12 ms·

Bitwarden – Open Source Password Manager

337 points by GutenYe 8y ago

amanzi 8y ago
I've been using this for the last few months and couldn't be happier. I use the browser extensions in Firefox, Chrome and Edge, as well as the desktop, Android and web apps.
- toomuchtodo 8y ago
  How does it compare to KeePassXC and 1Password?
  - amanzi 8y ago
    I found KeePassXC to be fairly clunky and didn't work well on Android with regards to autofilling forms, but that was a while back and it may have improved since then. Also with Bitwarden I've elected to have them host my encrypted passwords so I don't need to worry about setting up my own sync provider. I don't know much about 1Password but I didn't trust them to put too much effort into their Android app since they were predominantly an Apple shop.
    - toomuchtodo 8y ago
      Thank you!
    - FuckOffNeemo 8y ago
      Their (1Password) Android app is great. As you pointed out though, iOS always gets the UI\UX benefits first because they're focused predominately on the Apple eco.
    - Semaphor 8y ago
      > didn't work well on Android with regards to autofilling forms Works pretty well, I use "Keepass2Android Password Safe" and it supports the newest APIs to enable fully automatic filling once you tell it which app belongs to which account. For syncing I use my own nextcloud server.
- thorwwed9 8y ago
  What's the difference between their browser extension and web app (the vault)?
ramses0 8y ago
https://www.passwordstore.org/ https://www.passwordstore.org/
- hashkb 8y ago
  Can I take advantage of this on my mobile device or browser? Can I share with my team? It's not really apples to apples.
  - shakna 8y ago
    Yes. You can. [0] I run passff [1], to get Firefox to use it, and Android-Password-Store [2] on my phone. [0] https://www.passwordstore.org/#extensions https://www.passwordstore.org/#extensions [1] https://github.com/jvenant/passff#readme https://github.com/jvenant/passff#readme [2] https://github.com/zeapo/Android-Password-Store#readme https://github.com/zeapo/Android-Password-Store#readme
    - etu 8y ago
      Theres also browserpass [0], it works great in firefox and chrome as well. A great great plugin is pass-otp [1], using this I have migrated the storage of all OTP secrets from my phone to pass. And then I export it from pass to my phone. That way I still have my OTP secrets if I loose my phone and don't have to hassle with recovery of accounts just because of loosing the phone. For sure the OTP needs to be changed at that point but still worth it. It's also worth to mention that browserpass [0] integrates pass-otp [1] so whenever I log in to a page (that has an OTP secret) using browserpass it shows a litle box in the top right corner with the current OTP code that I can copy-paste to the site. [0]: https://github.com/browserpass/browserpass https://github.com/browserpass/browserpass [1]: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
  - TheDong 8y ago
    > Can I take advantage of this on my mobile device Yes. See the list of compatible clients on the page: https://www.passwordstore.org/#other https://www.passwordstore.org/#other I personally use it on android happily. > Can I share with my team? Yes. Just encrypt to multiple gpg ids, which can be customized per folder as well with a simple list in the ".gpg-id" file. I admit that you can only use it as such with tech-savvy team members. If you want usability such that non-technical people can work with it, you'll likely want something else, like 1password.
pvg 8y ago
Has come up a fair bit before. https://hn.algolia.com/?query=bitwarden&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?query=bitwarden&sort=byPopularity&pr...
- nepeckman 8y ago
  It was probably posted in response to the firefox lockbox announcement.
dorfsmay 8y ago
Can you keep the database on a local disk, Dropbox etc?
- amanzi 8y ago
  Not in the same way as other password managers. But you can set up your own Bitwarden instance using Docker if you don't want to trust them with your passwords.
- tylerhou 8y ago
  https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs is an api-compatible backend and uses SQLite as a database engine. You can also build it outside of Docker. I'm not sure how well SQLite binary files sync to Dropbox, but definitely you can run on local disk. source: https://news.ycombinator.com/item?id=17504187 https://news.ycombinator.com/item?id=17504187
fluxsauce 8y ago
If you were curious about the Open Source part (I was) - https://github.com/bitwarden/ https://github.com/bitwarden/
m_sahaf 8y ago
There are also two Bitwarden-compatible API implementations in Rust[0] and Ruby[1]. Their main advantage, IMO, is them doing away with the requirement of Microsoft SQL Server. [0] https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs [1] https://github.com/jcs/bitwarden-ruby https://github.com/jcs/bitwarden-ruby
- hashkb 8y ago
  This is great ammo for answering when anyone asks why Bitwarden (or OSS in general) is better than LastPass or 1passsword...
  - satysin 8y ago
    I thought it was very cool of Kyle, the Bitwarden dev, to give Joshua, the Ruby dev, a heads up about breaking API changes ahead of time. https://github.com/jcs/bitwarden-ruby/issues/32 https://github.com/jcs/bitwarden-ruby/issues/32
- lhl 8y ago
  There's also a Go implementation: https://github.com/VictorNine/bitwarden-go/ https://github.com/VictorNine/bitwarden-go/
- deusex_ 8y ago
  This is an AWS Serverless version which can run pretty much completely in Free Tier and you have HA out of the box https://github.com/vvondra/bitwarden-serverless https://github.com/vvondra/bitwarden-serverless
ron22 8y ago
I love Bitwarden. I signed up when it first launched and happy to see it continue to add features. One of the only projects I pay to support the project rather than to get access to the additional premium features.
albertop 8y ago
First paragraph on their page disqualifies it completely. I do not want my passwords on anybody’s servers. Our secure cloud syncing features allow you to access your data from anywhere, on any device! Your vault is conveniently optimized for use on desktop, laptop, tablet, and phone devices.
- ReverseCold 8y ago
  > I do not want my passwords on anybody’s servers. What about your own server? https://help.bitwarden.com/article/install-on-premise/ https://help.bitwarden.com/article/install-on-premise/
  - slenk 8y ago
    I run my own server; it works great and is incredibly easy to set up. I would highly recommend people check this software out. It's maybe not as feature rich as other password managers, but it is being actively developed and the few times I had questions I got a quick response from Kyle (the creator).
    - DavideNL 8y ago
      > I run my own server If you think it matters where the data is stored (which shouldn't matter because it should be client side encrypted), running your own server would also be a risk. Because you cannot possibly have the same resources to monitor your server/router for suspicious activity...
      - SteveGoob 8y ago
        That's true, but at the same time, there's something to be said for not storing my eggs in the huge basket with everyone else's eggs in it too. By separating the storage of passwords, we drive down the economic interest in breaking into any one of the individual baskets.
      - slenk 8y ago
        I still think it matters where data is stored because I don't trust most companies to not have back doors. Since its all my own equipment and I have a background in this sort of stuff, I know what I am looking for when it comes to intrusions.
keehun 8y ago
