10 ms·

I was just about to pay for my LastPass subscription (after years on being on free tier), given the recent price changes. This made me change my mind - why a pa

I was just about to pay for my LastPass subscription (after years on being on free tier), given the recent price changes. This made me change my mind - why a password manager, which I entrust with my personal passwords, notes and credit card info, needs to dial home to 7 different trackers is just beyond relief. I like LastPass because it works across my phone and multiple machines / browsers (I use Firefox). Can anyone please shed some light on good alternatives? I will happily pay for it.

buster 6y ago
KeepassXC plus some file sync tool works great for me across multiple devices (Android, Linux, Windows)
- hestefisk 6y ago
  iOS?
  - hanklazard 6y ago
    Last I checked, there were some third party iOS apps but the Bitwarden iOS app was far superior.
  - 40four 6y ago
    I have found KeePassium to be an excellent iOS KeePass client.
  - chewz 6y ago
    Strongbox is good on both iOS and macOS...
  - delogos 6y ago
    KyPass has been excellent for me for the last several years.
  - Fnoord 6y ago
    KeePass only officially works on Windows. All non-Windows versions are unofficial versions. See [1] for a list. [1] https://keepass.info/download.html https://keepass.info/download.html
    - aerique 6y ago
      There's also KeePassX and KeePassXC which have been working fine on Linux for years. - https://keepassxc.org/ https://keepassxc.org/ Not to mention mobile clients even on Sailfish OS.
  - Bud 6y ago
    1Password is by far the best on iOS, and it works on Mac, PC, Linux, and Android as well.
- Latty 6y ago
  I wouldn't recommend it for casual users as there are definitely things that are less polished about the way it works, but for power-users it is great. The SSH key integration is really good.
  - mFixman 6y ago
    Is it though? I keep my locked file mirrored in Google Drive and have an Android app to pull passwords. I really don't see how a casual user would find Keepass harder to use than LastPass. I don't understand how Keepass is not more popular other than marketing. If you have a file with all your passwords for everything you really want to keep a local copy that won't expire. The current status quo seems like a disaster waiting to happen on the day LastPass closes down.
    - aaronax 6y ago
      Sadly the simple act of choosing where to save a file, understanding where that is, and remembering that, is more than many people feel they should need to do. Signing in with an email address and guessing their own password (typically one of the three passwords they share across all of their online services) is the norm.
    - Latty 6y ago
      The way the browser integration works means it just sometimes doesn't pick up that the app is open. There is a ton of little polish stuff like that which makes it way harder to use for people with little tech experience, and I've had normal people struggle with more streamlined experiences like BitWarden.
1_player 6y ago
Bitwarden is great. I got work to buy an enterprise license, which also gives me a full license for personal use. Also, it's open source.
- Meph504 6y ago
  have you actually tried to use their support, it was a single guy, who wasn't helpful, when I asked for a different rep, he copped an attitude. I still use bitwarden for personal use, but I didn't find the product (2 years ago) to be really enterprise ready. [biggest issue, when you share, you aren't sharing, you transfer your password to a group, this password is then no longer backed up, if you make a personal backup.] The support issue was we had something go wrong with a group, and a dept. lost the passwords entered, but all the shares still pointed to it, so attempting to use it error'ed out.
jafingi 6y ago
1Password. Zero trackers.
- georgyo 6y ago
  Do you know that or are you assuming that?
  - npteljes 6y ago
    By the same Exodus service: https://reports.exodus-privacy.eu.org/en/reports/com.agilebits.onepassword/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.agilebi...
  - xoa 6y ago
    In addition to sibling poster, and while they've gone in an unfortunate cloud sub direction overall, it's still possible to buy an entirely standalone non-subscription normal license for 1Password and sync vaults via Dropbox, iCloud for those in the Apple ecosystem, a folder, or manually via WiFi. You can then use an application firewall or anything similar to monitor all network connections. At least from what I've seen 1Password makes only the expected connections needed for their own services for things like auto update checks, Watchtower (a typical local compromise check system with k-anonymity, their page here [0]), and sync. All of them can be disabled with no effect beyond the expected of those functions not happening. I do wish we lived in a world where things had gone a bit differently and LAN had gained more of a role in all this, and one could pay for and run their own 1Password server. Of course for that matter passwords and they exist now shouldn't exist at all, it should all be public keys. Password managers themselves are a form of collective madness and horrible path dependency. And in principle 1P could maybe do some form of exclusive first party tracking and simply give up on whomever didn't talk to them. But for now at the least they still have the option to avoid dependencies on them pretty well. ---- 0: https://support.1password.com/watchtower-privacy/ https://support.1password.com/watchtower-privacy/
