12 ms·

Bitwarden: Free, open-source password manager

409 points by gjvc 5y ago

amq 5y ago
I wish google would provide a basic password manager as part of their workspace. It's 2022 and passwords are more painful than ever. In an ideal world we would have SSO everywhere, but it's just not happening.
- toyg 5y ago
  They are slowly extending the Chrome password manager to be a more general-purpose password store, at least on Android. But tbh I think Google already knows my secrets more than they should, handing them all passwords would be a step too far for me.
- mkdirp 5y ago
  Google does, as part of Chrome. Iirc there is even a ui on your account. There is unfortunately no password sharing or anything like it.
traveler01 5y ago
Beeing user Bitwarden for some years. Switched from Android to iOS, switched browsers, never lost a single password. It's the best service around, I'm thinking about purchasing the premium even if I don't need the extra features only to contribute for the project.
sneak 5y ago
There are no good password managers. Bitwarden sucks, but sucks the least. Make sure you self-host using vaultwarden, the people at the Bitwarden company are clueless about security.
Kraftwurm 5y ago
I switched from LastPass (basically used it since their beginning) to Bitwarden about a year ago. Would never go back. So far have heard good things only about it and it is open source. Works like a charm for me.
neon_me 5y ago
Love Bitwarden, I personally onboarded dozen … but they must heavily invest in UI/UX and fix their apps (+ extensions) It’s not easy and intuitive for non-techies.
- skrebbel 5y ago
  I just switched to it from LastPass which, well, has even worse UX in my opinion. It's an extremely low bar to clear and I agree Bitwarden is quirky too, but for me it's still firmly been an upgrade. The only thing I miss is an "add to bitwarden?" dialog when I sign up somewhere. Their docs say it exists but I've never managed to get it to appear :-)
  - NoboruWataya 5y ago
    > The only thing I miss is an "add to bitwarden?" dialog when I sign up somewhere. Their docs say it exists but I've never managed to get it to appear :-) I have seen this occasionally but it is fairly random and unreliable. And then sometimes it pops up for stuff I clearly don't want to save, like OTP.
    - eitland 5y ago
      Works most of the time on my Firefox on Windows and Linux I think.
  - test1235 5y ago
    I just switched as well, and I was pleasantly surprised at how easy it was to do so. Like you said, it definitely feels nicer to use than lastpass.
  - jodator 5y ago
    Totally agree. LastPass has worse UX IMO. With bitwarden I never missed the "add to bitwarden" dialog. As a paying user. I love that they offer Android app. It has its moments like the integration with keyboard does not always work, but I can use it from the shot it's drawer. If you generate passwords (or passphrases!) they are stores 8n history, so there's always a backup :)
Barrin92 5y ago
probably my favorite open source project in years, together with Lichess. No idea why people still throw money at proprietary password managers.
- leokennis 5y ago
  Personally a happy user of 1Password. Reasons being: - "It just works" for me and my non-tech-family - It's only $50/year Maybe BitWarden is just as good or better. But why take the gamble and migrate everything and everyone, when I have multiple happy 1P users for a low yearly cost?
  - lazzurs 5y ago
    I have to use 1Password for some shared work stuff and I find Bitwarden comparable but I am happier with Bitwarden as it is open source and so central to my personal security.
  - schleck8 5y ago
    I wouldn't consider 4 $ per month a low cost for a password manager
    - leokennis 5y ago
      Of course it's all relative. $4 is infinitely more than $0. On the other hand, $4 for keeping my most important secrets safe is cheap.
      - frupert52 5y ago
        $4 is $4 more than $0
        dereg 5y ago
        I find the attitude of many folks on HN, arguably a forum full of logicians, baffling at times. I don't use 0 dollars to contextualize the cost of 1Password (or any productivity software). I value the time that I save with it. It saves me so much time, I don't mind paying $4, let alone $10. Not paying for something because it's not free is being penny wise, pound foolish.
imafish 5y ago
For self-host - is it better than KeePass?
- poglet 5y ago
  I’ve been trying to switch from KeePass to Bitwarden so that my partner and I can share some passwords but KeePass just works, so it’s been hard to change over.
  - Tajnymag 5y ago
    If I may ask, how do you share passwords when using KeePass?
    - lotsofpulp 5y ago
      I am not poglet, but I use Strongbox to manage Keepass databases in iOS and macOS and share it via iCloud Drive. I was using KeepassXC, but I liked the the TOTP backup/share with partner functionality and iOS strongbox app.
      - poglet 5y ago
        Thanks I will give this a go.
    - poglet 5y ago
      She just askes me to get the password for her. I have chosen to store some of her rarely used account passwords to save her from having to go through the password reset process every time she wants to access the accounts. I attempted to set her up with her own database but it's difficult to manage accounts that we both share in two separate databases.
    - dathinab 5y ago
      share the password database, do not add passwords at the same time in multiple places, always sync->add->sync. Most people do not add passwords often, so that works just fine. You also can have multiple database file, one for the common shared password which is always read only synced from a single source. And one for local passwords which are not yet, or should not, go into the shared database.
monkeydust 5y ago
I am probably in minority but been using Clipperz for near a decade.
JanSuly 5y ago
Happy to see people agree that Bitwarden is a great tool. Thanks to the Bitwarden-Team.
vgalin 5y ago
> The most trusted open source password manager for business I expected a blog article with actual feedbacks from companies and data, but ended up on bitwarden.com main page. Baseless claims can be quite common when it comes to marketing, but I'm genuinely curious: which password manager is used in your workplace, if any? I've personally never seen in my (for now short) career anything else than Keepass.
- oxfordmale 5y ago
  My company uses 1Password, in my previous company we used LastPass.
- aniforprez 5y ago
  Workplace uses 1Password. I've been using it personally for years and I love it. Completely worth the subscription cost though it has its quirks I like Bitwarden and the work they do and I'm sure they're trustworthy seeing as they've been audited and such but the android app and some of the UI is clunky to say the least. I tried switching from LastPass (which is awful) and ended up going to 1Password
  - chiefalchemist 5y ago
    I use BW at home and 1PW at work - both via browser extension. I cringe and/or swear at 1PW far more often than BW.
    - aniforprez 5y ago
      I've not found much reason to swear or cringe at 1Password... maybe ever. I was a bit frustrated once when it gave the wrong popup when filling out my addresses. What is your use case if you don't mind me asking?
