21 ms·

Bitwarden: Free, open-source password manager

455 points by punnerud 3y ago

nomercy400 3y ago
I am a KeepassXC user, yet this sounds interesting. What does Bitwarden offer to make me want to switch?
- KJBweb 3y ago
  better cross platform user interface integration
- harrytodorov 3y ago
  From what I can see, the major feature would be that it stores the password database on their premises and then lets you access it through multiple devices. Whereas in the case of KeepassXC, you have to have your own place where to store the password database and set it up on you different devices. So Bitwarden offers more convenience.
- b1476 3y ago
  For what it’s worth I was a longtime KeepassXC user. Switched to Bitwarden to have easier shared passwords between myself and partner/family however I’m now moving back to KeepassXC. I support Bitwarden fully however the app itself is just so badly designed. The UI is dreadful (both the website and desktop app) and I find it very frustrating to use. The whole layered concept of folders and inability to have tags is a nightmare when you have a large collection of passwords. The iOS app seems to quit unexpectedly after opening as well. I’m just very underwhelmed with what I was hoping would be a nice alternative to having to sync my Keepass database everywhere. On the KeepassXC side of things I’ve had zero issues with the app itself (using it on Linux, OSX and Windows) and I use Strongbox on iOS which is one of the very few apps I’m happy to pay for to support the developer, it’s so much more polished than Bitwarden.
  - caoilte 3y ago
    Keepassxc is great and works well with keepass2android via file sharing. I can imagine how the password sharing would be a problem tho.
- sebstefan 3y ago
  Vault synchronization between devices without needing to self-host anything, for free
- antioxidant 3y ago
  Nothing. Adding 2FA codes to logins costs money, and self-hosting is deliberately difficult so you’ll be using the cloud. Also you can’t edit while offline.
  - vincentkriek 3y ago
    Self hosting is incredibly easy with vaultwarden (https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden)
    - LinAGKar 3y ago
      That's a different implementation though
      - vincentkriek 3y ago
        A different implementation for the server though, not the clients. So, as a user you wouldn't see the difference. And as an admin it's much easier to maintain.
      - ghosty141 3y ago
        Theoretically yes but its comptible with the official cliente like the iOS app so it practically works the same.
  - r4indeer 3y ago
    > Adding 2FA codes to logins costs money If you don't want to pay $10/year for Premium, you can still host Vaultwarden instead and get the features for free. > self-hosting is deliberately difficult so you'll be using the cloud [citation needed] in my opinion. Yes, the current self-hosting method is rather complex, but still not that difficult to set up. Just follow their guide. They are even working on a new "unified" deployment method [1] where you can choose your own DB and all the Bitwarden containers are merged into one. The resulting docker-compose.yml looks as simple as any other service I self-host. Why would they do this if what you said were true? [1] https://bitwarden.com/help/install-and-deploy-unified-beta/ https://bitwarden.com/help/install-and-deploy-unified-beta/
- silversmith 3y ago
  Same boat. I'm also curious how does device sync happen with bitwarden - from a cursory glance it seems to rely on their cloud. Can you manually manage the database file, like with keepass?
  - Tmpod 3y ago
    You can use their cloud, but if you're technical you can also self-host a server instance. In that case, it's usually recommend to stay way from the complicated official implementation and instead pick vaultwarden, like another commenter said.
- Octabrain 3y ago
  I did the same for years: KeepassXC + Database being synced through Google Drive + keyfile stored only locally on each device (Linux personal laptop, Windows work laptop + Android personal phone) + Safe strong password that was only in my head. The main reason I decided to switch to Bitwarden it's because the Google drive client I used on Linux (GVFS in Gnome) gave me a few good headaches. Basically, everytime I made a modification to the database, it changed the name of the file, therefore, when opening the database later from another device, I had to be listing files by modification date to try to guess the most recent one and open it. Also, sometimes from Linux, I got errors from KeepassXC saying that the database was not writable, so I had to save it in a different location that wasn't the Google drive FS and then move it manually to it. Perhaps not a big deal for some people but after years of this I just got tired of shenanigans on something I consider too critical. The reasons for me for switching specifically to Bitwarden were: - Price. - Open source. - Multiplatform client. - Simple and straightforward to import stuff from KeepassXC. - MFA. - Possibility of self hosting. (Although I'm using the saas version for now)
- dsissitka 3y ago
  It's been a few months since I've used Bitwarden but I can think of a couple things: - Fewer people to trust. You have to be a little more careful with KeePass clients: https://news.ycombinator.com/item?id=36020196 https://news.ycombinator.com/item?id=36020196 - Templates. Bitwarden's implementation is pretty basic but the KeePass ecosystem is still sorting it out: https://github.com/keepassxreboot/keepassxc/issues/8228 https://github.com/keepassxreboot/keepassxc/issues/8228
- Phelinofist 3y ago
  I also use KeePassXC and commit my DB to git. On PCs I just clone the repo and am ready to go. On mobile I download the DB via a web interface. No fancy automatic sync, but my DB doesn't change that often, so the manual effort is still small.