blutack 6y ago
Bitwarden is open source (with $10/year for some extra nice-to-haves if you use their hosted cloud service) and better than LastPass for me personally in pretty much every respect. I switched approx 2 years ago after the LogMeIn acquisition and haven't regretted it.
- thejosh 6y ago
  Been hearing good things about bitwarden, just switched in about 2 minutes. As a password manager, Lastpass hasn't really improved with the times, infact it's been getting buggier and buggier with Chrome as times goes on.
- abarringer 6y ago
  It's bee a couple years but the web browser plugins for BitWarden were unreliable. Our power users made it work but our average office user complained non-stop and moved back to using notepad. Maybe BitWarden has improved since then but it was too immature to rollout to the average office user.
  - neogodless 6y ago
    I started using BitWarden during their rough phase and can agree it was a struggle. On the computer it is now flawless except for the very occasional web site that codes far enough out of standards that any normal heuristic cannot detect that there is a prompt for credentials being shown. On mobile, it is still a bit hit or miss. I'm on Android 10 (awaiting the OnePlus release of Oxygen OS 11 for my model) and the Firefox Add-on is really good, but there are still places where detection of logins isn't quite right. And in apps on Android, it's also hit or miss. Venmo, for example, required me to do a long press, hit the ellipsis and choose autofill. That's fine for a power user and generally a bit beyond what an average office user would find acceptable. Though I don't have comparison to alternatives - it may just be that these apps aren't "behaving" well with the Android autofill service, and you can't blame BitWarden for that. Recently, my spouse started using BitWarden on her computer, and she did almost all of the set up and migrating her passwords, and updating weak passwords (we paid the $10/year for the reports) without any help from me. She is above average knowledgeable with software, but having her ask me almost no questions made me think that the software for computer use is ready.
abdullahkhalids 6y ago
How does one realistically type in the master password on a phone keyboard [1]? A secure password would be like 20 characters long with a mix of alphanumeric and special characters. [1] Do these password managers even use their own keyboard, or rely on whatever insecure keyboard is installed on the mobile OS?
- ChrisRR 6y ago
  What's wrong with typing in 20 characters on a phone keyboard? My password is longer than that and I don't have an issue Alternatively you can use fingerprint unlock
  - abdullahkhalids 6y ago
    Because it takes a long time. On the rare occasion I log into something on my phone, it takes almost a minute to type in the random passwords that Keepassxc on my computer generates. Fingerprint authentication will work though.
    - NamTaf 6y ago
      Once you're logged in, just copy/paste the password? You only need to type out your master password manually. Am I misunderstanding the issue?
      - distances 6y ago
        On Android you should not copy/paste as all apps can read the clipboard. Use either a keyboard that comes with the password manager, or system auto-fill support that gets the values from the manager. Both modes are supported at least by Keepass2Android.
- Kaze404 6y ago
  You can use a fingerprint to authenticate on Android.
traceroute66 6y ago
How about cutting the cord on silly SaaS services like LastPass or Bitwarden ? Zetetic Codebook [1] is the way to go. Pros: • It has desktop clients • It has apps • It has secure encrypted sync • It has responsive dev team • No silly subscription model Cons: • It doesn't have a fancy web app (but do you need one ?) I've no affiliation apart from being a long term happy user. [1] https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/
- dastx 6y ago
  Personally I'd much rather use Bitwarden due to their fully open source nature, and possibility to self host if they ever go down the wrong path. In addition, there are open source alternatives that have all the features you mentioned (namely the Keepass/Keeweb family).
- windexh8er 6y ago
  I find a comment like: > ...silly SaaS services like LastPass or Bitwarden? ...rather off-putting considering Bitwarden is nothing like LastPass in execution. For starters you don't need to pay for Bitwarden and you can run your own backend for self-host. Some of us use our password managers with others and would like to share things. I'm happy to pay for this feature. So no, you're not required to leverage Bitwarden as SaaS like LastPass. They're not the same in that respect. I have no affiliation with Bitwarden other than being a customer who dropped LastPass after the acquisition years ago.