I really, really want to be a big fan of Bitwarden. I even used it for the past year and a half. However, the last time HN talked about Bitwarden 7 months ago, I listed some reasons[0] why Bitwarden still fell massively short of 1Password, and I feel that those three points have not been addressed (which I believe impacts the friction/convenience of using Bitwarden). My three points then were: 1. A stand-alone desktop app. Quite annoying to have to open up a browser every time I want to access a password. Basically, it's as inconvenient as Keychain on OSX if you're not using a browser when you need a login info. This could be solved if the browser plugin popup could be persisted as its own window. 2. iOS app is not polished. Not sure about Android app as I've not used it. (* biggest problem then was how slow search was. It has been improved although nowhere as fast as 1Password's—still) 3. In the Safari extension, I would love to be able to search and use item entries that are not specific to the domain. Sometimes, I have other info in secured notes or password entries without a domain that I want to get to from the extension. In these cases, I've had to leave the browser and open the actual app to get access to them. I just migrated from Bitwarden to 1Password a few days ago and have been much happier since—especially with 1Password's ability to generate 2 factor tokens and put them in your pasteboard automatically so you don't ever have to pull up an Authenticator app! [0]: https://news.ycombinator.com/item?id=15734260 https://news.ycombinator.com/item?id=15734260
- xxkylexx 8y ago
  There has been a standalone Windows desktop app since February. https://bitwarden.com/#download https://bitwarden.com/#download > Especially with 1Password's ability to generate 2 factor tokens and put them in your pasteboard automatically so you don't ever have to pull up an Authenticator app! Bitwarden also does this.
  - keehun 8y ago
    Thanks for letting me know! Somehow, it wasn't very obvious to me on both desktop app and OTP feature. I still felt its sluggish performance on launch/search/sync was slowing me down a lot throughout the day.
Solar19 8y ago
This looks like it could be better than LastPass. Bitwarden is the only password manager that I've seen that officially supports Opera, Vivaldi, and Brave. I wonder what the browser support on Android is like. LastPass seems to work only on Chrome on Android, but I like to use Firefox, Opera, and Samsung's optimized browser.
- jillesvangurp 8y ago
  Firefox mobile can use the extension and the native android app is fully supported by Android's password completion support as well.
- LyndsySimon 8y ago
  > Bitwarden is the only password manager that I've seen that officially supports Opera, Vivaldi, and Brave. Brave bundles their extensions, and have gone months between updates in the past. Be aware of that if you use it, as it's a potential security issue with a password manager. > I wonder what the browser support on Android is like. Android support is excellent. The only nagging issue I had was that the "URL" for an app is usually something like "com.github", while the URL stored in the login is "github.com". Bitwarden is good about partial matches, so it's rare that I had to search for the login I wanted. > LastPass seems to work only on Chrome on Android, but I like to use Firefox, Opera, and Samsung's optimized browser. I moved off Android a few months ago, but I was using Brave and Bitwarden integrated seamlessly. It ties in to the "accessibility" framework I think, and offers an option in the system dropdown menu when a login is detected.
rohan404 8y ago
We evaluated Bitwarden to use as our company vault for shared accesses, however found OneLogin to have a better UI, additional functionality (especially when it came to syncing with our Google directory) and the price (for enterprise) wasn't too much less than OneLogin (which is negotiable anyways).
- jhickmanit 8y ago
  I personally would be a little wary or OneLogin, they suffered a breach in the past[1]. I know a lot of services are breached but one keeping my secrets I want rock solid. https://krebsonsecurity.com/2017/06/onelogin-breach-exposed-ability-to-decrypt-data/ https://krebsonsecurity.com/2017/06/onelogin-breach-exposed-...
  - crypt1d 8y ago
    to be fair, many of them could be breached already, u just don't know about it yet. At least with OneLogin there was a disclosure and pressure from the public to improve their opsec.
ericseppanen 8y ago
"Each Bitwarden installation requires a unique installation id and installation key." Sorry, it doesn't count as open source if everyone needs your permission to run it.
- mcfedr 8y ago
  It's open source, not to hard to remove this requirement
  - ericseppanen 8y ago
    The time investment to prove or disprove this statement is more than I'm willing to give. I'd prefer to spend my time working with projects whose maintainers aren't hostile to my privacy.
    - tylerhou 8y ago
      > whose maintainers aren't hostile to my privacy How are they violating your privacy?
duxup 8y ago
I've been a Keepass user for so long I just haven't wanted to switch. I just don't want to use someone else's server... or setup my own. Even so best of luck to them.
- negus 8y ago
  Yeah. You may sync your keepass db using Google.Drive-like services -- I do this
jhabdas 8y ago
For years I've discouraged use of clouds for storing passwords. But because Bitwarden is FOSS software, encrypts data on the client, has good cross-platform support, and can operate if the company goes out of business they have won me over for the storage of secrets I'm not reserving for the sneakernet.
- bad_user 8y ago
  Last time I checked Bitwarden was not encrypting data on the client. Did that change? Also, OSS does not mean secure. Without audits from security experts, I can’t trust it. Bitwarden is objectivity less secure than 1Password or Keepass actually, at the very least because it doesn’t have a desktop application.
  - number6 8y ago
    Bitwarden has a desktop client. If you are hosting it on your private server does it change your outlook on its security?
    - bad_user 8y ago
      No, it’s worse.
      - zouhair 8y ago
        Very thorough argument.
        bad_user 8y ago
        Matches the question, but should be obvious why. I do not have the inclination or resources to secure and keep my server up to date, unless we are talking about a periodic "apt upgrade" that I could configure to run automatically, but no more than that. And at the very least I know how to reasonably secure a Linux server, at least initially. If running your own server gives you peace of mind in terms of security, then read more about how security works and the threat model you'll face. Just to give an obvious example ... running your own Wordpress is one of the worst thing you can do on your own server, putting your whole server at risk, not just your website.
anotherevan 8y ago
I recently switched to BitWarden from Lastpass after trying a few different options including pass, Enpass and KeePass options. 95% of my usage is in the desktop browser, and the UI of their add-on is great, IMO. Lastpass' had been getting worse for some time, and their shuttering of Xmarks finally left me with no good reason to stay. Using the add-on with Firefox on my phone is reasonable, although could be a bit better. Phone experience in general I'd say is also quite reasonable - not used it that much yet, but I think it is quite comparable to other offerings.
- rosege 8y ago
  Was the data transfer easy between the 2? I'm thinking of doing the same.
  - anotherevan 8y ago
    Yes, it was very easy. Just follow the instructions from here: https://help.bitwarden.com/article/import-from-lastpass/ https://help.bitwarden.com/article/import-from-lastpass/