      - zwirbl 5y ago
        1Password once "forgot" an autogenerated password for a government webservice, where I had to used a snailmailed one time password. I needed to get another OTP for registration. It never happened to me again, but having a wrong password stored was really annoying. I've switched to Bitwarden recently and, for the most part, am happier than before.
pythops 5y ago
Definitely the best ! I've been using it for a couple of years now, and I'm really happy with. I highly recommend it
timvisee 5y ago
Isn't $5 per month per user (enterprise) quite expensive for a glorified key-value store?
- deutschepost 5y ago
  Yes. But it is very easy to selfhost yourself (probably what you want in an enterprise setting).
- toyg 5y ago
  > a glorified key-value store? That's what LastPass is, which is why they were holed multiple times. Turns out it's quite hard to implement a secure key-value store.
- schoolornot 5y ago
  Yes, it is. Then again you'd be shocked at how much companies pay for SAAS apps today. I like to think you use FOSS when you're small b/c you can't afford the good stuff, then you get so big you want to switch back to FOSS b/c so many companies are taking you for a ride.
- edent 5y ago
  I agree. I look forward to you releasing a feature-complete competitor at $2.49.
eterps 5y ago
I love the autofill keyboard shortcut, a real productivity boost. To auto-fill login information, use the following default shortcuts. If there are multiple Login items with the detected URI, the last-used login will be used for the auto-fill operation. You can cycle through multiple Logins by repeatedly using the keyboard shortcut: On Windows: Ctrl + Shift + L On macOS: Cmd + Shift + L On Linux: Ctrl + Shift + L
- gefhfffh 5y ago
  Now make this work with desktop apps, please
  - derkades 5y ago
    KeePassXC does support autofill in desktop apps
gidorah 5y ago
We use a combination of passwords written down in notebooks and recycling easy passwords. Makes it nice and easy then!
- boobsbr 5y ago
  correct horse battery staple
Gatsky 5y ago
I see lots of people deriding LastPass... just wondering what exactly Bitwarden or 1Password do better? I find LastPass a bit clunky at times, and once or twice a year it won't actually save a password, but seems ok in general?
- NazakiAid 5y ago
  I switched to 1Password for LastPass mainly due to trust (due to LogMeIn), bad mobile app (always asking me to give it permissions it needs then forgetting, and more), no TOTP support, problems with extension and more that I thankfully cannot remember. Switching was a great decision.
- cube00 5y ago
  I left after they increased the premium price from $12 to $36 within a few years. I read a few comments from people that this was a classic LogMeIn move where they buy a service, hike the price and squeeze out everything they can before slowly letting the service die off. I'm happy to pay a reasonable price for services and bitwarden's $10 price (the old LastPass price) shows that's the reasonable price.
- hestefisk 5y ago
  Last year there were a few stories about how they embed trackers in their software. So I decided to go with a paid solution that will never spy on me (BW).
sgpl 5y ago
I've used Bitwarden for over 4 years now after first hearing about it on HN. I really can't complain. I have Bitwarden on my phone, on my browser (chrome + firefox) and it works flawlessly for me. I even have the Mac app but I almost never have to use it. I'd highly recommend it in case anyone here's looking to switch to Bitwarden. I've used LastPass previously, but that was so long ago that it'd hardly be a fair comparison to Bitwarden now - but I remember not being satisfied with LastPass enough to export my data and switch.
deleted 5y ago
[deleted]
EPmoL 5y ago
There’s a critical feature missing from Bitwarden that is keeping my on 1Password: - history It’s saved me enough times that I can’t move to a manager that doesn’t record history.
- flawi 5y ago
  Wait, you mean password history? As in being able to see the old password once you generate a new one or otherwise update it? Because Bitwarden definitely has that.
  - EPmoL 5y ago
    Spun up a Vaultwarden docker and gave it a try. You are correct, it does have password history. That's great. It was probably there the whole time and I didn't notice when I evaluated last. I see it doesn't have history anywhere else, such as secure notes, which 1password does have. Might still be too tough to give up the extra types and tags, but having history on the passwords is a great step. Quite tempting indeed.
- j_crick 5y ago
  Seems like they have some version of it implemented: > Q: I need an old password! Can I view the history of a password that I changed in Bitwarden? > A: Yes! You can view the last 5 passwords for any Login Item. Open the item in question and select the “1” next to Password History near the bottom of the window. https://bitwarden.com/help/article/product-faqs/ https://bitwarden.com/help/article/product-faqs/
  - EPmoL 5y ago
    Seems like only on passwords, but great that it does at least have it on passwords!
- Jamieee 5y ago
  Password history is a feature on Bitwarden. In the browser extension, at the bottom of the entry, you'll have something like: Updated: 18 May 2020, 16:22:44 Password updated: 18 May 2020, 16:22:44 Password history: 1
justsomehnguy 5y ago
Offtopic/Ask HN: I tried to use Vaultwarden implementation with one caveat: I don't need to use any plug-ins - my everyday passwords are at my fingertips anyway, for anything else I'm fine with logging in and copy-pasting the login and password. And here comes the thing which makes VW (and a couple of other password managers I tried in the last couple of years) usage abysmal: the web-interface just sucks. First of all - the process of adding a new login-password info requires too many clicks to set something more than just a login, password, (web-site) address. You want to add some tag? Click 'add', click 'type', click to the value field, type in. Want more than one tag? Repeat for each one. Okay, that would be tolerable if this was just once in a while task, but here comes the next one: Second and more important - awful search. VW just doesn't have the search functionality. It just loads ALL your accounts and filters them in the UI.. and sometimes even fails to do that. Like I see '$something' in the account description, type it in the 'search' field.. and have an empty result. For me personally the lack of useful search (including server-side search) makes the thing unusable. Are my requirements (sane web-gui, working search, usable without browser/apps addons) unreasonable?
- mqus 5y ago
  Afaik the Web-Interface of Vaultwarden is exactly the same as the normal bitwarden web client. The only thing they added was their admin interface, which you wouldn't normally see anyways. > It just loads ALL your accounts and filters them in the UI Server-side search would only work if you decrypt the data on the server, which is explicitly not wanted.
  - justsomehnguy 5y ago