screamingninja 6y ago
> Can anyone please shed some light on good alternatives? I have been happily using Firefox's built-in password manager. Syncs seamlessly with Firefox Lockwise to provide complete integration with Android OS and presumably similar integration with iOS devices. https://www.mozilla.org/firefox/lockwise/ https://www.mozilla.org/firefox/lockwise/
- nantes 6y ago
  Same, I've been very happy with Lockwise, with only a couple of UI complaints here and there. However, to be clear, Lockwise also ships 2 trackers[0], although one of those appears to be an in-house telemetry tool[1]. [0] https://reports.exodus-privacy.eu.org/en/reports/mozilla.lockbox/latest/ https://reports.exodus-privacy.eu.org/en/reports/mozilla.loc... [1] https://github.com/mozilla-mobile/android-components/blob/master/components/service/glean/README.md https://github.com/mozilla-mobile/android-components/blob/ma...
- tchalla 6y ago
  I wish Lockwise was available on other browsers too. It really is a great app.
xdrosenheim 6y ago
Firefox's built-in password storage? Not sure how secure it is, and if you need your passwords in other apps, you can download their LockWise app.
- hestefisk 6y ago
  How well does it work on iOS?
  - lorenzhs 6y ago
    It integrates with the system password manager interface but it's sometimes a bit slow to start. I think the problem is that it updates the passwords every time it is opened instead of relying on cached copies. Other than that it works fine.
  - ayewo 6y ago
    It doesn't integrate well with iOS but if you are willing to use Firefox for iOS over Mobile Safari, it works pretty well.
    - magikaram 6y ago
      Firefox has been a great web browser for me, as the synced tabs over devices has been useful. And while Google still likely has some of my data, I've switched to DuckDuckGo and Firefox full time now.
c0nsumer 6y ago
I moved from LastPass to 1Password some time in early 2020 and never looked back. The browser add-in alone on 1Password is SO much faster that I feel it alone has saved me a bunch of time.
- rdudek 6y ago
  I did the same, however I wish 1password would keep my extension logged in instead of asking me to type up a convoluted password every time I open the browser.
  - davidwparker 6y ago
    You can update your settings for it to turn off locking (while using the browser, idle, or sleep). However, if you quit the browser completely you'll have to re-login.
pablooliva 6y ago
I moved to 1Password last month after LastPass sync got corrupted and the data would not populate my Firefox extension or my iOS app. 1Password has been an excellent replacement. I had a paid family account with LastPass previously. Some more back story. I tried to get help from LastPass when I noticed fields for saved accounts were blank or included strange characters. After 1 week of only getting an automated reply with how to clear your local cache (which did not work) and several more attempts from my side to get help without a response, I decided to cancel. I was locked out of my bank account until I realized that I could log into my web client directly on the LastPass website (stupid panicked me). This allowed me to easily export all my data and move to 1Password. Thanks LastPass.
bayindirh 6y ago
I use Codebook which uses opensource encryption libraries developed by them. Liking it so far.
XorNot 6y ago
I've been using Keepass for years now, combined with Keepass2Android on my phone. I recently (finally) got that setup working perfectly by setting up Syncthing between my phone and computers. Combined with an InputStick which emulates a keyboard to type a password from my phone into a computer it's plugged into, and I can efficiently get all my secrets around without involving anyone's cloud in an unencrypted capacity. EDIT: I will note I've never bothered having browser integration though.
- MeinBlutIstBlau 6y ago
  Be very careful with the keepass Syncthing combo. If you're not monitoring which one had changes, you could get it overwritten when you don't want it to.
  - XorNot 6y ago
    Controlled for! Keepass2Android prompts and merges if the file changes out underneath it. Regular keepass each machine uses its own file in send only mode, and synchronises to the main file which is in send-receive mode on save. I'm not strictly sure this is entirely necessary these days because Syncthing will do collision detection and make copies, and keepass will prompt to merge if the file changes as well.
tclancy 6y ago
1Password is a dream compared to my experience on LastPass.
Bud 6y ago
1Password is the best I've seen out of several alternatives. Works flawlessly on all devices, great syncing, great UI. Highly recommended, well worth its price. Easy enough to set up that I've helped a few relatives around age 80 to get it running.