    - jumbopapa 8y ago
      Do pay attention to the HTML encoded characters mentioned on that page because I was going crazy trying to figure out why some passwords didn't work after I imported them.
  - e12e 8y ago
    At the time I migrated from pass, there were no custom import/export - but bitwarden csv support is enough that you should be able to migrate anything where you can get at your logins in any structured format via some minor scripting.
widerporst 8y ago
I'm using KeepassXC on desktop, Keepass2Android on mobile and Dropbox for syncing the database and I'm quite happy with it. Bitwarden looks a bit more polished, but are there any other advantages over Keepass?
- timendum 8y ago
  Check also KeePass Dx for Android, it has some nice features like Fingerprint for fast unlocking, AutoFill and a nicer Material Theme.
  - mrrsm 8y ago
    Other then the design being a tiny bit different I can't see what KeePass Dx offers that differentiates itself from Keepass2Android?
  - h4waii 8y ago
    KeePass DX doesn't support syncing the database natively. With Keepass2Android, you don't need to install the Dropbox client to save the database to cloud providers.
- tshannon 8y ago
  Same, and for accessing it over the web (for when I'm not on my own machine) I use keeweb (https://keeweb.info/ https://keeweb.info/)
cipherzero 8y ago
I love bitwarden, and have converted to it. However i just learned about https://passman.cc/ https://passman.cc/ Has anyone used that?
- guroot 8y ago
  Yes, I'm using it currently and have for over a year. It works well enough. However; The mobile apps haven't shown progress in over a year. Development on the main app is very slow. The browser extensions work, but do have minor quirks. Honestly it feels like a dead project, It's not but it's lacking in resources and the devs are lacking in time from what I've been able to gather from the issue tracker. https://github.com/nextcloud/passman/issues https://github.com/nextcloud/passman/issues I do sometimes worry I'm one nextcloud update away from losing access to my passwords as a recent one did mess with the interface a bit, it's still functional but some ui elements are mis-aligned. I've been considering switching to bitwarden for a while, It's interface is much nicer, and more polished. I've mostly been waiting for one of the alternative API implementations to mature a bit, because I don't want to have to run a big honking MS-SQL container on my little VPS. I'm also going to have to write my own importer, or mangle the data a bit because the cvs format for passman isn't compatible with any of the import formats for bitwarden. Or maybe I'll just give up and migrate to pass or gopass(https://www.gopass.pw/ https://www.gopass.pw/) worth looking at if you like pass). I think I want too much from my password manager =/
logix 8y ago
It's full of shills every time there's an article about password managers. I wonder if they come from LastPass or 1Password.
ggm 8y ago
If somebody wrote code to let me send the second factor from a nominated device as my banks use of Symantec technology does.. it would be cool: I keep meaning to remind myself having the second factor inside 1password is not a second independent factor.
ohthehugemanate 8y ago
I switched from LastPass to bitwarden in November, and I love it. - it's FOSS, and audited, so it's software I can trust - great UX on Firefox, chrome, and even Edge. I had my issues, but the project improved them away very quickly. - sharing support for families or organizations. - convenient standalone clients for win/Mac/Linux... And even the CLI. - built in 2FA code generation for each entry, so I don't need a separate app for that. - the best autofill I've experienced, on desktop browser and even on mobile(!) - open API so there are third party clients available - the lead developer is super responsive on GH, so I've been able to contribute. - cheaper than the alternatives (at least at the time), and I feel good about where my money is going. I can't recommend it strongly enough. It's one of the OSS applications that has a permanent place on all my devices, right up there with Firefox quantum in my "great examples of OSS" liste.
- giggsey 8y ago
  Is storing the 2FA codes alongside your password a wise idea?
  - Borealid 8y ago
    Yes, if the attack vector you're trying to close is a compromised keyboard/network/terminal and not a stolen-while-unlocked device. "Catching" one 2FA code doesn't let you compromise someone's account. Losing (or having compromised) the hardware running your password manager while that password manager is unlocked is a totally different thing from logging into a web site once from a library computer.
    - pilif 8y ago
      > Yes, if the attack vector you're trying to close is a compromised keyboard/network/terminal and not a stolen-while-unlocked device. however, not having the TOTP key in your password manager would also protect against malware on your machine running the password manager from gaining access to your account.
  - LyndsySimon 8y ago
pmontra 8y ago
https://github.com/bitwarden/core/blob/master/README.md https://github.com/bitwarden/core/blob/master/README.md SQL Server 2017, really? Interesting choice. Open source but we have to pay licenses for the database if we want to self host. I wonder what was wrong with PostgreSQL or MySQL even if they're using .NET Core as a language. Edit: there is an issue for that https://github.com/bitwarden/core/issues/10 https://github.com/bitwarden/core/issues/10
- some_account 8y ago
  Ah shit, its a . NET program :( It all sounded really good until this point. I was even going to say you could add support for postgres, but I don't know a lot of open source devs who are using. NET.
  - hottycat3 8y ago
    Keepass2 is also Open-Source and .Net because as far as I know .Net offers some extra security on Windows like locking the desktop while entering the master password.
    - vasili111 8y ago
      Can you please give me a link about locking desktop while entering a master password in KeePass? I want to know more about it.
      - graedus 8y ago
        https://keepass.info/help/kb/sec_desk.html https://keepass.info/help/kb/sec_desk.html
- syshum 8y ago
  Pretty sure they were in the BizSpark program from Microsoft so that probably influenced alot of their technology choices
  - 8y ago
xtf 8y ago
Seriously? A password manager where the desktop app is build ontop of unsecure electron.
- Starz0r 8y ago
  I get that Electron is undesirable, but what do you mean by unsecure? Also, can you list some alternatives if you don't want them building a desktop app in Electron?
  - self_awareness 8y ago
    Malware can sweep through the memory to find passwords by reading memory directly from another process' address space.
    - smw 8y ago
      This is a risk in desktop software written in other languages and with other gui frameworks as well, no?
Mefis 8y ago
Any reason not to use Firefox's own password sync? It's been working fine for me so far.
czei002 8y ago
On problem with password managers (that are using web authentication to create/manage an account for backing up the password manager in the cloud) is that the authentication password can be leaked during the authentication process. For example, the storage provider for password manager backup can simply read the password from the authentication web page since this web page is hosted at the provider. This is problematic if the authentication password is also used to encrypt the password manager, i.e. the provider could decrypt the password manager with the authentication password. You would actually need two passwords; one for authentication and one for encryption. Unfortunately, you usually don't even have the option to choose two passwords. To solve this problem I'm working on FejoaAuth (https://fejoa.org/fejoapage/auth.html https://fejoa.org/fejoapage/auth.html). FejoaAuth uses an authentication protocol that does not leak the user password to the provider who is going to store the password manager. This protocol is run in a trusted browser plugin in order to ensure the correct execution of the protocol. Thus you can use a single password for authentication and password manager encryption.
