6 ms·

For self-host - is it better than KeePass?

poglet 5y ago
I’ve been trying to switch from KeePass to Bitwarden so that my partner and I can share some passwords but KeePass just works, so it’s been hard to change over.
- Tajnymag 5y ago
  If I may ask, how do you share passwords when using KeePass?
  - lotsofpulp 5y ago
    I am not poglet, but I use Strongbox to manage Keepass databases in iOS and macOS and share it via iCloud Drive. I was using KeepassXC, but I liked the the TOTP backup/share with partner functionality and iOS strongbox app.
    - poglet 5y ago
      Thanks I will give this a go.
  - poglet 5y ago
    She just askes me to get the password for her. I have chosen to store some of her rarely used account passwords to save her from having to go through the password reset process every time she wants to access the accounts. I attempted to set her up with her own database but it's difficult to manage accounts that we both share in two separate databases.
  - dathinab 5y ago
    share the password database, do not add passwords at the same time in multiple places, always sync->add->sync. Most people do not add passwords often, so that works just fine. You also can have multiple database file, one for the common shared password which is always read only synced from a single source. And one for local passwords which are not yet, or should not, go into the shared database.
  - jillesvangurp 5y ago
    If you use Keeweb, you can put the database file on a shared drive and open it from there. I set that up for some shared passwords in our company with Google Drive.
Fnoord 5y ago
For self-host, use Vaultwarden [1] [1] https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden
- mkdirp 5y ago
  If you do self-host, please consider still buying premium from Bitwarden. It's only $10 per year. It's well worth the money and since you're still using the clients, which are still developed Bitwarden, it'll help towards keeping the product alive.
  - toyg 5y ago
    Considering it costs a fifth of 1Password, and has had an almost-fully-featured free option since early days, I suspect that Premium income is not their main source of funds. Maybe they got investment to survive while they built a business-friendly product. Maybe they consult for businesses running their own servers.
  - Fnoord 5y ago
    Agreed, I'm doing the same. I used the TOTP feature before I self-hosted.
- teekert 5y ago
  This works very well for me indeed, just add this to you docker-compose.yaml (includes Traefik configuration under labels, for https) and boom: bitwarden: container_name: bitwarden networks: - bitwarden image: vaultwarden/server:latest restart: always environment: SIGNUPS_ALLOWED: "false" # Set to true when making your accounts DOMAIN: "https://bw.domain.nl" WEBSOCKET_ENABLED: "true" # ADMIN_TOKEN: "SomeTokenForResetPurposes" volumes: - ./bw-data:/data labels: - traefik.enable=true - traefik.http.middlewares.redirect-https.redirectScheme.scheme=https - traefik.http.middlewares.redirect-https.redirectScheme.permanent=true - traefik.http.routers.bitwarden-ui-https.rule=Host(`bw.domain.nl`) - traefik.http.routers.bitwarden-ui-https.entrypoints=websecure - traefik.http.routers.bitwarden-ui-https.tls=true - traefik.http.routers.bitwarden-ui-https.service=bitwarden-ui - traefik.http.routers.bitwarden-ui-http.rule=Host(`bw.domain.nl`) - traefik.http.routers.bitwarden-ui-http.entrypoints=web - traefik.http.routers.bitwarden-ui-http.middlewares=redirect-https - traefik.http.routers.bitwarden-ui-http.service=bitwarden-ui - traefik.http.services.bitwarden-ui.loadbalancer.server.port=80 - traefik.http.routers.bitwarden-websocket-https.rule=Host(`bw.domain.nl`) && Path(`/notifications/hub`) - traefik.http.routers.bitwarden-websocket-https.entrypoints=websecure - traefik.http.routers.bitwarden-websocket-https.tls=true - traefik.http.routers.bitwarden-websocket-https.service=bitwarden-websocket - traefik.http.routers.bitwarden-websocket-http.rule=Host(`bw.domain.nl`) && Path(`/notifications/hub`) - traefik.http.routers.bitwarden-websocket-http.entrypoints=web - traefik.http.routers.bitwarden-websocket-http.middlewares=redirect-https - traefik.http.routers.bitwarden-websocket-http.service=bitwarden-websocket - traefik.http.services.bitwarden-websocket.loadbalancer.server.port=3012 - traefik.http.routers.bitwarden-ui-https.tls.certresolver=mytlschallenge
Oxodao 5y ago