- landmass 3y ago
  As a long-time user of KeePassXC, I switched because of the difficulty of syncing databases. Basically, I used the sneakernet and a thumb drive whenever I thought I needed to for five or six devices - it became wearing. At first after the change I kept the critical account - banks, email, and the like - solely on KeePassXC. As I began to trust Bitwarden I began to slowly add those accounts, too. Also, while I trust Bitwarden sync, I'm not quite as sure of the various apps that implement the KeePassXC on iOS. I'm still not aware that any have been audited, so to my mind Bitwarden is more secure. Still, the possibility of a change of management philosophy at Bitwarden also wore on me, so not wishing to be solely dependent on an app that I might no longer trust, I continued to maintain my KeePassXC vault, duplicating any new Bitwarden entries. It's a simple way to backup Bitwarden, though a bit time-consuming. Syncing KeePassXC is simpler now than before I migrated; sneakernet is no longer required, having been replaced by Signal and "Note to Self." It's still not as simple as Bitwarden's sync, so I'll maintain that unless I have a trust reason to change. FWIW
tiffanyh 3y ago
FYI - Bitwarden took $100M in VC money last year. At some point, the pressure to aggressively monetize will unfortunately happen. https://techcrunch.com/2022/09/06/open-source-password-manager-bitwarden-raises-100m/amp/ https://techcrunch.com/2022/09/06/open-source-password-manag...
- FirmwareBurner 3y ago
  My take in life: whenever VC or PE investors take over, start moving away from that product and pronto.
  - 22289d 3y ago
    The new CEO concerns me. I didn't know who the founder was but I always had the impression it was a lone hacker. They passed the baton. Now it's some old Web 1.0 guy who was the CEO of eFax in the 90's. That's not the type of service I thought I was using. I looked up their headquarters in Santa Barbara and it's a co-working space. That doesn't sound very secure. Though that could be their corp address and they're hiding where they work.
    - louthy 3y ago
      > The new CEO concerns me. I didn't know who the founder was but I always had the impression it was a lone hacker. They passed the baton. Now it's some old Web 1.0 guy who was the CEO of eFax in the 90's. This sounds like ageism to me. I don't know if this guy is any good or not, but calling out someone as a 'concern' just because they were successful in the past isn't a good look. Is there anything more substantive behind your concern?
      - oooyay 3y ago
        I've never heard "web 1.0 guy" as a pejorative, on top of what you said. For the curious, Michael Crandell is the CEO and he founded Right Scale in 2007 which exited in 2018 with 250 employees. He was EVP at eFax in the early aughts, which would have been somewhere in his twenties. He's a Stanford and Harvard graduate as well as a self-taught programmer in assembly. Here's an interview with him: https://medium.com/authority-magazine/michael-crandell-of-bitwarden-5-things-you-need-to-know-to-optimize-your-companys-approach-to-6844f97dd875 https://medium.com/authority-magazine/michael-crandell-of-bi... Kyle Spearrin is still at BitWarden and is listed as the Founder & CTO: https://bitwarden.com/about/ https://bitwarden.com/about/ It looks like he lives in Jacksonville, FL and has a lot of hobbies. Maybe this is some internalization, but thinking about another engineer referring to me, pejoratively, as a "web 1.0 engineer" would probably leave me confused. Am I supposed to be ashamed I played in the early days of the web?
woernsn 3y ago
Here, I also want to mention vaultwarden which is an open-source Rust implementation of the server: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden
- notpushkin 3y ago
  Using Vauldwarden for my team passwords (for personal ones I have Password Store). Zero problems except when I had to migrate to another server and it didn't pick up the database from the Docker volume I restored the first time (although it's equally likely a Docker problem or me doing something wrong).