geberl 8y ago
If you're searching for an open-source self-hosted alternative that offers corporate features like LDAP integration take a look at SysPass (https://github.com/nuxsmin/sysPass https://github.com/nuxsmin/sysPass). Doesn't look as nice as Bitwarden though.
amaccuish 8y ago
I like Enpass. Syncs to my own nextcloud. What other password managers can do that out of interest?
- justtoast 8y ago
  I also use Enpass. It needs more of a mention in these threads.
  - npongratz 8y ago
    I suspect Enpass doesn't get much mention on HN threads because it is not (or at least, does not obviously appear to be) open source, which I've observed is of paramount interest to a large number of HN readers -- full disclosure: including me. Because it is not open source [0], we must take statements like the following purely on faith in their PR department, rather than being able to independently verify: https://www.enpass.io/kb/if-enpass-is-an-offline-password-manager-then-why-does-it-connects-to-internet-and-shows-network-activity/ https://www.enpass.io/kb/if-enpass-is-an-offline-password-ma... "Indeed Enpass is an offline password manager and saves your data locally on your device and in any case, we do not (and we can not) access any of your data. But yes, Enpass does connect to the internet with the sole purpose to give best user experience." I'm sure they're really nice people, and do their best, etc, etc, but passwords are the linchpin crown jewels. Enpass could secretly and instantaneously become bad actors or incompetent stewards of said crown jewels, and we wouldn't know, since we cannot see what they are doing. One of many risks I would not take. [0] Please correct me if my search-engine-fu is weak today, but I can find no official Enpass open source repos or code anywhere.
  - anmipo 8y ago
    One fine day Enpass pulled the their app from BlackBerry users - no warnings, no refunds: https://www.enpass.io/blog/discontinuing-the-support-for-enpass-on-blackberry/ https://www.enpass.io/blog/discontinuing-the-support-for-enp... There are quite a few comments from paying customers, who were locked out of their data. According to timestamps, Enpass team successfully ignored these comments for months. Perhaps this should be mentioned whenever Enpass surfaces as an option...
solidrake 8y ago
I love the Linux app, and the integration on browser extensions and Android app, but the Android app is very limited on features. I love projects like this, and support them as a paid member, just like ProtonMail.
vasili111 8y ago
What are the advantages and disadvantages of Bitwarden over KeePassXC?
- commanderkeen08 8y ago
  A web UI and iOS app that supports Face ID and TOTP codes.
nickjj 8y ago
If anyone wants an open source command line driven password manager that doesn't require signing up or hosting anything, I recommend checking out "Pass". It piggy backs off GPG encryption. https://www.passwordstore.org/ https://www.passwordstore.org/ I use it to manage over 300 passwords and other sensitive blobs of text (it lets you save arbitrary text snippets) and also has some nifty quality of life features like auto-copying a password to your clipboard for 30 seconds when you want to access a specific password.
- chme 8y ago
  I like and use pass regulary, but it has some inconveniences. - It doesn't encrypt the paths to the passwords - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password - It doesn't work with (Update: X.509) smartcards/gpgsm - It's written in bash. That has pros and cons...
  - phaer 8y ago
    > - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password only the first line of an encrypted file is considered to be the password. So you can just but your username or any other account-related information on the following lines. > - It doesn't encrypt the paths to the passwords To elaborate: One of the problems with this approach is that it may leak websites where you have accounts to people who gain access to your pass repo/directory even without gaining control of your gpg key. > - It doesn't work with smartcards/gpgsm What do you mean by that? I use pass with my yubikey as a gpg "smartcard"?
    - chme 8y ago
      >> - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password > only the first line of an encrypted file is considered to be the password. So you can just but your username or any other account-related information on the following lines. I didn't know that. But what I would have preferred was copying the username with one command and copying the password with another. >> - It doesn't work with smartcards/gpgsm > What do you mean by that? I use pass with my yubikey as a gpg "smartcard"? I haven't tried that with a yubi key, but with a corporate X.509 id card. And that needed gpgsm. I had to patch pass in order for it to work, because gpgsm uses different parameters that gpg.
tehabe 8y ago
What I really like about Bitwarden is, that you can define several URLs for one entry, I have some services which can be accessed from several addresses (same account) though. It is also possible to define how a URL is matched which is a nice feature too.
commanderkeen08 8y ago
Here’s why I switched from 1Password— I recently picked up a Pixelbook and have gone all in on ChromeOS. Its replaced my MBP. But unfortunately, that meant parting ways with 1Password. I needed a new password manager with the following: Self hosted TOTP support (have since decided not to use this) A web UI IOS app with face/Touch ID. I tried the 1Password subscription but 1Password X just felt too clunky and I wasn’t in love with storing on their server. Keepass/XC/whatever was a hot mess for me. I really wanted to use it and the idea of keeping and syncing a single db file still really appeals to me, but the ecosystem is such a mess. I tried running a self hosted container for Keepass Web but I kept having to enter a Dropbox API key on every client. I also couldn’t find an iOS app that supported Face ID or the option for storing TOTP. Maybe it’s a better experience on Android. On top of that, the UI was pretty jarring all around. Bitwarden still has some work in the UI department. The lack of keyboard shortcuts and a native app adds some resistance but it’s manageable for me.
untitled_bob 8y ago
1Password works great on iOS and macOS but it's not open source... and there's the subscription they try to impose... and their servers... So I was looking to replace it. Bitwarden could be the one in the near future as Keepass is a real pain on iOS and mac for a non-techie. The problem I still have with bitwarden is that the app won't work unless connected to the internet. If the connection is missing you can't add or edit anything, store on your device and sync later :-(
alexeymetz 8y ago
This is nice product, but server requirement completely eliminates it as a candidate instead of 1Password for me. I still can't find a better open-source solution which works completely offline on desktop, browsers and mobile devices with the possibility of synchronization using 3rd-party services, decent UI and at least the ability to store TOTP passwords. Enpass is good, but it's proprietary too.