Absolutely. Keepass gives you only a file that you have to sync by yourself and when you have multiple device editing the same file... Well... On the other hand, Bitwarden lets you self-host a complete server that handles everything. If you want something less resources intensive you can take a look at Vaultwarden which is a re-implementation of the server in Rust instead of C#. The main advantage is that it uses MySQL or Postgres instead of the heavy MS SQL Server.
- Liquid_Fire 5y ago
  > when you have multiple device editing the same file... Well... You are implying that this is a problem, but KeePass actually explicitly supports this and merges your changes. I've been using KeePass like this for many years and never had a problem editing the database from multiple devices.
- k8sToGo 5y ago
  It is funny, because to me "only a file you have to sync (and backup)" sounds more like an advantage than setting up an entire server environment just so you can access your passwords.
  - dathinab 5y ago
    I guess it depends if you sync you passwords across multiple devices, and also potentially add new passwords on multiple devices. I personally don't. Sure I have a password manager on my phone, but it only gets a small subset of my passwords anyway. Similar any password I add on my phone is very likely to be somewhat irrelevant mostly throwaway.
    - k8sToGo 5y ago
      I use Nextcloud to sync to my Android. On iOS it was more annoying.
  - Caligatio 5y ago
    If you're the sole user, it's probably not worth self-hosting {Bit,Vault}warden. However, the ability to share passwords and, optionally, TOTP codes is super helpful. My wife and I both used KeePass before and the combination of syncing the DB across devices and inability to share (a subset of) passwords was a killer. {Bit,Vault}warden} both now support emergency access which will be useful if it's ever needed
lazzurs 5y ago
I've found the multi device syncing easier and the integration with iOS works very well.
- teekert 5y ago
  This was my reason to go away from KeePass(XC) with NextCloud for sync. I would inevitably run into a sync issues (also due to the need for NextCloud to be always up of course, also self-hosted) and I never found a nice way to integrate KeePassXC into android or iOS, Bitwarden just works, on any OS (allthough what I find annoying is that you have to sync the vault before you get new stuff by going into the app and syncing, just using it does not update it, so frequently I find myself missing passwords on iOS and then I need to manual sync first). Oh, and there is an issues with using it in private tabs on FireFox which has existed since I started using it.
  - toyg 5y ago
    > you have to sync the vault before you get new stuff I had that problem on iOS, and it disappeared since I moved to Android. There is probably an issue in what they are (not) allowed to do in background on iOS.
  - jptech 5y ago
    > I would inevitably run into a sync issues Could it be that you weren't using it correctly? KeePass database files aren't supposed to remain open (for security of course) and it has quite a number of options to automatically close it after certain amount of time or when the window isn't focus, computer is locked, etc. This would trigger a sync with the (NC) server and assuming that all your clients follow the same usage pattern and close the DB after a small window of time, there shouldn't be any conflict. > NextCloud to be always up of course, also self-hosted You could use NextCloud's own hosting. But then Bitwarden's server needs to always be up too, and optionally self-hosted. > Bitwarden just works A low bar to recommend a password manager, don't you think so?
    - teekert 5y ago
Daedren 5y ago
Depends, self hosting the main project will require a Microsoft SQL Server instance amongst other things which ends up with a quite heavy endeavour. There's an alternative implementation of the server API called Vaultwarden that works nicely with all the frontends but is unofficial. If Keepass works for you, you're likely not gaining much from switching. They're both just password managers at heart.
- deutschepost 5y ago
  Vaultwarden is pretty nice. I had it set up in minutes and it works perfectly.
dnel 5y ago
It depends how you use it, if you dont need to synchronise the database between machines (much) then KeePass is likely the easiest solution and works very well, beyond that Vaultwarden makes it easy to maintain a single centralised database accessed from multiple systems
creshal 5y ago
It scratches different itches; Bitwarden (/Vaultwarden) is good if you need to sync lots of devices and users to the same database; KeePass is less overhead with 3 or fewer devices and a single user.