    > Server-side search would only work if you decrypt the data on the server Or do not store it encrypted (aside from passwords) in the first place, or have a separate server-side encryption for non secrets, so it would be still encrypted at rest. It is all understandable, yet I don't have an option (except using almost a decade old RatticDB).
BrandoElFollito 5y ago
I use Biwarden extensively, in self-hosted mode (vaultwarden), for a few years now. It is truly excellent, especially the fact that you can "move" an entry to an organization, where everyone has the same ownership and rights (and not merely "share" it). Plus a ton of wonderful things. There are two minor points I am missing: - the ability to control someone's passwords. Typical usage: the 24/7/365 support for my parents, where I would like to be able to access their passwords (they also would like that, obviously). There would be a simple solution: the ability to force someone to file entries only in an organization. But it is not possible (and new entries will go to the personal vault by default). - the ability to discard the Android pop-up, sometimes it completely blocks the ability to manually fill in something. An "escape" kind of gesture.
- Samon 5y ago
  You can set an organisation policy to disable personal ownership, which forces every password to be saved into an org, unless the user is an org owner or administrator.
- vardagsnytt 5y ago
  Couldn't you revoke the permission for the android app to draw on your screen? But maybe I misinterpret your comment.
  - BrandoElFollito 5y ago
    The thing is that I still want BW to give me the possibility to choose a site to fill in (so I do need the popup). It is just that sometimes I need it out of the way, and there is no gesture for that (such as sliding it to the side for instance, or long pressing to make it go away)
    - gian21391 5y ago
      Are you referring to the popup created by the autofill service that is integrated in Android (https://developer.android.com/guide/topics/text/autofill https://developer.android.com/guide/topics/text/autofill)? In that case you can activate the inline autofill functionality (assuming that your keyboard supports that) so that no popup will show up.
canbus 5y ago
I swapped from Lastpass when they introduced the "single-device" restrictions for free users. Bitwarden has worked flawlessly since.
Philip-J-Fry 5y ago
I use Bitwarden, it's brilliant. But I wish a password manager would figure out a way to fill in passwords where they ask for 1st, 5th, 11th letters like many banks do. It doesn't need to be automated, if I can tell it which HTML element to read and parse as an index and which text elements to fill in, then that's good enough for me.
- domas 5y ago
  In Bitwarden you can achieve that by creating Custom Fields [1] for each letter. [1] https://bitwarden.com/help/article/custom-fields/ https://bitwarden.com/help/article/custom-fields/
  - Philip-J-Fry 5y ago
    No you can't? I'm aware you can point it at different fields and add additional information. But you can't make it fill in a password field that asks for 3 random characters.
Slippery_John 5y ago
Is there a good, real comparison of password managers for personal use out there somewhere? I've tried looking in the past and haven't found one that isn't just ads. I've been a long time LastPass user but I'm looking to switch away. Features I need: * Cross-platform (iOS, macOS, Windows) * Easy to use browser plugins (the LastPass safari plugin is awful and non-discoverable via Safari plugin search) * Autofill in browsers (Safari and Firefox) and mobile (iOS) * Internet-based sync (I don't really want to manage my own backend) Nice to haves: * Account creation detection * TOTP * Yubikey support * XKCD-style password generation for passwords I want a shot at remembering
- sparselogic 5y ago
  1Password checks all these boxes (including nice-to-haves). Longtime satisfied user here.
- petargyurov 5y ago
  BitWarden ticks all of the features you need. I am not sure about all the nice-to-haves you have listed but it definitely supports your last point.
- skinnymuch 5y ago
  I believe 1PW has everything including nice to haves. Not sure about yubikey though.
- u2077 5y ago
  KeypassXC & Strongbox on iOS. Keypass has browser extensions, strongbox has autofill on iOS. Use iCloud drive as a database (windows iCloud app needs to be setup) There are occasional sync issues but I recommend keeping a local backup on each device. The combination has all of the features you mentioned including xkcd password generation & Yubikey. Only downside is that the desktop extension requires the app to be open in the background. For that, I have the app minimize to system tray so it isn’t in the task bar. Strongbox settings menus are an absolute disaster to learn, but it has extensive customization. Make sure you only give the app 32mb of memory or autofill will crash.
ryanthedev 5y ago
My companies uses bitwarden. Not a fan. UI is clunky and requires too many clicks. I haven’t used any of the other password managers so I can’t give a good comparison.
polyterative 5y ago
it just works for free on my phone and PC. I like it
shp0ngle 5y ago
I frankly thing password managers are the most stupid thing. We fake users inputing text to input boxes and spend crazy time figuring out how to do that and how to get around various sites trying to block that, so the site can still pretend it’s actual user inputting the password. Plus the manager needs to work around arbitrary password rules. Plus they usually don’t work at OS level; so you still need to remember that stupid iTunes password, that stupid Windows password, that stupid Google password on Android login. Plus you still need random PINs in random banks and other systems. It’s better than memorizing, of course, and slightly better than writing it on paper somewhere (although that’s actually not that horrible honestly). It’s just, they feel like a patch-fix from 1990s to a problem from 1990s. I don’t want password manager. I wish I didn’t need password manager.
- phito 5y ago
  Password managers are the most stupid thing, really? What better alternative do you propose?
  - xtracto 5y ago
    One suitable option is to memorize an algorithm as a password: Say, given a site, create a password as: HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars So gmail.com would be something like Chad1Gmail5%9Foo@ And then use that algorithm for generating all passwords.
    - udia 5y ago
      This was my strategy for some time, but I switched to using a proper password manager (Bitwarden). If your algorithm is discovered you're in as much trouble as if you used the same password across multiple sites.
    - sumedh 5y ago
      > One suitable option is to memorize an algorithm as a password: You lost 99% of people here.
    - 5y ago
lazerl0rd 5y ago