337 points by GutenYe 8y ago

I've been using this for the last few months and couldn't be happier. I use the browser extensions in Firefox, Chrome and Edge, as well as the desktop, Android and web apps.

toomuchtodo 8y ago
How does it compare to KeePassXC and 1Password?
- amanzi 8y ago
  I found KeePassXC to be fairly clunky and didn't work well on Android with regards to autofilling forms, but that was a while back and it may have improved since then. Also with Bitwarden I've elected to have them host my encrypted passwords so I don't need to worry about setting up my own sync provider. I don't know much about 1Password but I didn't trust them to put too much effort into their Android app since they were predominantly an Apple shop.
  - toomuchtodo 8y ago
    Thank you!
  - FuckOffNeemo 8y ago
    Their (1Password) Android app is great. As you pointed out though, iOS always gets the UI\UX benefits first because they're focused predominately on the Apple eco.
  - Semaphor 8y ago
    > didn't work well on Android with regards to autofilling forms Works pretty well, I use "Keepass2Android Password Safe" and it supports the newest APIs to enable fully automatic filling once you tell it which app belongs to which account. For syncing I use my own nextcloud server.
thorwwed9 8y ago
What's the difference between their browser extension and web app (the vault)?

ramses0 8y ago

https://www.passwordstore.org/ https://www.passwordstore.org/

hashkb 8y ago
Can I take advantage of this on my mobile device or browser? Can I share with my team? It's not really apples to apples.
- shakna 8y ago
  Yes. You can. [0] I run passff [1], to get Firefox to use it, and Android-Password-Store [2] on my phone. [0] https://www.passwordstore.org/#extensions https://www.passwordstore.org/#extensions [1] https://github.com/jvenant/passff#readme https://github.com/jvenant/passff#readme [2] https://github.com/zeapo/Android-Password-Store#readme https://github.com/zeapo/Android-Password-Store#readme
  - etu 8y ago
    Theres also browserpass [0], it works great in firefox and chrome as well. A great great plugin is pass-otp [1], using this I have migrated the storage of all OTP secrets from my phone to pass. And then I export it from pass to my phone. That way I still have my OTP secrets if I loose my phone and don't have to hassle with recovery of accounts just because of loosing the phone. For sure the OTP needs to be changed at that point but still worth it. It's also worth to mention that browserpass [0] integrates pass-otp [1] so whenever I log in to a page (that has an OTP secret) using browserpass it shows a litle box in the top right corner with the current OTP code that I can copy-paste to the site. [0]: https://github.com/browserpass/browserpass https://github.com/browserpass/browserpass [1]: https://github.com/tadfisher/pass-otp https://github.com/tadfisher/pass-otp
- TheDong 8y ago
  > Can I take advantage of this on my mobile device Yes. See the list of compatible clients on the page: https://www.passwordstore.org/#other https://www.passwordstore.org/#other I personally use it on android happily. > Can I share with my team? Yes. Just encrypt to multiple gpg ids, which can be customized per folder as well with a simple list in the ".gpg-id" file. I admit that you can only use it as such with tech-savvy team members. If you want usability such that non-technical people can work with it, you'll likely want something else, like 1password.

pvg 8y ago

Has come up a fair bit before. https://hn.algolia.com/?query=bitwarden&sort=byPopularity&prefix&page=0&dateRange=all&type=story https://hn.algolia.com/?query=bitwarden&sort=byPopularity&pr...

nepeckman 8y ago
It was probably posted in response to the firefox lockbox announcement.

dorfsmay 8y ago

Can you keep the database on a local disk, Dropbox etc?

amanzi 8y ago
Not in the same way as other password managers. But you can set up your own Bitwarden instance using Docker if you don't want to trust them with your passwords.
tylerhou 8y ago
https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs is an api-compatible backend and uses SQLite as a database engine. You can also build it outside of Docker. I'm not sure how well SQLite binary files sync to Dropbox, but definitely you can run on local disk. source: https://news.ycombinator.com/item?id=17504187 https://news.ycombinator.com/item?id=17504187

fluxsauce 8y ago

If you were curious about the Open Source part (I was) - https://github.com/bitwarden/ https://github.com/bitwarden/

m_sahaf 8y ago

There are also two Bitwarden-compatible API implementations in Rust[0] and Ruby[1]. Their main advantage, IMO, is them doing away with the requirement of Microsoft SQL Server. [0] https://github.com/dani-garcia/bitwarden_rs https://github.com/dani-garcia/bitwarden_rs [1] https://github.com/jcs/bitwarden-ruby https://github.com/jcs/bitwarden-ruby

hashkb 8y ago
This is great ammo for answering when anyone asks why Bitwarden (or OSS in general) is better than LastPass or 1passsword...
- satysin 8y ago
  I thought it was very cool of Kyle, the Bitwarden dev, to give Joshua, the Ruby dev, a heads up about breaking API changes ahead of time. https://github.com/jcs/bitwarden-ruby/issues/32 https://github.com/jcs/bitwarden-ruby/issues/32
lhl 8y ago
There's also a Go implementation: https://github.com/VictorNine/bitwarden-go/ https://github.com/VictorNine/bitwarden-go/
deusex_ 8y ago
This is an AWS Serverless version which can run pretty much completely in Free Tier and you have HA out of the box https://github.com/vvondra/bitwarden-serverless https://github.com/vvondra/bitwarden-serverless

ron22 8y ago

I love Bitwarden. I signed up when it first launched and happy to see it continue to add features. One of the only projects I pay to support the project rather than to get access to the additional premium features.

albertop 8y ago

First paragraph on their page disqualifies it completely. I do not want my passwords on anybody’s servers. Our secure cloud syncing features allow you to access your data from anywhere, on any device! Your vault is conveniently optimized for use on desktop, laptop, tablet, and phone devices.