  - quaintdev 3y ago
    > it didn't pick up the database from the Docker volume I restored the first time This happened to me too. Moved to KepassXC with syncthing and I haven't looked back
    - notpushkin 3y ago
      KeePass is nice from my experience, but how well does it perform in a multi-user environment?
      - teekert 3y ago
        I went away from keepassxc after too many sync conflicts. Perhaps it was my own Nextcloud that was the cause, but now with passwords sharing between me and spouse and no more sync issues (on Vaultwarden) I’m very happy I switched.
- preya2k 3y ago
  Only thing missing from Vaultwarden is SSO/Oauth. There’s a PR for it that’s been open for years. I’ve lost hope that it’ll ever land.
  - 3y ago
firtoz 3y ago
Does it have syncing 2fa support? That's what keeping me paying for 1Password. I know it's controversial, it's a risk I'm willing to take.
- vincentkriek 3y ago
  Yes
- Tmpod 3y ago
  It does, in the premium plan ($10/year).
  - firtoz 3y ago
    Time to reconsider :D
  - guerby 3y ago
    vaultwarden also has 2FA support. I'm using it (FIDO2/webauthn)
- Try1275 3y ago
  yes it does, in addition it allows you to access the authenticator key after you save it.
Try1275 3y ago
I am a happy user and find it very convenient but how safe is it really to have all your jewels centralized in the cloud, including 2FA. It seems such a worthwhile target. On the other hand keeping everything in sync manually seems a hassle and in the end you just encrypt on your machine and the syncing goes through the cloud anyway, so where's the difference? I'd be happy to hear thoughts on this.
- autophagian 3y ago
  For this I self-host vaultwarden (https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden), an implementation of the bitwarden server, on my raspberry pi at home (and back up the DB frequently). It works well enough for me, and doesn't have my stuff stored in a single company's cloud.
  - hollander 3y ago
    So what if the disk crashes? Do you keep backups? In the cloud?
    - tuhriel 3y ago
      There are different places to keep backups My relevant data is synced regularly to my nas (running a raid-1) and I weekly back the whole thing up to an offsite disk at my parents house. Can someone who really really want it, get to it? Sure, how big of a target am I against a cloud provider?
    - sigio 3y ago
      Always have backups... but in the bitwarden/vaultwarden case (just like with git), every client has a full copy which can be syched back to a new server, so even if you lose a server, you still have all passwords on (every) client. In my case, that is multiple browser instances on multiple laptops and the bitwarden client on android.
    - hanniabu 3y ago
      can't backup to usb?
vincentkriek 3y ago
Bitwarden is great. I use it everywhere and it manages passwords well. The key feature for me is the ease of use of "organizations", which allows me to share passwords with my wife easily. A lot of accounts regarding our financials or children are shared, so we both need the password. Bitwarden makes this trivial.
- deleted 3y ago
  [deleted]
- this_is_not_you 3y ago
  I also use the sharing feature (aka organizations) and maybe I am too dumb but it seems that you can't see or copy the password anymore once you have shared it (even the one you yourself shared with somebody else). Which is fine for when you can use the auto-fill but that just doesn't always work or isn't always feasible.
Beijinger 3y ago
I use https://www.enpass.io/ https://www.enpass.io/ (free version). Not open source but very good and very convenient. (I see they changed. There may not be a free version anymore, not sure)
tkubacki 3y ago
Open source and easy to use https://www.passwordstore.org/ https://www.passwordstore.org/
- proaralyst 3y ago
  Note that pass by design leaks both the websites you have set up and the metadata of the history of each record. This might suit your threat model, or it might not.
  - fryktelig 3y ago
    Wouldn't the attacker need to breach your git server first before that was leaked?
  - zikduruqe 3y ago
    If I'm looking in your ~/.password-store directory and see entries named Finanace/, Travel/, Streaming/, Work/... you have bigger problems.