buster 6y ago

KeepassXC plus some file sync tool works great for me across multiple devices (Android, Linux, Windows)

hestefisk 6y ago
iOS?
- hanklazard 6y ago
  Last I checked, there were some third party iOS apps but the Bitwarden iOS app was far superior.
- 40four 6y ago
  I have found KeePassium to be an excellent iOS KeePass client.
- chewz 6y ago
  Strongbox is good on both iOS and macOS...
- delogos 6y ago
  KyPass has been excellent for me for the last several years.
- Fnoord 6y ago
  KeePass only officially works on Windows. All non-Windows versions are unofficial versions. See [1] for a list. [1] https://keepass.info/download.html https://keepass.info/download.html
  - aerique 6y ago
    There's also KeePassX and KeePassXC which have been working fine on Linux for years. - https://keepassxc.org/ https://keepassxc.org/ Not to mention mobile clients even on Sailfish OS.
- Bud 6y ago
  1Password is by far the best on iOS, and it works on Mac, PC, Linux, and Android as well.
Latty 6y ago
I wouldn't recommend it for casual users as there are definitely things that are less polished about the way it works, but for power-users it is great. The SSH key integration is really good.
- mFixman 6y ago
  Is it though? I keep my locked file mirrored in Google Drive and have an Android app to pull passwords. I really don't see how a casual user would find Keepass harder to use than LastPass. I don't understand how Keepass is not more popular other than marketing. If you have a file with all your passwords for everything you really want to keep a local copy that won't expire. The current status quo seems like a disaster waiting to happen on the day LastPass closes down.
  - aaronax 6y ago
    Sadly the simple act of choosing where to save a file, understanding where that is, and remembering that, is more than many people feel they should need to do. Signing in with an email address and guessing their own password (typically one of the three passwords they share across all of their online services) is the norm.
  - Latty 6y ago
    The way the browser integration works means it just sometimes doesn't pick up that the app is open. There is a ton of little polish stuff like that which makes it way harder to use for people with little tech experience, and I've had normal people struggle with more streamlined experiences like BitWarden.

1_player 6y ago

Bitwarden is great. I got work to buy an enterprise license, which also gives me a full license for personal use. Also, it's open source.

Meph504 6y ago
have you actually tried to use their support, it was a single guy, who wasn't helpful, when I asked for a different rep, he copped an attitude. I still use bitwarden for personal use, but I didn't find the product (2 years ago) to be really enterprise ready. [biggest issue, when you share, you aren't sharing, you transfer your password to a group, this password is then no longer backed up, if you make a personal backup.] The support issue was we had something go wrong with a group, and a dept. lost the passwords entered, but all the shares still pointed to it, so attempting to use it error'ed out.

jafingi 6y ago

1Password. Zero trackers.

georgyo 6y ago
Do you know that or are you assuming that?
- npteljes 6y ago
  By the same Exodus service: https://reports.exodus-privacy.eu.org/en/reports/com.agilebits.onepassword/latest/ https://reports.exodus-privacy.eu.org/en/reports/com.agilebi...
- xoa 6y ago
  In addition to sibling poster, and while they've gone in an unfortunate cloud sub direction overall, it's still possible to buy an entirely standalone non-subscription normal license for 1Password and sync vaults via Dropbox, iCloud for those in the Apple ecosystem, a folder, or manually via WiFi. You can then use an application firewall or anything similar to monitor all network connections. At least from what I've seen 1Password makes only the expected connections needed for their own services for things like auto update checks, Watchtower (a typical local compromise check system with k-anonymity, their page here [0]), and sync. All of them can be disabled with no effect beyond the expected of those functions not happening. I do wish we lived in a world where things had gone a bit differently and LAN had gained more of a role in all this, and one could pay for and run their own 1Password server. Of course for that matter passwords and they exist now shouldn't exist at all, it should all be public keys. Password managers themselves are a form of collective madness and horrible path dependency. And in principle 1P could maybe do some form of exclusive first party tracking and simply give up on whomever didn't talk to them. But for now at the least they still have the option to avoid dependencies on them pretty well. ---- 0: https://support.1password.com/watchtower-privacy/ https://support.1password.com/watchtower-privacy/

blutack 6y ago

Bitwarden is open source (with $10/year for some extra nice-to-haves if you use their hosted cloud service) and better than LastPass for me personally in pretty much every respect. I switched approx 2 years ago after the LogMeIn acquisition and haven't regretted it.