I’ve been trying to switch from KeePass to Bitwarden so that my partner and I can share some passwords but KeePass just works, so it’s been hard to change over.

Tajnymag 5y ago
If I may ask, how do you share passwords when using KeePass?
- lotsofpulp 5y ago
  I am not poglet, but I use Strongbox to manage Keepass databases in iOS and macOS and share it via iCloud Drive. I was using KeepassXC, but I liked the the TOTP backup/share with partner functionality and iOS strongbox app.
  - poglet 5y ago
    Thanks I will give this a go.
- poglet 5y ago
  She just askes me to get the password for her. I have chosen to store some of her rarely used account passwords to save her from having to go through the password reset process every time she wants to access the accounts. I attempted to set her up with her own database but it's difficult to manage accounts that we both share in two separate databases.
- dathinab 5y ago
  share the password database, do not add passwords at the same time in multiple places, always sync->add->sync. Most people do not add passwords often, so that works just fine. You also can have multiple database file, one for the common shared password which is always read only synced from a single source. And one for local passwords which are not yet, or should not, go into the shared database.
- jillesvangurp 5y ago
  If you use Keeweb, you can put the database file on a shared drive and open it from there. I set that up for some shared passwords in our company with Google Drive.

Fnoord 5y ago

For self-host, use Vaultwarden [1] [1] https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden

mkdirp 5y ago
If you do self-host, please consider still buying premium from Bitwarden. It's only $10 per year. It's well worth the money and since you're still using the clients, which are still developed Bitwarden, it'll help towards keeping the product alive.
- toyg 5y ago
  Considering it costs a fifth of 1Password, and has had an almost-fully-featured free option since early days, I suspect that Premium income is not their main source of funds. Maybe they got investment to survive while they built a business-friendly product. Maybe they consult for businesses running their own servers.
- Fnoord 5y ago
  Agreed, I'm doing the same. I used the TOTP feature before I self-hosted.
teekert 5y ago
This works very well for me indeed, just add this to you docker-compose.yaml (includes Traefik configuration under labels, for https) and boom: bitwarden: container_name: bitwarden networks: - bitwarden image: vaultwarden/server:latest restart: always environment: SIGNUPS_ALLOWED: "false" # Set to true when making your accounts DOMAIN: "https://bw.domain.nl" WEBSOCKET_ENABLED: "true" # ADMIN_TOKEN: "SomeTokenForResetPurposes" volumes: - ./bw-data:/data labels: - traefik.enable=true - traefik.http.middlewares.redirect-https.redirectScheme.scheme=https - traefik.http.middlewares.redirect-https.redirectScheme.permanent=true - traefik.http.routers.bitwarden-ui-https.rule=Host(`bw.domain.nl`) - traefik.http.routers.bitwarden-ui-https.entrypoints=websecure - traefik.http.routers.bitwarden-ui-https.tls=true - traefik.http.routers.bitwarden-ui-https.service=bitwarden-ui - traefik.http.routers.bitwarden-ui-http.rule=Host(`bw.domain.nl`) - traefik.http.routers.bitwarden-ui-http.entrypoints=web - traefik.http.routers.bitwarden-ui-http.middlewares=redirect-https - traefik.http.routers.bitwarden-ui-http.service=bitwarden-ui - traefik.http.services.bitwarden-ui.loadbalancer.server.port=80 - traefik.http.routers.bitwarden-websocket-https.rule=Host(`bw.domain.nl`) && Path(`/notifications/hub`) - traefik.http.routers.bitwarden-websocket-https.entrypoints=websecure - traefik.http.routers.bitwarden-websocket-https.tls=true - traefik.http.routers.bitwarden-websocket-https.service=bitwarden-websocket - traefik.http.routers.bitwarden-websocket-http.rule=Host(`bw.domain.nl`) && Path(`/notifications/hub`) - traefik.http.routers.bitwarden-websocket-http.entrypoints=web - traefik.http.routers.bitwarden-websocket-http.middlewares=redirect-https - traefik.http.routers.bitwarden-websocket-http.service=bitwarden-websocket - traefik.http.services.bitwarden-websocket.loadbalancer.server.port=3012 - traefik.http.routers.bitwarden-ui-https.tls.certresolver=mytlschallenge

Oxodao 5y ago

Absolutely. Keepass gives you only a file that you have to sync by yourself and when you have multiple device editing the same file... Well... On the other hand, Bitwarden lets you self-host a complete server that handles everything. If you want something less resources intensive you can take a look at Vaultwarden which is a re-implementation of the server in Rust instead of C#. The main advantage is that it uses MySQL or Postgres instead of the heavy MS SQL Server.