    - xcdzvyn 3y ago
      Could I ask why?
      - zikduruqe 3y ago
        That means I have access to your local machine if I can view your ~/.password-store directory. I might not be able to view or decrypt the contents of every entry, but I still have access to your machine.
        xcdzvyn 3y ago
        Ah, right, I didn't consider that. Thanks.
- chx 3y ago
  Note https://github.com/passff/passff https://github.com/passff/passff
deleted 3y ago
[deleted]
bad_user 3y ago
I wanted to like Bitwarden, due to its “open source” nature. But 1Password is really miles ahead, and it's a little ironic, as 1Password 8 went through a major refactoring to a Node-enabled UI, which many people disliked, and it's still miles and miles ahead. I tried teaching my father to use Bitwarden for the sole reason that it seemed to be translated into my native tongue. In his use, Bitwarden turned out to be completely unreliable. As techies, we stop noticing the little glitches, the times when Bitwarden is unable to auto-complete, or to detect a login that needs to be saved. Or the times Bitwarden logs you out of the account, or fails to use your biometrics in the browser because the app is no longer running in the background. Or the management UX of the app that's terrible. For us, these are little annoyances, but for my father it was the difference between usable and unusable. The individual plan is very cheap, but the family plan is costly. And you can self-host, sure, but it's expensive to self-host. When talking of self-hosting, people actually mean the alternative built from scratch in Rust (vaultwarden). Well, that project was never audited to my knowledge. Open source or not, it may have security vulnerabilities that could be exploited remotely, and I don't understand how people can trust it. Bitwarden also took VC investments. Which is fine, I guess they need to grow, but I'm longing for projects that are owned by sustainable businesses that don't need to grow. Why does everything need freaking VC investments? The problem being that startups that took such investments are not trustworthy to be around in another year from now, sorry. Although this is true of 1Password as well.
- rcxdude 3y ago
  AFAIK the vaultwarden is just easier to set up for self-hosting. You can self-host the same server bitwarden use, but it's a lot more effort (unless they have stopped developing this recently).
- j1elo 3y ago
  I'm a paying user because 1€/month is the perfect price for what I'd like a password manager to cost. But you're right and the flaws are there. Before, I used LastPass, and for me, the form field detection was miles ahead. Not a tiny bit, but _a lot_ better. And the UI built on the ephemeral pop-up was a very bad idea that after years and years they haven't decided to ditch and do it the proper way on a new tab, like LastPass, uBlock Origin, o TreeStyleTabs do.
tjrgergw 3y ago
I wish our industry would adopt the custom that to pitch your product you need to compare yourself to the best competitor, or no one will even look at you. There's only one thing I wanna hear from Bitwarden: What do you do that KeePassXC doesn't, and what are the trade-offs?
- mikae1 3y ago
  > What do you do that KeePassXC doesn't, and what are the trade-offs? Bitwarden offers free hosting for personal use. Also, consistently named apps (even for mobile).
geekrax 3y ago
Since nobody has mentioned: iOS 17 and macOS Sonoma brings family sharing to password managerm. Sonoma also brings support for using native passwordsl manager in Chrome using a chrome extension developed by Apple. For families who are hooked into Apple's ecosystem, this can provide a much better password management than third party tools.
- jacooper 3y ago
  Then your iCloud account gets banned and you lose everything.
  - zshrc 3y ago
    Should’ve had better backups.
    - antgiant 3y ago
      You can’t backup the entire iCloud Keychain, only export to csv which doesn’t contain everything. (For instance passkey secrets)
- cebert 3y ago
  It’s a great way to get further locked into Apple’s ecosystem. Good luck if you ever need to move to an alternative platform.
  - throwaway2990 3y ago
    Good luck ever having a better alternative platform to move to.
    - jacooper 3y ago
      Oh there are so many. Especially ones better than MacOS.
  - afavour 3y ago
polyrand 3y ago
I really like Bitwarden, but I found it buggy in terms of user experience, and I'm now considering switching. Some annoying bugs I've experienced: * Desktop app not focusing correctly when opening it * Browser extension asking to save password even if it's already there * Log-In suggestions not showing * Slow and laggy on iOS * Biometrics log-in breaks half of the times I try to use it I like the fact it's open-source, although that doesn't make it more secure, and I don't think I would like to self-host.
