KeePass is a free open source password manager. Passwords can be stored in an encrypted database, which can be unlocked with one master key.
I’ve always hated the idea of using a subscription/cloud hosting for password management. I feel like I should have a LOT more control over that stuff and I don’t really want to hand all my keys over to a company.
All my secrets have been going in a highly encrypted archive with a long passphrase, but obviously that isn’t convenient on all devices. It’s been fine, I can open it on any computer but it’s not super quick. It does have the advantage of being able to put in multiple files, notes, private keys but it’s not ideal.
Anyway, finally found something that isn’t subscription, and has a similar philosophy - a highly encrypted archive file, and it’s open source and has heaps of clients including web browser plugins so it’s usable anywhere, and you can sync the vault with any file sync you like.
Thought you guys might appreciate the find, password managers have always been a bit of a catch 22 for me.
Note for android i found keepassxc the best app, and i’m using KeePassHelper browser plugin, and the KeePassXc desktop app as well as the free official one. Apps all seem to be cross platform.
What’s amusing is I am purposely not paying for bitwarden because of the check against darkweb leaks or whatever type feature when you pay. That’s seems like an anti privacy thing. I understand it’s a good idea albeit seems to expose a lot of information about you. I would like to do vaultwarden but don’t think I can trust self hosting myself without paying monthly for a vps which I don’t want to do. Home Internet hosting seems to unreliable to me for something that important.
I host vaultwarden at home. No real need for a vps since your passwords are synced to your phone or laptop(whatever client you’re using) and you can just sync it when you’re home if you make changes, or setup a VPN (I use wireguard) and sync on demand when needed.
That said, I do sync my database to a vps for dr purposes incase my home server suddenly vanishes… for critical services I follow a 3-2-1 backup rule but it’s not absolutely essential.
Follow OP’s approach. Use a Keepass file. It is offline and can be stored anywhere you can reasonably trust. You just need to sync it if you have many clients but syncthing is great for that.
The bitwarden clients also work when there’s no connection to the server, since they sync the vault. You just can’t add any new entries. That means spotty internet is not that much of an issue in terms of using it. It also means, that every device that has a client installed and gets used regularly (to give the client a chance of syncing) is automatically a backup device.
because of the check against darkweb leaks or whatever type feature when you pay. That’s seems like an anti privacy thing. I understand it’s a good idea albeit seems to expose a lot of information about you
For the password leak checks, your passwords are never transmitted. They are one-way hashed locally, and then only the first few characters of the hash are checked against the API provided at https://haveibeenpwned.com which is run and designed by Troy Hunt, one of the most respected people in the cybersecurity industry. He collects major password breaches and makes them available to check against without actually exposing the data. It’s perfectly safe and secure.
You are not logged in. However you can subscribe from another Fediverse account, for example Lemmy or Mastodon. To do this, paste the following into the search field of your instance: !selfhosted@lemmy.world
A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don’t control.
Rules:
Be civil: we’re here to support and learn from one another. Insults won’t be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it’s not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don’t duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
selfh.st Newsletter and index of selfhosted software and apps
What’s amusing is I am purposely not paying for bitwarden because of the check against darkweb leaks or whatever type feature when you pay. That’s seems like an anti privacy thing. I understand it’s a good idea albeit seems to expose a lot of information about you. I would like to do vaultwarden but don’t think I can trust self hosting myself without paying monthly for a vps which I don’t want to do. Home Internet hosting seems to unreliable to me for something that important.
Just random thoughts of mine here.
I host vaultwarden at home. No real need for a vps since your passwords are synced to your phone or laptop(whatever client you’re using) and you can just sync it when you’re home if you make changes, or setup a VPN (I use wireguard) and sync on demand when needed.
That said, I do sync my database to a vps for dr purposes incase my home server suddenly vanishes… for critical services I follow a 3-2-1 backup rule but it’s not absolutely essential.
Follow OP’s approach. Use a Keepass file. It is offline and can be stored anywhere you can reasonably trust. You just need to sync it if you have many clients but syncthing is great for that.
The bitwarden clients also work when there’s no connection to the server, since they sync the vault. You just can’t add any new entries. That means spotty internet is not that much of an issue in terms of using it. It also means, that every device that has a client installed and gets used regularly (to give the client a chance of syncing) is automatically a backup device.
For the password leak checks, your passwords are never transmitted. They are one-way hashed locally, and then only the first few characters of the hash are checked against the API provided at https://haveibeenpwned.com which is run and designed by Troy Hunt, one of the most respected people in the cybersecurity industry. He collects major password breaches and makes them available to check against without actually exposing the data. It’s perfectly safe and secure.