Since everyone's asking for a good password manager for their use-case, I may as well so the same. Thanks in advance for any replies. I've been looking for an alternative to Enpass, which: 1) Supports using WebDAV as a backend (or an "app" exists for Nextcloud, if one exists). 2) Supports biometric authentication on Windows and Android. 3) Has a client which unlocks off the system keyring on Linux (Enpass doesn't do this). 4) Uses in-line autofill (through the Keyboard) on Android. Enpass said they'd add this month's back... but never did. 5) Has a not-ugly UI which at least partially matches GTK/Qt on Linux, Fluent on Windows, and MD2/Material You on Android. 6) Has Chrome and Firefox extensions that "take over" as Autofill like the Enpass extensions do (you can see it in Chrome Settings -> Autofill, if an extension does). I don't mind if it's paid, as long as it isn't relatively expensive (i.e. no more than Enpass because I got that on discount).
falcrist 5y ago
Is this an advertisement? It just links to the bitwarden website. Why is this even here?
- syspec 5y ago
  There's a post on the front page regarding 1Password raising 600M, so I imagine this is a counter post
bergercookie 5y ago
I'm confused. How is this post not violating hacker news terms of use, and in addition to that how has it attracted 176 points? Hacker news was about cool hacker or personal project. This is a company advertisement.
lvl100 5y ago
I’ve been using Bitwarden, LastPass and 1Password for the past few years. Of the three, Bitwarden gave me the least problems. LastPass is by far the worst. While 1Password is generally good about keeping up with its features, it is on the pricy side and UI is not great. I liked Bitwarden so much I asked them if I can pay for it several years in advance. No dice there. My recommendation is to pair Bitwarden with Yubikey.
- skinnymuch 5y ago
  Some one else said BW doesn’t always detect new logins. Is this not true? That comment doesn’t appear to have downvotes or people stating otherwise. Another few comments have said BW sometimes loses track of a pw or login. Maybe when created? Not sure. Is this stuff not true? I’m on a family plan for 1PW and it has been mostly flawless for me. However if that family plan ever breaks up, i would love to BW
  - lvl100 5y ago
    I personally never had those issues. You can certainly test drive Bitwarden for free. Importing from 1Password is rather straight forward.
perfectenschlag 5y ago
i love bitwarden, but the design is a little ugly. they need to improve this
FuriouslyAdrift 5y ago
We self host Bitwarden at work so I can distribute read only logins and passwords to vendors, lower level employees, etc.
Octabrain 5y ago
I’ve strongly considered to migrate from Keepassxc to Bitwarden for making things simpler. At the moment, the way I use Keepass is: password + only storing the db on Google Drive + adding the key file to any device I want to access from (smartphone and laptop) via usb cable. This way I can keep the db up to date across devices while keeping it “safe” as the key file is not being shared across the network. So, as I said, I’ve considered Bitwarden for being open source and cheap and for simplicity but despite reading the implementation they do and knowing they have had successful audits the paranoid in my cannot stop thinking on the “what ifs”. I have all my life on Keepass: from access to the bank, to government taxes stuff, to the pi-hole web ui etc etc. I feel I have more control now with my clunky approach. If I migrate to a managed solution and for any reason my data gets compromised on their side I would be utterly fucked. Probably it’s just me being irrational.
- walton_simons 5y ago
  For what little it's worth from a random internet person, I agree with you 100%. I do it the same way as you, with the database stored on Dropbox, and an offline key file. I just can't make myself trust an online service for this stuff, as irrational as that may be. Even if KeePass turned out to have some expoloitable vulnerabilities, it's still running solely on my machine, and I don't allow it to connect to the internet at all. I suppose yes, if someone breaks into my computer I could be in trouble, but if they can do that, they can just steal my session cookies anyway, password manager or not.
- fitblipper 5y ago
  I use keepass. I've solved the cross device problem by using syncthing. It is amazingly convenient and hasn't given me any problems across 3 computers and 3 phones. The only thing is, if you sit with your pw db open for extended period of time, you may need to sync it from storage in order to pick up changes that a different device has made recently.
iamricks 5y ago
We use Dashlane at work and its probably the worst software i have ever used. I have no idea what they do with their funding but it doesn't seem like it gets spent in making the app function correctly.
xcambar 5y ago
I'm surprised there's no mention of Hashicorp Vault. Maybe a misunderstanding on my side on why they differ. Can someone care enough to explain this to me?
- munchbunny 5y ago
  HashiCorp Vault solves a different problem. Password managers target the end user password management problem, whereas HashiCorp Vault targets the bootstrapping problem for servers/services.
  - xcambar 5y ago
    I thought Vault covered both use cases. Thanks!
antihero 5y ago
This looks lovely, I'm pretty happy with 1Password, are there any compelling reasons to take the effort to switch?
- dimitrisnl 5y ago
  I don't see any. 1Password saves me time, has no issues (for me), and any migration process is just a time-sink.
- themeiguoren 5y ago
  Bitwarden is free, 1password for yourself costs $36/yr. That was my reason for using it - I try to avoid subscriptions like the plague.
jdlyga 5y ago
Here's hoping that Bitwarden stays on the same course for the foreseeable future. I've seen plenty of excellent product like this fall victim to monetizing everything like CCleaner.
Justsignedup 5y ago
Tries everything. Still pay for 1password. That tool is fantastic.
tiepoul 5y ago
I always use Bitwarden as my password manager, it didn't let me down.
akoster 5y ago
Though it looks and sounds good, how would security be impacted by using the google chrome-based electron runtime to run the desktop client’s TypeScript and CLI runtime to run the server’s C# code? Wouldn’t this increase potential attack surface and probability of introducing vulnerabilities through more complexity (though this could be said for writing more of the stack oneself)? Im thinking about pass (https://www.passwordstore.org/ https://www.passwordstore.org/) and KeePass 1.x (https://keepass.info https://keepass.info) for comparison.
rad_gruchalski 5y ago
I’m a paying client and I love it. Works on every device, zero hassle.
manishsharan 5y ago
I moved from LastPass when it turned on its subscribers. I tried Keepass..loved it's offline model but it was not a smooth experience. Then I tried Bitwarden.. found it useful and user-friendly and I ended up buying subscription for my entire family.
qwertyuiop_ 5y ago
Bitwarden for simplicity
AtNightWeCode 5y ago
I use several password managers for various reasons, but I like Bitwarden. I use it both for work and privately. I think it is a bit unclear how Bitwarden the company is setup. That is the only thing that bothers me. Passwords are often not “real” secrets, so it does not matter that much. Generally, I would really like a hardware password manager. Maybe in a chip that you can have in your body. With some MFA so no one can use it when you are dead or passed out.