- syntaxless 3y ago
  If I create a new login on mobile it never syncs to the vault/desktop correctly. I have so many empty vault items that then sync back to mobile. Nothing seems to fix it.
gaborme 3y ago
I’m using KeePass since decades.
wmal 3y ago
The title is misleading. This is not fully "free and open-source". I'm actually puzzled by the licensing structure. Bitwarden server is dual-licensed [1] - part of it is licensed with AGPL (Open Source) - some features are licensed with a source available Bitwarden license Now, even the Open Source core requires you to register if you want to self host. This is to provide you with complementary services like security updates, push relay servers (?), and licensing checks. [2] Although not stated in the docs, I guess this also improves their telemetry data, as they suggest to never share the license keys between installations. I completely understand the need to use source available licenses instead of open source. What I don't understand is why to even license parts of your app as Open Source? The resulting product is not free. Neither as in beer, nor as in speech. Does anyone know good reasons for doing that? I'm asking seriously. I'd like to better understand how companies benefit by marketing their products as Open Source, even if they are barely open source. [1]: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.md https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.... [2]: https://bitwarden.com/help/hosting-faqs/#q-what-are-my-installation-id-and-installation-key-used-for https://bitwarden.com/help/hosting-faqs/#q-what-are-my-insta...
- the_gipsy 3y ago
  You said it yourself, marketing.
- skjoldr 3y ago
  "Commercial.Core and SSO integration: Code for certain new modules that are designed and developed for use by larger organizations and enterprise environments is released under the Bitwarden License, a "source available" license." The rest of Bitwarden is free both as in beer and as in speech. Dunno why you think otherwise. Vaultwarden exists, and Bitwarden clients are compatible with it.
  - wmal 3y ago
    Thank you, and other people, for mentioning Vaultwarden. I’ll check that out. This is, however, a separate software package, coming from different people, so not related to my question. Bitwarden is not free as in speech, as it requires me to register with Bitwarden, Inc and get a license key to be able to self host. Also, then it uses some closed cloud services. As for the free as in beer - this is more nuanced, but I still think it is far from free. For individuals - hosting something that requires 2-4 GB of RAM [1] is definitely not free. For companies - hosting something that doesn’t include SSO is pointless. The Bitwarden source available license, that includes SSO, does not allow production use [2], and requires a paid subscription instead. BTW I completely understand the reasons to not open source everything. What I don’t understand is: why not use the source available Bitwarden license for the entire server codebase? [1]: https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/ [2]: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.md https://github.com/bitwarden/server/blob/master/LICENSE_FAQ....
blacklight 3y ago
I've been self-hosting it for years and I love it. I mean, being a MSSQL + .NET app it's quite an exotic beast in my self-hosting garden, but it definitely does its job without skipping a beat. I'm also happy to support them with a modest $10/month contribution - for that price you get a few extra perks on your instance, but most importantly for me you get to store OTP codes / support for MFA, so I don't have to use a separate app for that. I feel like it's important to keep financially supporting projects like these, even if we host them ourselves, even if we only get one or two extra perks for the extra bucks. External pressures towards enshittification are inversely proportional to profitability. If a company can make money out of a business model where 80% is free to self-host and 20% is additional subscribe-only stuff, then things can remain like they are. If it doesn't, then we're all going to lose also the remaining 80%.
BrunoBernardino 3y ago
I'm surprised no one's mentioned Padloc [1] yet. It's end-to-end encrypted, open source, easy to self host, and with a really UI + UX. I got all my family to use it and used it for a over a year, before eventually contributing actively to it. There's even a Tauri-based desktop app! Full disclosure: I have "contributing power" but do not make money from its sales or anything like it. [1]: https://padloc.app https://padloc.app
- xd1936 3y ago
  "This app isn't available for your device because it was made for an older version of Android". Cannot install. —Google Play on an Android 13 Pixel 7. That and the star rating are not confidence inspiring.
  - BrunoBernardino 3y ago
    Sorry, I install from the APK directly, available in the GitHub repo. I see someone already created an issue for it at https://github.com/padloc/padloc/issues/725 https://github.com/padloc/padloc/issues/725 so thanks for bringing it up!