thejosh 6y ago
Been hearing good things about bitwarden, just switched in about 2 minutes. As a password manager, Lastpass hasn't really improved with the times, infact it's been getting buggier and buggier with Chrome as times goes on.
abarringer 6y ago
It's bee a couple years but the web browser plugins for BitWarden were unreliable. Our power users made it work but our average office user complained non-stop and moved back to using notepad. Maybe BitWarden has improved since then but it was too immature to rollout to the average office user.
- neogodless 6y ago
  I started using BitWarden during their rough phase and can agree it was a struggle. On the computer it is now flawless except for the very occasional web site that codes far enough out of standards that any normal heuristic cannot detect that there is a prompt for credentials being shown. On mobile, it is still a bit hit or miss. I'm on Android 10 (awaiting the OnePlus release of Oxygen OS 11 for my model) and the Firefox Add-on is really good, but there are still places where detection of logins isn't quite right. And in apps on Android, it's also hit or miss. Venmo, for example, required me to do a long press, hit the ellipsis and choose autofill. That's fine for a power user and generally a bit beyond what an average office user would find acceptable. Though I don't have comparison to alternatives - it may just be that these apps aren't "behaving" well with the Android autofill service, and you can't blame BitWarden for that. Recently, my spouse started using BitWarden on her computer, and she did almost all of the set up and migrating her passwords, and updating weak passwords (we paid the $10/year for the reports) without any help from me. She is above average knowledgeable with software, but having her ask me almost no questions made me think that the software for computer use is ready.

abdullahkhalids 6y ago

How does one realistically type in the master password on a phone keyboard [1]? A secure password would be like 20 characters long with a mix of alphanumeric and special characters. [1] Do these password managers even use their own keyboard, or rely on whatever insecure keyboard is installed on the mobile OS?

ChrisRR 6y ago
What's wrong with typing in 20 characters on a phone keyboard? My password is longer than that and I don't have an issue Alternatively you can use fingerprint unlock
- abdullahkhalids 6y ago
  Because it takes a long time. On the rare occasion I log into something on my phone, it takes almost a minute to type in the random passwords that Keepassxc on my computer generates. Fingerprint authentication will work though.
  - NamTaf 6y ago
    Once you're logged in, just copy/paste the password? You only need to type out your master password manually. Am I misunderstanding the issue?
    - distances 6y ago
      On Android you should not copy/paste as all apps can read the clipboard. Use either a keyboard that comes with the password manager, or system auto-fill support that gets the values from the manager. Both modes are supported at least by Keepass2Android.
Kaze404 6y ago
You can use a fingerprint to authenticate on Android.

traceroute66 6y ago

How about cutting the cord on silly SaaS services like LastPass or Bitwarden ? Zetetic Codebook [1] is the way to go. Pros: • It has desktop clients • It has apps • It has secure encrypted sync • It has responsive dev team • No silly subscription model Cons: • It doesn't have a fancy web app (but do you need one ?) I've no affiliation apart from being a long term happy user. [1] https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/

dastx 6y ago
Personally I'd much rather use Bitwarden due to their fully open source nature, and possibility to self host if they ever go down the wrong path. In addition, there are open source alternatives that have all the features you mentioned (namely the Keepass/Keeweb family).
windexh8er 6y ago
I find a comment like: > ...silly SaaS services like LastPass or Bitwarden? ...rather off-putting considering Bitwarden is nothing like LastPass in execution. For starters you don't need to pay for Bitwarden and you can run your own backend for self-host. Some of us use our password managers with others and would like to share things. I'm happy to pay for this feature. So no, you're not required to leverage Bitwarden as SaaS like LastPass. They're not the same in that respect. I have no affiliation with Bitwarden other than being a customer who dropped LastPass after the acquisition years ago.