Liquid_Fire 5y ago
> when you have multiple device editing the same file... Well... You are implying that this is a problem, but KeePass actually explicitly supports this and merges your changes. I've been using KeePass like this for many years and never had a problem editing the database from multiple devices.
k8sToGo 5y ago
It is funny, because to me "only a file you have to sync (and backup)" sounds more like an advantage than setting up an entire server environment just so you can access your passwords.
- dathinab 5y ago
  I guess it depends if you sync you passwords across multiple devices, and also potentially add new passwords on multiple devices. I personally don't. Sure I have a password manager on my phone, but it only gets a small subset of my passwords anyway. Similar any password I add on my phone is very likely to be somewhat irrelevant mostly throwaway.
  - k8sToGo 5y ago
    I use Nextcloud to sync to my Android. On iOS it was more annoying.
- Caligatio 5y ago
  If you're the sole user, it's probably not worth self-hosting {Bit,Vault}warden. However, the ability to share passwords and, optionally, TOTP codes is super helpful. My wife and I both used KeePass before and the combination of syncing the DB across devices and inability to share (a subset of) passwords was a killer. {Bit,Vault}warden} both now support emergency access which will be useful if it's ever needed

lazzurs 5y ago

I've found the multi device syncing easier and the integration with iOS works very well.

teekert 5y ago
This was my reason to go away from KeePass(XC) with NextCloud for sync. I would inevitably run into a sync issues (also due to the need for NextCloud to be always up of course, also self-hosted) and I never found a nice way to integrate KeePassXC into android or iOS, Bitwarden just works, on any OS (allthough what I find annoying is that you have to sync the vault before you get new stuff by going into the app and syncing, just using it does not update it, so frequently I find myself missing passwords on iOS and then I need to manual sync first). Oh, and there is an issues with using it in private tabs on FireFox which has existed since I started using it.
- toyg 5y ago
  > you have to sync the vault before you get new stuff I had that problem on iOS, and it disappeared since I moved to Android. There is probably an issue in what they are (not) allowed to do in background on iOS.
- jptech 5y ago
  > I would inevitably run into a sync issues Could it be that you weren't using it correctly? KeePass database files aren't supposed to remain open (for security of course) and it has quite a number of options to automatically close it after certain amount of time or when the window isn't focus, computer is locked, etc. This would trigger a sync with the (NC) server and assuming that all your clients follow the same usage pattern and close the DB after a small window of time, there shouldn't be any conflict. > NextCloud to be always up of course, also self-hosted You could use NextCloud's own hosting. But then Bitwarden's server needs to always be up too, and optionally self-hosted. > Bitwarden just works A low bar to recommend a password manager, don't you think so?
  - teekert 5y ago

Daedren 5y ago

Depends, self hosting the main project will require a Microsoft SQL Server instance amongst other things which ends up with a quite heavy endeavour. There's an alternative implementation of the server API called Vaultwarden that works nicely with all the frontends but is unofficial. If Keepass works for you, you're likely not gaining much from switching. They're both just password managers at heart.

deutschepost 5y ago
Vaultwarden is pretty nice. I had it set up in minutes and it works perfectly.

dnel 5y ago

It depends how you use it, if you dont need to synchronise the database between machines (much) then KeePass is likely the easiest solution and works very well, beyond that Vaultwarden makes it easy to maintain a single centralised database accessed from multiple systems

creshal 5y ago

It scratches different itches; Bitwarden (/Vaultwarden) is good if you need to sync lots of devices and users to the same database; KeePass is less overhead with 3 or fewer devices and a single user.