- haizhung 3y ago
  Does it have WiFi sync? Seems like all the big players are committed to removing that, and that’s like the one single thing I want from a password manager: don’t store all my passwords in the cloud.
  - neandrake 3y ago
    Check out CodeBook, it’s not open source but it’s a 1-time fee for device type (windows, Mac, iPhone, android), up to five installs. I’ve purchased for phone, MacBook, and windows pc and been using for the past 5+ years and am satisfied with it. The product itself isn’t open source but the company which makes it does develop an open source module/extension of SQLite for encrypted database. All syncing is manually done, across Wi-Fi or it can use Dropbox or google drive. https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/
monlockandkey 3y ago
I don't agree with the self hosted Bitwarden philosophy. Having a "server" to manage passwords is overkill for most people. The best is to use an encrypted keepass file stored on your cloud storage (Google drive, Dropbox etc). It is portable and easy to access from anywhere ( don't need to VPN to your local network). Not a fan of the self hosted server password management model. Doesn't make any sense unless managing multiple users.
- 2rsf 3y ago
  I agree with the first part of your statement, but how do you access an encrypted keepass file from mobiles?
  - debo_ 3y ago
    There are mobile apps for keepass e.g. KeypassDroid https://play.google.com/store/apps/details?id=com.android.keepass https://play.google.com/store/apps/details?id=com.android.ke...
  - monlockandkey 3y ago
    https://keeweb.info/ https://keeweb.info/
Aerbil313 3y ago
I have no passwords. Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose all your electronics? All your belongings? Your house burns down in a fire? The cloud gets hacked? You have conflicting interests with US government and they kindly request your passwords from Apple? You have conflicting interests with any other country and they find and use the backdoors installed in US companies by US agencies? I use an algorithmic password which is: * Trivial to run in my head (I got used to it) * Compliant with all silly password character requirements * Has password rotation built in for apps/websites which require you to change your password every X monts * Has a shorter version for apps/websites which have a password length limit of 20 chars * Has a third easier-to-spell version for passwords I need to share with family and friends * Completely ASCII * Impossible to tell with bare eyes it's the password for amazon.com from the resulting password. It looks like randomly generated gibberish. * Leaves the Caps Lock off (so that you won't try again and fail again when you fail once and the Caps Lock is on) I only have an algorithm in my head. The downsides? It's a bit more slower to enter a password if I haven't entered it in a while. Still doesn't take more than 30 secs. And it can only be brute forced in a million years instead of a billion. And yes, you need these features in your algorithmic password. It took me about a year of trial and error to get to this point.
- ishtanbul 3y ago
  Can you please explain this more?
  - Aerbil313 3y ago
    I cannot disclose the algorithm. What feature do you want explained?
    - nashashmi 3y ago
      How do you solve for password expiration and prohibited reuse?
      - 3y ago
nichtverstehen 3y ago
I use and pay for Bitwarden. I want it to succeed, but I still find it weird. 1. Security. Bitwarden's documentation on its security model is quite thin. 1password has a great write-up about how it works in detail: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p.... Corresponding doc for Bitwarden is much lighter on detail: https://bitwarden.com/help/bitwarden-security-white-paper/ https://bitwarden.com/help/bitwarden-security-white-paper/. The security audits they list of https://bitwarden.com/help/is-bitwarden-audited/ https://bitwarden.com/help/is-bitwarden-audited/ are focused on the client software implementation bits, and make no judgement on the overall security model. My main concern is that the password is the only key that is needed to both log into the server and to decrypt the vault. There is no additional key that is completely offline, like 1password Secret Key (that is presumably stored in Keychain / Secure Enclave at rest). A password seems somewhat more easily stealable (with keyloggers or clipboard loggers etc). I am not a security expert, but I know enough to be concerned :). I wish there was more discussion on the implications of this difference on security models. 2. Offline access. Bitwarden does not like to work offline. You can unlock and view the vault, but you cannot make any changes without active connection to the internet! And Bitwarden will show you a very generic error ("failed to fetch") if you try editing while offline, it won't give you any suggestion on what to do. Moreover, apparently they will delete the local copy of the vault if internet connection is missing for 30 days: https://www.reddit.com/r/Bitwarden/comments/vtaqi0/comment/if7cigx/ https://www.reddit.com/r/Bitwarden/comments/vtaqi0/comment/i.... That's just nuts if true. I should not rely on the Cloud to have access to the vault as stored locally as long as I have the password. While there is a general fear about trusting The Cloud as the source of truth for accessing the passwords, this caused very tangible practical issues. I have actually run into needing Bitwarden while on the go. Also the CloudFlare IP that Bitwarden uses was somehow blocked by my provider for some time, and that broke Bitwarden completely (both the provider and Bitwarden neglected to do anything about the problem when contacted). 3. UX. You get used to it, but it's simply not great. Worst of all, the UI of the browser extension is prone to data loss. The Bitwarden popup resets the state every time it is unfocused. So imagine the scenario: * I start creating a new entry and generate a password. * I briefly dismiss the Bitwarden popup to paste the password into the website. * I open Bitward popup again hoping to finish entering the data and save. But the entry is gone. I just need to hope that the generated password is still on the clipboard. 1password in contrast keeps full UI state and partially entered data even if the vault is locked in the interim.