409 points by gjvc 5y ago

amq 5y ago

I wish google would provide a basic password manager as part of their workspace. It's 2022 and passwords are more painful than ever. In an ideal world we would have SSO everywhere, but it's just not happening.

toyg 5y ago
They are slowly extending the Chrome password manager to be a more general-purpose password store, at least on Android. But tbh I think Google already knows my secrets more than they should, handing them all passwords would be a step too far for me.
mkdirp 5y ago
Google does, as part of Chrome. Iirc there is even a ui on your account. There is unfortunately no password sharing or anything like it.

traveler01 5y ago

Beeing user Bitwarden for some years. Switched from Android to iOS, switched browsers, never lost a single password. It's the best service around, I'm thinking about purchasing the premium even if I don't need the extra features only to contribute for the project.

sneak 5y ago

There are no good password managers. Bitwarden sucks, but sucks the least. Make sure you self-host using vaultwarden, the people at the Bitwarden company are clueless about security.

Kraftwurm 5y ago

I switched from LastPass (basically used it since their beginning) to Bitwarden about a year ago. Would never go back. So far have heard good things only about it and it is open source. Works like a charm for me.

neon_me 5y ago

Love Bitwarden, I personally onboarded dozen … but they must heavily invest in UI/UX and fix their apps (+ extensions) It’s not easy and intuitive for non-techies.

skrebbel 5y ago
I just switched to it from LastPass which, well, has even worse UX in my opinion. It's an extremely low bar to clear and I agree Bitwarden is quirky too, but for me it's still firmly been an upgrade. The only thing I miss is an "add to bitwarden?" dialog when I sign up somewhere. Their docs say it exists but I've never managed to get it to appear :-)
- NoboruWataya 5y ago
  > The only thing I miss is an "add to bitwarden?" dialog when I sign up somewhere. Their docs say it exists but I've never managed to get it to appear :-) I have seen this occasionally but it is fairly random and unreliable. And then sometimes it pops up for stuff I clearly don't want to save, like OTP.
  - eitland 5y ago
    Works most of the time on my Firefox on Windows and Linux I think.
- test1235 5y ago
  I just switched as well, and I was pleasantly surprised at how easy it was to do so. Like you said, it definitely feels nicer to use than lastpass.
- jodator 5y ago
  Totally agree. LastPass has worse UX IMO. With bitwarden I never missed the "add to bitwarden" dialog. As a paying user. I love that they offer Android app. It has its moments like the integration with keyboard does not always work, but I can use it from the shot it's drawer. If you generate passwords (or passphrases!) they are stores 8n history, so there's always a backup :)

Barrin92 5y ago

probably my favorite open source project in years, together with Lichess. No idea why people still throw money at proprietary password managers.

leokennis 5y ago
Personally a happy user of 1Password. Reasons being: - "It just works" for me and my non-tech-family - It's only $50/year Maybe BitWarden is just as good or better. But why take the gamble and migrate everything and everyone, when I have multiple happy 1P users for a low yearly cost?
- lazzurs 5y ago
  I have to use 1Password for some shared work stuff and I find Bitwarden comparable but I am happier with Bitwarden as it is open source and so central to my personal security.
- schleck8 5y ago
  I wouldn't consider 4 $ per month a low cost for a password manager
  - leokennis 5y ago
    Of course it's all relative. $4 is infinitely more than $0. On the other hand, $4 for keeping my most important secrets safe is cheap.
    - frupert52 5y ago
      $4 is $4 more than $0
      - dereg 5y ago
        I find the attitude of many folks on HN, arguably a forum full of logicians, baffling at times. I don't use 0 dollars to contextualize the cost of 1Password (or any productivity software). I value the time that I save with it. It saves me so much time, I don't mind paying $4, let alone $10. Not paying for something because it's not free is being penny wise, pound foolish.

imafish 5y ago

For self-host - is it better than KeePass?

poglet 5y ago
I’ve been trying to switch from KeePass to Bitwarden so that my partner and I can share some passwords but KeePass just works, so it’s been hard to change over.
- Tajnymag 5y ago
  If I may ask, how do you share passwords when using KeePass?
  - lotsofpulp 5y ago
    I am not poglet, but I use Strongbox to manage Keepass databases in iOS and macOS and share it via iCloud Drive. I was using KeepassXC, but I liked the the TOTP backup/share with partner functionality and iOS strongbox app.
    - poglet 5y ago
      Thanks I will give this a go.
  - poglet 5y ago
    She just askes me to get the password for her. I have chosen to store some of her rarely used account passwords to save her from having to go through the password reset process every time she wants to access the accounts. I attempted to set her up with her own database but it's difficult to manage accounts that we both share in two separate databases.
  - dathinab 5y ago
    share the password database, do not add passwords at the same time in multiple places, always sync->add->sync. Most people do not add passwords often, so that works just fine. You also can have multiple database file, one for the common shared password which is always read only synced from a single source. And one for local passwords which are not yet, or should not, go into the shared database.

monkeydust 5y ago

I am probably in minority but been using Clipperz for near a decade.

JanSuly 5y ago

Happy to see people agree that Bitwarden is a great tool. Thanks to the Bitwarden-Team.

vgalin 5y ago

> The most trusted open source password manager for business I expected a blog article with actual feedbacks from companies and data, but ended up on bitwarden.com main page. Baseless claims can be quite common when it comes to marketing, but I'm genuinely curious: which password manager is used in your workplace, if any? I've personally never seen in my (for now short) career anything else than Keepass.

oxfordmale 5y ago
My company uses 1Password, in my previous company we used LastPass.
aniforprez 5y ago
Workplace uses 1Password. I've been using it personally for years and I love it. Completely worth the subscription cost though it has its quirks I like Bitwarden and the work they do and I'm sure they're trustworthy seeing as they've been audited and such but the android app and some of the UI is clunky to say the least. I tried switching from LastPass (which is awful) and ended up going to 1Password
- chiefalchemist 5y ago
  I use BW at home and 1PW at work - both via browser extension. I cringe and/or swear at 1PW far more often than BW.
  - aniforprez 5y ago
    I've not found much reason to swear or cringe at 1Password... maybe ever. I was a bit frustrated once when it gave the wrong popup when filling out my addresses. What is your use case if you don't mind me asking?
    - zwirbl 5y ago
      1Password once "forgot" an autogenerated password for a government webservice, where I had to used a snailmailed one time password. I needed to get another OTP for registration. It never happened to me again, but having a wrong password stored was really annoying. I've switched to Bitwarden recently and, for the most part, am happier than before.

