I appreciate that both are on the more expensive end of things, however I personally put a value on my information and data (as do many of the free and low cost services). This is a personal choice and may not suit your needs.
I did try RoboForm a while back, but didn't get on with it.
At work I cannot use any of the software above so use the browser password managers. Although this is out of necessity rather than choice and I'm not convinced on the security and privacy of this.
KeePass + KeePass xc
Switched to that after the whole last pass debacle and haven't looked back. Not quite as polished an integration with the host os as last pass, but way, way more secure if you set it up correctly.
I use BitWarden, works really well on the PC. Works okay on the (android) phone.
The only issue is not every app/site marks the username/password fields in a way that allows the password manager to find it. So sometimes you have to do copy/paste from the bitwarden app. Not a huge problem but irritating.
I've used KeePass for at least a decade and have never felt the need for anything else. Cross platform support: I use it on Ubuntu, Windows and Android. I sync the database via Dropbox.
I've used LastPass for years.
I've been meaning to ditch it for a while, the well-documented problems aside it irritates me on a number of levels.
The only issue is not every app/site marks the username/password fields in a way that allows the password manager to find it.
I don't know but I expect that's a problem with particular websites rather than the password manager.
Bitwarden for me, changed following the lastpass stupidity.
I just pay for it and works fine. No reason to change currently
After the whole lastpass thing it clearly highlighted (IMHO) the fundamental architectural flaw of having one giant database which holds all your user password data.
Because obviously that one central DB is an extremely high value target for any malicious actors.
Way better, IMHO, to have properly secured individual per-user databases as they are much lower value and also there's an element of security in obscurity.
This is where KeePass is great 👍 but you need to pay attention to how you set it up.
I have my vault synced using my personal cloud storage account (can use Dropbox, OneDrive etc) coupled with an encryption key file that is only on the devices I want to allow access (phone, pc, laptop)
Read up about it before making your selection.
(There may be other password managers that can be set up the same as KeePass)
I've used 1Password for years now, I've only ever been really happy with it - Team account at work, Family account at home for easy sharing. Mostly on iOS/MacOS but it's good on Windows too.
Keepass and KeepassXC.
Use the latter for personal use, mainly on Linux machine. Conveniently the former is available on the work laptop Windows company portal thing.
Why pay if you can have it for free?
I thought they all use a standard file format so should be easyish to move between apps?
After the whole lastpass thing it clearly highlighted (IMHO) the fundamental architectural flaw of having one giant database which holds all your user password data.
Because obviously that one central DB is an extremely high value target for any malicious actors.
Way better, IMHO, to have properly secured individual per-user databases as they are much lower value and also there's an element of security in obscurity.
This is where KeePass is great 👍 but you need to pay attention to how you set it up.
I have my vault synced using my personal cloud storage account (can use Dropbox, OneDrive etc) coupled with an encryption key file that is only on the devices I want to allow access (phone, pc, laptop)
Read up about it before making your selection.
(There may be other password managers that can be set up the same as KeePass)
There are pluses and minuses for both.
We use Keepass at work, it's fine but you have to be careful with backups, syncing changes between copies of your db, ensuring your key file doesn't get left anywhere, etc.
At home I can't be bothered with any of that, Bitwarden works on all my devices, I do literally no setup on it, install the app, sign in and it just works. But that convenience comes with the reliance on BitWarden's security policies.
Keepass and KeepassXC.
Why pay if you can have it for free?
Because Bitwarden is a good service and I want it to continue operating! But anyway there is a free version of it for personal use which is perfectly adequate for most people I think.
If something is free, then you are the product or at least your data is
Bitwarden, I moved to Bitwarden after a recommendation from a IT security bod, prompted after the whole debacle with lastpass.
I use keepass at work and for work I’m happy messing around with db sync backup etc, but not for home and family.
been tempted recently to move wholesale to the inbuilt iOS password manager.
yes there’s a risk to using a password manager app, but there’s just too many password details to manage reliably otherwise.
@grahamt1980 please explain how you think KeePass are selling my data
I have no idea, but what are they getting out of the transaction?
Might be a suspicious way of thinking, but it has worked for me.
https://pwsafe.org/ which is by Bruce Schneier. I sync the password file across all my devices via iCloud. The desktop app is free, the iOS one is a one time payment. No central DB, no browser extensions. The browsers do a good job of remembering the passwords now anyway.
I have no idea, but what are they getting out of the transaction?
Might be a suspicious way of thinking, but it has worked for me.
Fair enough as a way of approaching things cautiously.
However in the case of KeePass it's free open source and community maintained. You can read up on it on the KeePass website.
Ps it is also an auditable / audited codebase.
PPS, regarding KeePass being a bit more faffy, well yes slightly, but only really on first-time setup then (and additionally a bit more setup when adding a new device - if you are using a key file - which you should do)
I haven't touched my setup in ages
If something is free, then you are the product or at least your data is
This statement is no longer true.
If you pay Microsoft for its services, then you are the product too. And they are doing everything in their power to make you both the product and the one that pays financially.
Keepass is (or can be) 100% offline. They have none of my passwords. none of my databases, know nothing about me, and don't even know I use it (unless one of their devs just happens to chance upon this thread). However, with some quantum computing, since my (work) Keepass database is backed up on Onedrive, theoretically MS or NSA etc. could find something useful.
The Windows (or maybe it's the non-XC?) version you definitely need to make sure you hit Save. Windows 11 will quite happily let you proceed with a reboot and kill Keepass (among other running processes) and chuck away anything you had changed in the mean time. And since that's on a work laptop, where all browser addons are deemed "warez", it's a bit faffier than it could be, but then I expect that would be true for any password manager (except the one built in to the browser, that is desperate to get you to sync that data to their servers 😉 )
The Linux (or maybe XC?) version updates the file every time you commit any change. And in my case it's backed up only across devices on my network by me, with no 3rd party cloud or anything.
I removed the key file from my database because I couldn't remember the filename or where it was located. I was worried about password access if i lost the keyfile. It was just any old file with small file size I chose at random.
The XC version is multi platform. On Your favourite Linux distro, its usually available via your the software package manager.
And since that's on a work laptop, where all browser addons are deemed "warez", it's a bit faffier than it could be, but then I expect that would be true for any password manager
Why isn't work providing a company-wide with a password manager?