ReverseCold 8y ago
> I do not want my passwords on anybody’s servers. What about your own server? https://help.bitwarden.com/article/install-on-premise/ https://help.bitwarden.com/article/install-on-premise/
- slenk 8y ago
  I run my own server; it works great and is incredibly easy to set up. I would highly recommend people check this software out. It's maybe not as feature rich as other password managers, but it is being actively developed and the few times I had questions I got a quick response from Kyle (the creator).
  - DavideNL 8y ago
    > I run my own server If you think it matters where the data is stored (which shouldn't matter because it should be client side encrypted), running your own server would also be a risk. Because you cannot possibly have the same resources to monitor your server/router for suspicious activity...
    - SteveGoob 8y ago
      That's true, but at the same time, there's something to be said for not storing my eggs in the huge basket with everyone else's eggs in it too. By separating the storage of passwords, we drive down the economic interest in breaking into any one of the individual baskets.
    - slenk 8y ago
      I still think it matters where data is stored because I don't trust most companies to not have back doors. Since its all my own equipment and I have a background in this sort of stuff, I know what I am looking for when it comes to intrusions.

keehun 8y ago

I really, really want to be a big fan of Bitwarden. I even used it for the past year and a half. However, the last time HN talked about Bitwarden 7 months ago, I listed some reasons[0] why Bitwarden still fell massively short of 1Password, and I feel that those three points have not been addressed (which I believe impacts the friction/convenience of using Bitwarden). My three points then were: 1. A stand-alone desktop app. Quite annoying to have to open up a browser every time I want to access a password. Basically, it's as inconvenient as Keychain on OSX if you're not using a browser when you need a login info. This could be solved if the browser plugin popup could be persisted as its own window. 2. iOS app is not polished. Not sure about Android app as I've not used it. (* biggest problem then was how slow search was. It has been improved although nowhere as fast as 1Password's—still) 3. In the Safari extension, I would love to be able to search and use item entries that are not specific to the domain. Sometimes, I have other info in secured notes or password entries without a domain that I want to get to from the extension. In these cases, I've had to leave the browser and open the actual app to get access to them. I just migrated from Bitwarden to 1Password a few days ago and have been much happier since—especially with 1Password's ability to generate 2 factor tokens and put them in your pasteboard automatically so you don't ever have to pull up an Authenticator app! [0]: https://news.ycombinator.com/item?id=15734260 https://news.ycombinator.com/item?id=15734260

xxkylexx 8y ago
There has been a standalone Windows desktop app since February. https://bitwarden.com/#download https://bitwarden.com/#download > Especially with 1Password's ability to generate 2 factor tokens and put them in your pasteboard automatically so you don't ever have to pull up an Authenticator app! Bitwarden also does this.
- keehun 8y ago
  Thanks for letting me know! Somehow, it wasn't very obvious to me on both desktop app and OTP feature. I still felt its sluggish performance on launch/search/sync was slowing me down a lot throughout the day.

Solar19 8y ago

This looks like it could be better than LastPass. Bitwarden is the only password manager that I've seen that officially supports Opera, Vivaldi, and Brave. I wonder what the browser support on Android is like. LastPass seems to work only on Chrome on Android, but I like to use Firefox, Opera, and Samsung's optimized browser.

jillesvangurp 8y ago
Firefox mobile can use the extension and the native android app is fully supported by Android's password completion support as well.
LyndsySimon 8y ago
> Bitwarden is the only password manager that I've seen that officially supports Opera, Vivaldi, and Brave. Brave bundles their extensions, and have gone months between updates in the past. Be aware of that if you use it, as it's a potential security issue with a password manager. > I wonder what the browser support on Android is like. Android support is excellent. The only nagging issue I had was that the "URL" for an app is usually something like "com.github", while the URL stored in the login is "github.com". Bitwarden is good about partial matches, so it's rare that I had to search for the login I wanted. > LastPass seems to work only on Chrome on Android, but I like to use Firefox, Opera, and Samsung's optimized browser. I moved off Android a few months ago, but I was using Brave and Bitwarden integrated seamlessly. It ties in to the "accessibility" framework I think, and offers an option in the system dropdown menu when a login is detected.

rohan404 8y ago

We evaluated Bitwarden to use as our company vault for shared accesses, however found OneLogin to have a better UI, additional functionality (especially when it came to syncing with our Google directory) and the price (for enterprise) wasn't too much less than OneLogin (which is negotiable anyways).

jhickmanit 8y ago
I personally would be a little wary or OneLogin, they suffered a breach in the past[1]. I know a lot of services are breached but one keeping my secrets I want rock solid. https://krebsonsecurity.com/2017/06/onelogin-breach-exposed-ability-to-decrypt-data/ https://krebsonsecurity.com/2017/06/onelogin-breach-exposed-...
- crypt1d 8y ago
  to be fair, many of them could be breached already, u just don't know about it yet. At least with OneLogin there was a disclosure and pressure from the public to improve their opsec.

ericseppanen 8y ago

"Each Bitwarden installation requires a unique installation id and installation key." Sorry, it doesn't count as open source if everyone needs your permission to run it.

mcfedr 8y ago
It's open source, not to hard to remove this requirement
- ericseppanen 8y ago
  The time investment to prove or disprove this statement is more than I'm willing to give. I'd prefer to spend my time working with projects whose maintainers aren't hostile to my privacy.
  - tylerhou 8y ago
    > whose maintainers aren't hostile to my privacy How are they violating your privacy?

duxup 8y ago

I've been a Keepass user for so long I just haven't wanted to switch. I just don't want to use someone else's server... or setup my own. Even so best of luck to them.

negus 8y ago
Yeah. You may sync your keepass db using Google.Drive-like services -- I do this

jhabdas 8y ago

For years I've discouraged use of clouds for storing passwords. But because Bitwarden is FOSS software, encrypts data on the client, has good cross-platform support, and can operate if the company goes out of business they have won me over for the storage of secrets I'm not reserving for the sneakernet.

bad_user 8y ago
Last time I checked Bitwarden was not encrypting data on the client. Did that change? Also, OSS does not mean secure. Without audits from security experts, I can’t trust it. Bitwarden is objectivity less secure than 1Password or Keepass actually, at the very least because it doesn’t have a desktop application.
- number6 8y ago
  Bitwarden has a desktop client. If you are hosting it on your private server does it change your outlook on its security?
  - bad_user 8y ago
    No, it’s worse.
    - zouhair 8y ago
      Very thorough argument.
      - bad_user 8y ago
        Matches the question, but should be obvious why. I do not have the inclination or resources to secure and keep my server up to date, unless we are talking about a periodic "apt upgrade" that I could configure to run automatically, but no more than that. And at the very least I know how to reasonably secure a Linux server, at least initially. If running your own server gives you peace of mind in terms of security, then read more about how security works and the threat model you'll face. Just to give an obvious example ... running your own Wordpress is one of the worst thing you can do on your own server, putting your whole server at risk, not just your website.

anotherevan 8y ago

I recently switched to BitWarden from Lastpass after trying a few different options including pass, Enpass and KeePass options. 95% of my usage is in the desktop browser, and the UI of their add-on is great, IMO. Lastpass' had been getting worse for some time, and their shuttering of Xmarks finally left me with no good reason to stay. Using the add-on with Firefox on my phone is reasonable, although could be a bit better. Phone experience in general I'd say is also quite reasonable - not used it that much yet, but I think it is quite comparable to other offerings.