pythops 5y ago

Definitely the best ! I've been using it for a couple of years now, and I'm really happy with. I highly recommend it

timvisee 5y ago

Isn't $5 per month per user (enterprise) quite expensive for a glorified key-value store?

deutschepost 5y ago
Yes. But it is very easy to selfhost yourself (probably what you want in an enterprise setting).
toyg 5y ago
> a glorified key-value store? That's what LastPass is, which is why they were holed multiple times. Turns out it's quite hard to implement a secure key-value store.
schoolornot 5y ago
Yes, it is. Then again you'd be shocked at how much companies pay for SAAS apps today. I like to think you use FOSS when you're small b/c you can't afford the good stuff, then you get so big you want to switch back to FOSS b/c so many companies are taking you for a ride.
edent 5y ago
I agree. I look forward to you releasing a feature-complete competitor at $2.49.

eterps 5y ago

I love the autofill keyboard shortcut, a real productivity boost. To auto-fill login information, use the following default shortcuts. If there are multiple Login items with the detected URI, the last-used login will be used for the auto-fill operation. You can cycle through multiple Logins by repeatedly using the keyboard shortcut: On Windows: Ctrl + Shift + L On macOS: Cmd + Shift + L On Linux: Ctrl + Shift + L

gefhfffh 5y ago
Now make this work with desktop apps, please
- derkades 5y ago
  KeePassXC does support autofill in desktop apps

gidorah 5y ago

We use a combination of passwords written down in notebooks and recycling easy passwords. Makes it nice and easy then!

boobsbr 5y ago
correct horse battery staple

Gatsky 5y ago

I see lots of people deriding LastPass... just wondering what exactly Bitwarden or 1Password do better? I find LastPass a bit clunky at times, and once or twice a year it won't actually save a password, but seems ok in general?

NazakiAid 5y ago
I switched to 1Password for LastPass mainly due to trust (due to LogMeIn), bad mobile app (always asking me to give it permissions it needs then forgetting, and more), no TOTP support, problems with extension and more that I thankfully cannot remember. Switching was a great decision.
cube00 5y ago
I left after they increased the premium price from $12 to $36 within a few years. I read a few comments from people that this was a classic LogMeIn move where they buy a service, hike the price and squeeze out everything they can before slowly letting the service die off. I'm happy to pay a reasonable price for services and bitwarden's $10 price (the old LastPass price) shows that's the reasonable price.
hestefisk 5y ago
Last year there were a few stories about how they embed trackers in their software. So I decided to go with a paid solution that will never spy on me (BW).

sgpl 5y ago

I've used Bitwarden for over 4 years now after first hearing about it on HN. I really can't complain. I have Bitwarden on my phone, on my browser (chrome + firefox) and it works flawlessly for me. I even have the Mac app but I almost never have to use it. I'd highly recommend it in case anyone here's looking to switch to Bitwarden. I've used LastPass previously, but that was so long ago that it'd hardly be a fair comparison to Bitwarden now - but I remember not being satisfied with LastPass enough to export my data and switch.

deleted 5y ago

[deleted]

EPmoL 5y ago

There’s a critical feature missing from Bitwarden that is keeping my on 1Password: - history It’s saved me enough times that I can’t move to a manager that doesn’t record history.

flawi 5y ago
Wait, you mean password history? As in being able to see the old password once you generate a new one or otherwise update it? Because Bitwarden definitely has that.
- EPmoL 5y ago
  Spun up a Vaultwarden docker and gave it a try. You are correct, it does have password history. That's great. It was probably there the whole time and I didn't notice when I evaluated last. I see it doesn't have history anywhere else, such as secure notes, which 1password does have. Might still be too tough to give up the extra types and tags, but having history on the passwords is a great step. Quite tempting indeed.
j_crick 5y ago
Seems like they have some version of it implemented: > Q: I need an old password! Can I view the history of a password that I changed in Bitwarden? > A: Yes! You can view the last 5 passwords for any Login Item. Open the item in question and select the “1” next to Password History near the bottom of the window. https://bitwarden.com/help/article/product-faqs/ https://bitwarden.com/help/article/product-faqs/
- EPmoL 5y ago
  Seems like only on passwords, but great that it does at least have it on passwords!
Jamieee 5y ago
Password history is a feature on Bitwarden. In the browser extension, at the bottom of the entry, you'll have something like: Updated: 18 May 2020, 16:22:44 Password updated: 18 May 2020, 16:22:44 Password history: 1

justsomehnguy 5y ago

Offtopic/Ask HN: I tried to use Vaultwarden implementation with one caveat: I don't need to use any plug-ins - my everyday passwords are at my fingertips anyway, for anything else I'm fine with logging in and copy-pasting the login and password. And here comes the thing which makes VW (and a couple of other password managers I tried in the last couple of years) usage abysmal: the web-interface just sucks. First of all - the process of adding a new login-password info requires too many clicks to set something more than just a login, password, (web-site) address. You want to add some tag? Click 'add', click 'type', click to the value field, type in. Want more than one tag? Repeat for each one. Okay, that would be tolerable if this was just once in a while task, but here comes the next one: Second and more important - awful search. VW just doesn't have the search functionality. It just loads ALL your accounts and filters them in the UI.. and sometimes even fails to do that. Like I see '$something' in the account description, type it in the 'search' field.. and have an empty result. For me personally the lack of useful search (including server-side search) makes the thing unusable. Are my requirements (sane web-gui, working search, usable without browser/apps addons) unreasonable?

mqus 5y ago
Afaik the Web-Interface of Vaultwarden is exactly the same as the normal bitwarden web client. The only thing they added was their admin interface, which you wouldn't normally see anyways. > It just loads ALL your accounts and filters them in the UI Server-side search would only work if you decrypt the data on the server, which is explicitly not wanted.
- justsomehnguy 5y ago
  > Server-side search would only work if you decrypt the data on the server Or do not store it encrypted (aside from passwords) in the first place, or have a separate server-side encryption for non secrets, so it would be still encrypted at rest. It is all understandable, yet I don't have an option (except using almost a decade old RatticDB).