screamingninja 6y ago

> Can anyone please shed some light on good alternatives? I have been happily using Firefox's built-in password manager. Syncs seamlessly with Firefox Lockwise to provide complete integration with Android OS and presumably similar integration with iOS devices. https://www.mozilla.org/firefox/lockwise/ https://www.mozilla.org/firefox/lockwise/

nantes 6y ago
Same, I've been very happy with Lockwise, with only a couple of UI complaints here and there. However, to be clear, Lockwise also ships 2 trackers[0], although one of those appears to be an in-house telemetry tool[1]. [0] https://reports.exodus-privacy.eu.org/en/reports/mozilla.lockbox/latest/ https://reports.exodus-privacy.eu.org/en/reports/mozilla.loc... [1] https://github.com/mozilla-mobile/android-components/blob/master/components/service/glean/README.md https://github.com/mozilla-mobile/android-components/blob/ma...
tchalla 6y ago
I wish Lockwise was available on other browsers too. It really is a great app.

xdrosenheim 6y ago

Firefox's built-in password storage? Not sure how secure it is, and if you need your passwords in other apps, you can download their LockWise app.

hestefisk 6y ago
How well does it work on iOS?
- lorenzhs 6y ago
  It integrates with the system password manager interface but it's sometimes a bit slow to start. I think the problem is that it updates the passwords every time it is opened instead of relying on cached copies. Other than that it works fine.
- ayewo 6y ago
  It doesn't integrate well with iOS but if you are willing to use Firefox for iOS over Mobile Safari, it works pretty well.
  - magikaram 6y ago
    Firefox has been a great web browser for me, as the synced tabs over devices has been useful. And while Google still likely has some of my data, I've switched to DuckDuckGo and Firefox full time now.

c0nsumer 6y ago

I moved from LastPass to 1Password some time in early 2020 and never looked back. The browser add-in alone on 1Password is SO much faster that I feel it alone has saved me a bunch of time.

rdudek 6y ago
I did the same, however I wish 1password would keep my extension logged in instead of asking me to type up a convoluted password every time I open the browser.
- davidwparker 6y ago
  You can update your settings for it to turn off locking (while using the browser, idle, or sleep). However, if you quit the browser completely you'll have to re-login.

pablooliva 6y ago

I moved to 1Password last month after LastPass sync got corrupted and the data would not populate my Firefox extension or my iOS app. 1Password has been an excellent replacement. I had a paid family account with LastPass previously. Some more back story. I tried to get help from LastPass when I noticed fields for saved accounts were blank or included strange characters. After 1 week of only getting an automated reply with how to clear your local cache (which did not work) and several more attempts from my side to get help without a response, I decided to cancel. I was locked out of my bank account until I realized that I could log into my web client directly on the LastPass website (stupid panicked me). This allowed me to easily export all my data and move to 1Password. Thanks LastPass.

bayindirh 6y ago

I use Codebook which uses opensource encryption libraries developed by them. Liking it so far.

XorNot 6y ago

I've been using Keepass for years now, combined with Keepass2Android on my phone. I recently (finally) got that setup working perfectly by setting up Syncthing between my phone and computers. Combined with an InputStick which emulates a keyboard to type a password from my phone into a computer it's plugged into, and I can efficiently get all my secrets around without involving anyone's cloud in an unencrypted capacity. EDIT: I will note I've never bothered having browser integration though.

MeinBlutIstBlau 6y ago
Be very careful with the keepass Syncthing combo. If you're not monitoring which one had changes, you could get it overwritten when you don't want it to.
- XorNot 6y ago
  Controlled for! Keepass2Android prompts and merges if the file changes out underneath it. Regular keepass each machine uses its own file in send only mode, and synchronises to the main file which is in send-receive mode on save. I'm not strictly sure this is entirely necessary these days because Syncthing will do collision detection and make copies, and keepass will prompt to merge if the file changes as well.

tclancy 6y ago

1Password is a dream compared to my experience on LastPass.

Bud 6y ago

1Password is the best I've seen out of several alternatives. Works flawlessly on all devices, great syncing, great UI. Highly recommended, well worth its price. Easy enough to set up that I've helped a few relatives around age 80 to get it running.