If you want to stay with a solution any moderately experienced developer can audit themselves without investing too much time, but would like to add a bit of us

If you want to stay with a solution any moderately experienced developer can audit themselves without investing too much time, but would like to add a bit of user friendliness, have a look at pass¹. It is nothing more than a script that calls the GnuPG binary and the tree command line utility for displaying a tree of files. It uses your GPG-keypair to encrypt text files. You can add as much info as you like, but by convention the first line of each file is assumed to be the password: # Generate a 32-character random password. pass generate sites/news.ycombinator.com 32 # Copy the password to the clipboard; this will ask you to unlock your GPG-key. pass -c sites/news.ycombinator.com 32 # Find stuff. pass find news # Edit the file (e.g., add the username). pass edit sites/news.ycombinator.com 32 All files are GPG-encrypted plain text files in a directory on disk. Easy to backup as well. There is a rather sweet feature you can use to share some passwords with someone. You can add a list of GPG key IDs in a file called .gpg-id in any of the subdirectories of your password store, and share that subdirectory using a syncing tool such as SyncThing². My partner and I each have our own password store, but share a directory called 'together' via SyncThing. All passwords stored there are encrypted using both our GPG-keys by pass, whilst our private entries remain encrypted just for our own respective keys. 1: https://www.passwordstore.org/ https://www.passwordstore.org/ 2: https://syncthing.net/ https://syncthing.net/