BrandoElFollito 5y ago

I use Biwarden extensively, in self-hosted mode (vaultwarden), for a few years now. It is truly excellent, especially the fact that you can "move" an entry to an organization, where everyone has the same ownership and rights (and not merely "share" it). Plus a ton of wonderful things. There are two minor points I am missing: - the ability to control someone's passwords. Typical usage: the 24/7/365 support for my parents, where I would like to be able to access their passwords (they also would like that, obviously). There would be a simple solution: the ability to force someone to file entries only in an organization. But it is not possible (and new entries will go to the personal vault by default). - the ability to discard the Android pop-up, sometimes it completely blocks the ability to manually fill in something. An "escape" kind of gesture.

Samon 5y ago
You can set an organisation policy to disable personal ownership, which forces every password to be saved into an org, unless the user is an org owner or administrator.
vardagsnytt 5y ago
Couldn't you revoke the permission for the android app to draw on your screen? But maybe I misinterpret your comment.
- BrandoElFollito 5y ago
  The thing is that I still want BW to give me the possibility to choose a site to fill in (so I do need the popup). It is just that sometimes I need it out of the way, and there is no gesture for that (such as sliding it to the side for instance, or long pressing to make it go away)
  - gian21391 5y ago
    Are you referring to the popup created by the autofill service that is integrated in Android (https://developer.android.com/guide/topics/text/autofill https://developer.android.com/guide/topics/text/autofill)? In that case you can activate the inline autofill functionality (assuming that your keyboard supports that) so that no popup will show up.

canbus 5y ago

I swapped from Lastpass when they introduced the "single-device" restrictions for free users. Bitwarden has worked flawlessly since.

Philip-J-Fry 5y ago

I use Bitwarden, it's brilliant. But I wish a password manager would figure out a way to fill in passwords where they ask for 1st, 5th, 11th letters like many banks do. It doesn't need to be automated, if I can tell it which HTML element to read and parse as an index and which text elements to fill in, then that's good enough for me.

domas 5y ago
In Bitwarden you can achieve that by creating Custom Fields [1] for each letter. [1] https://bitwarden.com/help/article/custom-fields/ https://bitwarden.com/help/article/custom-fields/
- Philip-J-Fry 5y ago
  No you can't? I'm aware you can point it at different fields and add additional information. But you can't make it fill in a password field that asks for 3 random characters.

Slippery_John 5y ago

Is there a good, real comparison of password managers for personal use out there somewhere? I've tried looking in the past and haven't found one that isn't just ads. I've been a long time LastPass user but I'm looking to switch away. Features I need: * Cross-platform (iOS, macOS, Windows) * Easy to use browser plugins (the LastPass safari plugin is awful and non-discoverable via Safari plugin search) * Autofill in browsers (Safari and Firefox) and mobile (iOS) * Internet-based sync (I don't really want to manage my own backend) Nice to haves: * Account creation detection * TOTP * Yubikey support * XKCD-style password generation for passwords I want a shot at remembering

sparselogic 5y ago
1Password checks all these boxes (including nice-to-haves). Longtime satisfied user here.
petargyurov 5y ago
BitWarden ticks all of the features you need. I am not sure about all the nice-to-haves you have listed but it definitely supports your last point.
skinnymuch 5y ago
I believe 1PW has everything including nice to haves. Not sure about yubikey though.
u2077 5y ago
KeypassXC & Strongbox on iOS. Keypass has browser extensions, strongbox has autofill on iOS. Use iCloud drive as a database (windows iCloud app needs to be setup) There are occasional sync issues but I recommend keeping a local backup on each device. The combination has all of the features you mentioned including xkcd password generation & Yubikey. Only downside is that the desktop extension requires the app to be open in the background. For that, I have the app minimize to system tray so it isn’t in the task bar. Strongbox settings menus are an absolute disaster to learn, but it has extensive customization. Make sure you only give the app 32mb of memory or autofill will crash.

ryanthedev 5y ago

My companies uses bitwarden. Not a fan. UI is clunky and requires too many clicks. I haven’t used any of the other password managers so I can’t give a good comparison.

polyterative 5y ago

it just works for free on my phone and PC. I like it

shp0ngle 5y ago

I frankly thing password managers are the most stupid thing. We fake users inputing text to input boxes and spend crazy time figuring out how to do that and how to get around various sites trying to block that, so the site can still pretend it’s actual user inputting the password. Plus the manager needs to work around arbitrary password rules. Plus they usually don’t work at OS level; so you still need to remember that stupid iTunes password, that stupid Windows password, that stupid Google password on Android login. Plus you still need random PINs in random banks and other systems. It’s better than memorizing, of course, and slightly better than writing it on paper somewhere (although that’s actually not that horrible honestly). It’s just, they feel like a patch-fix from 1990s to a problem from 1990s. I don’t want password manager. I wish I didn’t need password manager.

phito 5y ago
Password managers are the most stupid thing, really? What better alternative do you propose?
- xtracto 5y ago
  One suitable option is to memorize an algorithm as a password: Say, given a site, create a password as: HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars So gmail.com would be something like Chad1Gmail5%9Foo@ And then use that algorithm for generating all passwords.
  - udia 5y ago
    This was my strategy for some time, but I switched to using a proper password manager (Bitwarden). If your algorithm is discovered you're in as much trouble as if you used the same password across multiple sites.
  - sumedh 5y ago
    > One suitable option is to memorize an algorithm as a password: You lost 99% of people here.
  - 5y ago

lazerl0rd 5y ago

Since everyone's asking for a good password manager for their use-case, I may as well so the same. Thanks in advance for any replies. I've been looking for an alternative to Enpass, which: 1) Supports using WebDAV as a backend (or an "app" exists for Nextcloud, if one exists). 2) Supports biometric authentication on Windows and Android. 3) Has a client which unlocks off the system keyring on Linux (Enpass doesn't do this). 4) Uses in-line autofill (through the Keyboard) on Android. Enpass said they'd add this month's back... but never did. 5) Has a not-ugly UI which at least partially matches GTK/Qt on Linux, Fluent on Windows, and MD2/Material You on Android. 6) Has Chrome and Firefox extensions that "take over" as Autofill like the Enpass extensions do (you can see it in Chrome Settings -> Autofill, if an extension does). I don't mind if it's paid, as long as it isn't relatively expensive (i.e. no more than Enpass because I got that on discount).