rosege 8y ago
Was the data transfer easy between the 2? I'm thinking of doing the same.
- anotherevan 8y ago
  Yes, it was very easy. Just follow the instructions from here: https://help.bitwarden.com/article/import-from-lastpass/ https://help.bitwarden.com/article/import-from-lastpass/
  - jumbopapa 8y ago
    Do pay attention to the HTML encoded characters mentioned on that page because I was going crazy trying to figure out why some passwords didn't work after I imported them.
- e12e 8y ago
  At the time I migrated from pass, there were no custom import/export - but bitwarden csv support is enough that you should be able to migrate anything where you can get at your logins in any structured format via some minor scripting.

widerporst 8y ago

I'm using KeepassXC on desktop, Keepass2Android on mobile and Dropbox for syncing the database and I'm quite happy with it. Bitwarden looks a bit more polished, but are there any other advantages over Keepass?

timendum 8y ago
Check also KeePass Dx for Android, it has some nice features like Fingerprint for fast unlocking, AutoFill and a nicer Material Theme.
- mrrsm 8y ago
  Other then the design being a tiny bit different I can't see what KeePass Dx offers that differentiates itself from Keepass2Android?
- h4waii 8y ago
  KeePass DX doesn't support syncing the database natively. With Keepass2Android, you don't need to install the Dropbox client to save the database to cloud providers.
tshannon 8y ago
Same, and for accessing it over the web (for when I'm not on my own machine) I use keeweb (https://keeweb.info/ https://keeweb.info/)

cipherzero 8y ago

I love bitwarden, and have converted to it. However i just learned about https://passman.cc/ https://passman.cc/ Has anyone used that?

guroot 8y ago
Yes, I'm using it currently and have for over a year. It works well enough. However; The mobile apps haven't shown progress in over a year. Development on the main app is very slow. The browser extensions work, but do have minor quirks. Honestly it feels like a dead project, It's not but it's lacking in resources and the devs are lacking in time from what I've been able to gather from the issue tracker. https://github.com/nextcloud/passman/issues https://github.com/nextcloud/passman/issues I do sometimes worry I'm one nextcloud update away from losing access to my passwords as a recent one did mess with the interface a bit, it's still functional but some ui elements are mis-aligned. I've been considering switching to bitwarden for a while, It's interface is much nicer, and more polished. I've mostly been waiting for one of the alternative API implementations to mature a bit, because I don't want to have to run a big honking MS-SQL container on my little VPS. I'm also going to have to write my own importer, or mangle the data a bit because the cvs format for passman isn't compatible with any of the import formats for bitwarden. Or maybe I'll just give up and migrate to pass or gopass(https://www.gopass.pw/ https://www.gopass.pw/) worth looking at if you like pass). I think I want too much from my password manager =/

logix 8y ago

It's full of shills every time there's an article about password managers. I wonder if they come from LastPass or 1Password.

ggm 8y ago

If somebody wrote code to let me send the second factor from a nominated device as my banks use of Symantec technology does.. it would be cool: I keep meaning to remind myself having the second factor inside 1password is not a second independent factor.

ohthehugemanate 8y ago

I switched from LastPass to bitwarden in November, and I love it. - it's FOSS, and audited, so it's software I can trust - great UX on Firefox, chrome, and even Edge. I had my issues, but the project improved them away very quickly. - sharing support for families or organizations. - convenient standalone clients for win/Mac/Linux... And even the CLI. - built in 2FA code generation for each entry, so I don't need a separate app for that. - the best autofill I've experienced, on desktop browser and even on mobile(!) - open API so there are third party clients available - the lead developer is super responsive on GH, so I've been able to contribute. - cheaper than the alternatives (at least at the time), and I feel good about where my money is going. I can't recommend it strongly enough. It's one of the OSS applications that has a permanent place on all my devices, right up there with Firefox quantum in my "great examples of OSS" liste.

giggsey 8y ago
Is storing the 2FA codes alongside your password a wise idea?
- Borealid 8y ago
  Yes, if the attack vector you're trying to close is a compromised keyboard/network/terminal and not a stolen-while-unlocked device. "Catching" one 2FA code doesn't let you compromise someone's account. Losing (or having compromised) the hardware running your password manager while that password manager is unlocked is a totally different thing from logging into a web site once from a library computer.
  - pilif 8y ago
    > Yes, if the attack vector you're trying to close is a compromised keyboard/network/terminal and not a stolen-while-unlocked device. however, not having the TOTP key in your password manager would also protect against malware on your machine running the password manager from gaining access to your account.
- LyndsySimon 8y ago

pmontra 8y ago

https://github.com/bitwarden/core/blob/master/README.md https://github.com/bitwarden/core/blob/master/README.md SQL Server 2017, really? Interesting choice. Open source but we have to pay licenses for the database if we want to self host. I wonder what was wrong with PostgreSQL or MySQL even if they're using .NET Core as a language. Edit: there is an issue for that https://github.com/bitwarden/core/issues/10 https://github.com/bitwarden/core/issues/10

some_account 8y ago
Ah shit, its a . NET program :( It all sounded really good until this point. I was even going to say you could add support for postgres, but I don't know a lot of open source devs who are using. NET.
- hottycat3 8y ago
  Keepass2 is also Open-Source and .Net because as far as I know .Net offers some extra security on Windows like locking the desktop while entering the master password.
  - vasili111 8y ago
    Can you please give me a link about locking desktop while entering a master password in KeePass? I want to know more about it.
    - graedus 8y ago
      https://keepass.info/help/kb/sec_desk.html https://keepass.info/help/kb/sec_desk.html
syshum 8y ago
Pretty sure they were in the BizSpark program from Microsoft so that probably influenced alot of their technology choices
- 8y ago

xtf 8y ago

Seriously? A password manager where the desktop app is build ontop of unsecure electron.

Starz0r 8y ago
I get that Electron is undesirable, but what do you mean by unsecure? Also, can you list some alternatives if you don't want them building a desktop app in Electron?
- self_awareness 8y ago
  Malware can sweep through the memory to find passwords by reading memory directly from another process' address space.
  - smw 8y ago
    This is a risk in desktop software written in other languages and with other gui frameworks as well, no?

