Ask HN: Password manager recommendation?

Do you actually pay for the service?

I have always been curious. What if the master password is compromised?

Been using 1Password for a year now on OSX/Windows/iOS and haven't hit any issues yet. The Windows app has a lot of catching up to do in terms of UX (I know there is a beta, but isn't stable enough for everyday use)

What surprised me is that they still don't have a Linux version!

I'm a fan of 1Password and use it on desktop (mac/win) and mobile (ios/Android), mandate it for some of our employees, and recommend it to family and friends. I am however not a fan of their push into to 1Password for clouds/teams/families/whatever. I demoed it and thought it was a vastly increased cost for marginal additional functionality compared to buying licenses. Worse is they appear to be devoting resources to the 'cloud' product while features of the stand alone software are put on the back burner. Could be a great business move from them. Who doesn't love MRR? (Well, besides customers). I still use and recommend it when the opportunity arises, but their new direction worries me.

I don't know how I "managed" without 1password. 1password saves me time every single day and greatly improves security as each login uses a unique and highly secure password. Finally use their iOS app for retrieving your passwords on the go.

I've been mostly using 1Password since my workplace provides an account that includes a personal vault, but I've also been looking at switching to Enpass for my personal passwords.

https://www.enpass.io

Some things I like about Enpass over 1Password:

- Has a Linux client.

- Offers free desktop clients, mobile clients require a 1 time purchase (not subscription based).

- Stores passwords locally. Sync is provided through a separate storage provider of your choosing (GDrive, iCloud, OneDrive, Dropbox, etc). I like this implementation much more than traditional cloud-based password managers because a hack of a single server (1Password's, for instance) won't compromise everybody's data and expose your (hopefully hashed) password database as collateral damage.

I'd love to hear from anyone who might have experience with both 1Password and Enpass on how it is to use Enpass on a daily basis compared to 1Password.

The nice thing about 1Password (is for the time being) the fact you don't have to use cloud services and can manage syncing locally or via Dropbox. They're making a big push to the web version which we use for work, but I have a personal account from forever ago that I still use the local WiFi sync with.

Great iOS integration, great OS X integration, awesome browser plugins, but the Windows UI is atrocious and Linux support is technically non-existent but there are ways.

LastPass is the last thing you should use. It got hacked in 2015 and 2016:

http://lifehacker.com/lastpass-hacked-time-to-change-your-ma...

https://www.hackread.com/lastpass-hacked-this-time-for-good/

Another happy customer here.

Notable features that I like: automatic password changes, security challenge (warns me about weak/previously used passwords), primarily web-based (works equally well on Linux).

Me too, but looking for another solution.

Why do you use two?

I also use Pass. It integrates great with git, so you can store your password database anywhere, and sync on demand with `pass git pull`.

Also by using GPG as an encryption mechanism it allows you to use your gpg-agent so you only have to authenticate when you log in to your computer.

Basically it relies on existing tools to solve existing problems (sync, encryption) and concentrates on the added value: listing, storage and retrieval of passwords.

A greatly useful application of the unix philosophy.

On linux, I use KeePassX. It's basically the same thing IIUC. I sync mine via an svn repo.

I use a small constellation of context-specific KeePass files (Work versus Home, for example) as the overall huge number of password groups ("folders") started to get hard to manage, and I also wanted to start better managing the specific devices with access to some of the files.

I had been using various combos of Dropbox/OneDrive to sync several of my primary files, but recently moved to Resilio Sync (formerly known as Bittorrent Sync) Encrypted Share folders because I can have "dumb nodes" that can share the "torrent" of the encrypted share folder but not access the internals (individual files), such as an always available VPS in the cloud somewhere.

I love Dashlane!

I've been there since Beta, too, and it's in the highest price tier for password managers, but it's often lauded as having the best user experience on desktop & mobile, and one of the simplest managers for even non-technical people. The local decryption also makes it uniquely secure and less susceptible to attacks like the LastPass attack in 2015.

Great product and happy to support the Dashlane team! You can store passwords, secure notes, payment methods, and even IDs like passport or driver's license numbers, with great autofill support.

Before Dashlane, I used a KeePass database that I synced with Dropbox, so I could access it on macOS or iOS, but the clients varied in quality, and when I switched to Dashlane, the experience was fantastic with autofill available on both macOS and iOS.

SplashID has that option. They promote a cloud-sync option, but you can opt for WiFi-Sync-Only instead, which will synchronize your phone to your desktop/laptop and never interact with the Cloud. There's also an option to never sync with any other device. I've been using it since the PalmOS days and have it working today across my Mac, Windows, iOS & Android devices.

https://www.splashid.com/

1Password has that option too. In fact if you happy with that option, you don't even have to pay them anything.

https://support.1password.com/sync-options/#sync-over-a-loca...

Btw, the closed source client is also a weak point in the whole architecture, but if you don't worry about that, then probably you shouldn't worry about letting them store your encrypted passwords.

KeePass (and family) store to encrypted files on your machine that never leave the device by default. It doesn't know or care about cloud or central server storage. (It simply provides a means to reconcile changes made in other files, such as synchronized conflict versions.)

Most people then choose the cloud storage of their own choice (Dropbox, OneDrive, Resilio Sync, etc...) to pass the files between devices as interested/necessary. KeePass doesn't know nor care that a sync provider is being used and its just like any other file to sync (which is why you can choose any file sync strategy under the sun).