falcrist 5y ago

Is this an advertisement? It just links to the bitwarden website. Why is this even here?

syspec 5y ago
There's a post on the front page regarding 1Password raising 600M, so I imagine this is a counter post

bergercookie 5y ago

I'm confused. How is this post not violating hacker news terms of use, and in addition to that how has it attracted 176 points? Hacker news was about cool hacker or personal project. This is a company advertisement.

lvl100 5y ago

I’ve been using Bitwarden, LastPass and 1Password for the past few years. Of the three, Bitwarden gave me the least problems. LastPass is by far the worst. While 1Password is generally good about keeping up with its features, it is on the pricy side and UI is not great. I liked Bitwarden so much I asked them if I can pay for it several years in advance. No dice there. My recommendation is to pair Bitwarden with Yubikey.

skinnymuch 5y ago
Some one else said BW doesn’t always detect new logins. Is this not true? That comment doesn’t appear to have downvotes or people stating otherwise. Another few comments have said BW sometimes loses track of a pw or login. Maybe when created? Not sure. Is this stuff not true? I’m on a family plan for 1PW and it has been mostly flawless for me. However if that family plan ever breaks up, i would love to BW
- lvl100 5y ago
  I personally never had those issues. You can certainly test drive Bitwarden for free. Importing from 1Password is rather straight forward.

perfectenschlag 5y ago

i love bitwarden, but the design is a little ugly. they need to improve this

FuriouslyAdrift 5y ago

We self host Bitwarden at work so I can distribute read only logins and passwords to vendors, lower level employees, etc.

Octabrain 5y ago

I’ve strongly considered to migrate from Keepassxc to Bitwarden for making things simpler. At the moment, the way I use Keepass is: password + only storing the db on Google Drive + adding the key file to any device I want to access from (smartphone and laptop) via usb cable. This way I can keep the db up to date across devices while keeping it “safe” as the key file is not being shared across the network. So, as I said, I’ve considered Bitwarden for being open source and cheap and for simplicity but despite reading the implementation they do and knowing they have had successful audits the paranoid in my cannot stop thinking on the “what ifs”. I have all my life on Keepass: from access to the bank, to government taxes stuff, to the pi-hole web ui etc etc. I feel I have more control now with my clunky approach. If I migrate to a managed solution and for any reason my data gets compromised on their side I would be utterly fucked. Probably it’s just me being irrational.

walton_simons 5y ago
For what little it's worth from a random internet person, I agree with you 100%. I do it the same way as you, with the database stored on Dropbox, and an offline key file. I just can't make myself trust an online service for this stuff, as irrational as that may be. Even if KeePass turned out to have some expoloitable vulnerabilities, it's still running solely on my machine, and I don't allow it to connect to the internet at all. I suppose yes, if someone breaks into my computer I could be in trouble, but if they can do that, they can just steal my session cookies anyway, password manager or not.
fitblipper 5y ago
I use keepass. I've solved the cross device problem by using syncthing. It is amazingly convenient and hasn't given me any problems across 3 computers and 3 phones. The only thing is, if you sit with your pw db open for extended period of time, you may need to sync it from storage in order to pick up changes that a different device has made recently.

iamricks 5y ago

We use Dashlane at work and its probably the worst software i have ever used. I have no idea what they do with their funding but it doesn't seem like it gets spent in making the app function correctly.

xcambar 5y ago

I'm surprised there's no mention of Hashicorp Vault. Maybe a misunderstanding on my side on why they differ. Can someone care enough to explain this to me?

munchbunny 5y ago
HashiCorp Vault solves a different problem. Password managers target the end user password management problem, whereas HashiCorp Vault targets the bootstrapping problem for servers/services.
- xcambar 5y ago
  I thought Vault covered both use cases. Thanks!

antihero 5y ago

This looks lovely, I'm pretty happy with 1Password, are there any compelling reasons to take the effort to switch?

dimitrisnl 5y ago
I don't see any. 1Password saves me time, has no issues (for me), and any migration process is just a time-sink.
themeiguoren 5y ago
Bitwarden is free, 1password for yourself costs $36/yr. That was my reason for using it - I try to avoid subscriptions like the plague.

jdlyga 5y ago

Here's hoping that Bitwarden stays on the same course for the foreseeable future. I've seen plenty of excellent product like this fall victim to monetizing everything like CCleaner.

Justsignedup 5y ago

Tries everything. Still pay for 1password. That tool is fantastic.

tiepoul 5y ago

I always use Bitwarden as my password manager, it didn't let me down.

akoster 5y ago

Though it looks and sounds good, how would security be impacted by using the google chrome-based electron runtime to run the desktop client’s TypeScript and CLI runtime to run the server’s C# code? Wouldn’t this increase potential attack surface and probability of introducing vulnerabilities through more complexity (though this could be said for writing more of the stack oneself)? Im thinking about pass (https://www.passwordstore.org/ https://www.passwordstore.org/) and KeePass 1.x (https://keepass.info https://keepass.info) for comparison.

rad_gruchalski 5y ago

I’m a paying client and I love it. Works on every device, zero hassle.

manishsharan 5y ago

I moved from LastPass when it turned on its subscribers. I tried Keepass..loved it's offline model but it was not a smooth experience. Then I tried Bitwarden.. found it useful and user-friendly and I ended up buying subscription for my entire family.

qwertyuiop_ 5y ago

Bitwarden for simplicity

AtNightWeCode 5y ago

I use several password managers for various reasons, but I like Bitwarden. I use it both for work and privately. I think it is a bit unclear how Bitwarden the company is setup. That is the only thing that bothers me. Passwords are often not “real” secrets, so it does not matter that much. Generally, I would really like a hardware password manager. Maybe in a chip that you can have in your body. With some MFA so no one can use it when you are dead or passed out.