Mefis 8y ago

Any reason not to use Firefox's own password sync? It's been working fine for me so far.

czei002 8y ago

On problem with password managers (that are using web authentication to create/manage an account for backing up the password manager in the cloud) is that the authentication password can be leaked during the authentication process. For example, the storage provider for password manager backup can simply read the password from the authentication web page since this web page is hosted at the provider. This is problematic if the authentication password is also used to encrypt the password manager, i.e. the provider could decrypt the password manager with the authentication password. You would actually need two passwords; one for authentication and one for encryption. Unfortunately, you usually don't even have the option to choose two passwords. To solve this problem I'm working on FejoaAuth (https://fejoa.org/fejoapage/auth.html https://fejoa.org/fejoapage/auth.html). FejoaAuth uses an authentication protocol that does not leak the user password to the provider who is going to store the password manager. This protocol is run in a trusted browser plugin in order to ensure the correct execution of the protocol. Thus you can use a single password for authentication and password manager encryption.

geberl 8y ago

If you're searching for an open-source self-hosted alternative that offers corporate features like LDAP integration take a look at SysPass (https://github.com/nuxsmin/sysPass https://github.com/nuxsmin/sysPass). Doesn't look as nice as Bitwarden though.

amaccuish 8y ago

I like Enpass. Syncs to my own nextcloud. What other password managers can do that out of interest?

justtoast 8y ago
I also use Enpass. It needs more of a mention in these threads.
- npongratz 8y ago
  I suspect Enpass doesn't get much mention on HN threads because it is not (or at least, does not obviously appear to be) open source, which I've observed is of paramount interest to a large number of HN readers -- full disclosure: including me. Because it is not open source [0], we must take statements like the following purely on faith in their PR department, rather than being able to independently verify: https://www.enpass.io/kb/if-enpass-is-an-offline-password-manager-then-why-does-it-connects-to-internet-and-shows-network-activity/ https://www.enpass.io/kb/if-enpass-is-an-offline-password-ma... "Indeed Enpass is an offline password manager and saves your data locally on your device and in any case, we do not (and we can not) access any of your data. But yes, Enpass does connect to the internet with the sole purpose to give best user experience." I'm sure they're really nice people, and do their best, etc, etc, but passwords are the linchpin crown jewels. Enpass could secretly and instantaneously become bad actors or incompetent stewards of said crown jewels, and we wouldn't know, since we cannot see what they are doing. One of many risks I would not take. [0] Please correct me if my search-engine-fu is weak today, but I can find no official Enpass open source repos or code anywhere.
- anmipo 8y ago
  One fine day Enpass pulled the their app from BlackBerry users - no warnings, no refunds: https://www.enpass.io/blog/discontinuing-the-support-for-enpass-on-blackberry/ https://www.enpass.io/blog/discontinuing-the-support-for-enp... There are quite a few comments from paying customers, who were locked out of their data. According to timestamps, Enpass team successfully ignored these comments for months. Perhaps this should be mentioned whenever Enpass surfaces as an option...

solidrake 8y ago

I love the Linux app, and the integration on browser extensions and Android app, but the Android app is very limited on features. I love projects like this, and support them as a paid member, just like ProtonMail.

vasili111 8y ago

What are the advantages and disadvantages of Bitwarden over KeePassXC?

commanderkeen08 8y ago
A web UI and iOS app that supports Face ID and TOTP codes.

nickjj 8y ago

If anyone wants an open source command line driven password manager that doesn't require signing up or hosting anything, I recommend checking out "Pass". It piggy backs off GPG encryption. https://www.passwordstore.org/ https://www.passwordstore.org/ I use it to manage over 300 passwords and other sensitive blobs of text (it lets you save arbitrary text snippets) and also has some nifty quality of life features like auto-copying a password to your clipboard for 30 seconds when you want to access a specific password.

chme 8y ago
I like and use pass regulary, but it has some inconveniences. - It doesn't encrypt the paths to the passwords - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password - It doesn't work with (Update: X.509) smartcards/gpgsm - It's written in bash. That has pros and cons...
- phaer 8y ago
  > - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password only the first line of an encrypted file is considered to be the password. So you can just but your username or any other account-related information on the following lines. > - It doesn't encrypt the paths to the passwords To elaborate: One of the problems with this approach is that it may leak websites where you have accounts to people who gain access to your pass repo/directory even without gaining control of your gpg key. > - It doesn't work with smartcards/gpgsm What do you mean by that? I use pass with my yubikey as a gpg "smartcard"?
  - chme 8y ago
    >> - It doesn't use a structural language for the password files, so additional information like username has to be stored in the path of the password > only the first line of an encrypted file is considered to be the password. So you can just but your username or any other account-related information on the following lines. I didn't know that. But what I would have preferred was copying the username with one command and copying the password with another. >> - It doesn't work with smartcards/gpgsm > What do you mean by that? I use pass with my yubikey as a gpg "smartcard"? I haven't tried that with a yubi key, but with a corporate X.509 id card. And that needed gpgsm. I had to patch pass in order for it to work, because gpgsm uses different parameters that gpg.

tehabe 8y ago

What I really like about Bitwarden is, that you can define several URLs for one entry, I have some services which can be accessed from several addresses (same account) though. It is also possible to define how a URL is matched which is a nice feature too.

commanderkeen08 8y ago

Here’s why I switched from 1Password— I recently picked up a Pixelbook and have gone all in on ChromeOS. Its replaced my MBP. But unfortunately, that meant parting ways with 1Password. I needed a new password manager with the following: Self hosted TOTP support (have since decided not to use this) A web UI IOS app with face/Touch ID. I tried the 1Password subscription but 1Password X just felt too clunky and I wasn’t in love with storing on their server. Keepass/XC/whatever was a hot mess for me. I really wanted to use it and the idea of keeping and syncing a single db file still really appeals to me, but the ecosystem is such a mess. I tried running a self hosted container for Keepass Web but I kept having to enter a Dropbox API key on every client. I also couldn’t find an iOS app that supported Face ID or the option for storing TOTP. Maybe it’s a better experience on Android. On top of that, the UI was pretty jarring all around. Bitwarden still has some work in the UI department. The lack of keyboard shortcuts and a native app adds some resistance but it’s manageable for me.

untitled_bob 8y ago

1Password works great on iOS and macOS but it's not open source... and there's the subscription they try to impose... and their servers... So I was looking to replace it. Bitwarden could be the one in the near future as Keepass is a real pain on iOS and mac for a non-techie. The problem I still have with bitwarden is that the app won't work unless connected to the internet. If the connection is missing you can't add or edit anything, store on your device and sync later :-(

alexeymetz 8y ago

This is nice product, but server requirement completely eliminates it as a candidate instead of 1Password for me. I still can't find a better open-source solution which works completely offline on desktop, browsers and mobile devices with the possibility of synchronization using 3rd-party services, decent UI and at least the ability to store TOTP passwords. Enpass is good, but it's proprietary too.