activitypea 3y ago
I try to use open-source wherever I can, but Bitwarden's UX just can't compete with 1Password or even LastPass. The Firefox extension in particular is pretty wonky.
- carstenhag 3y ago
  Agree. MacOS app is bad. Chrome extension bad. I use it at work and for that it's fine, I barely have to use it.
newscracker 3y ago
I’ve been using Bitwarden more as a backup since it lags in more ways than one. With iOS 17 bringing password sharing, I may be able to rely on that and switch to KeePass (and its derivatives) as a cross platform backup where needed. Products like 1Password and Dropbox first made a good consumer product before pivoting to enterprise and making the products worse. Even before the VC funding of $100 million, Bitwarden started pivoting to cater to enterprise features and neglected the consumer side. This has resulted in Bitwarden doing a minimum set of things in a very mediocre way. Its desktop clients are based on Electron and suffer with the common issues related to that (don’t behave like native apps for keyboard shortcuts or navigation, sluggish, etc.). Its mobile app, at least on iOS, is also sluggish and has poor UX. People have asked for additional predefined item types (like WiFi passwords, software licenses, etc.) and that’s been on the roadmap for more than five and a half years [1] with no timeframe for release in sight. It just recently changed the timeframe for this from the first half of 2023 back to “Under Research”. [2] In all likelihood, it’ll be six and a half to seven years by the time that’s done, if at all. One positive about Bitwarden is that its free tier offers something that’s somewhat good (ProtonPass is nowhere close to this as of yet). But I don’t see anything in the password management market that’s cheap enough (like Bitwarden’s personal plan), has good features (including browser extensions) and stability, and is managed by courteous and helpful people (1Password fails on some of these). [1]: https://community.bitwarden.com/t/additional-item-types-pre-defined/228 https://community.bitwarden.com/t/additional-item-types-pre-... [2]: https://community.bitwarden.com/t/bitwarden-roadmap/12865 https://community.bitwarden.com/t/bitwarden-roadmap/12865
luczsoma 3y ago
1Password is miles ahead. Its UX is WAY better, as is its cryptography architecture and its security whitepaper (https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...). Bitwarden doesn’t even come close.
- alt227 3y ago
  Unfortunately 1Password doesnt have the main feature that most of us are probably using bitwarden for, self hosting. EDIT: I have just noticed this. Everyone whos interest should submit! https://survey.1password.com/self-host/ https://survey.1password.com/self-host/
  - throwawaaarrgh 3y ago
    and 1Password doesn't work from behind corp proxies with custom traffic inspection certs
    - somehnguy 3y ago
      It does fine here
    - kstrauser 3y ago
      We added a steering exception to our Netskope setup for 1Password. All the traffic going there is encrypted twice anyway, once by the app and again my TLS, so inspection doesn’t show you anything interesting.
  - belthesar 3y ago
    Ironically, I tried to fill out that form, and I receive a 429 when trying to submit. I guess they aren't going to get a lot of requests to make this product a reality if they can't get feedback that folks want it.
- throwaway2990 3y ago
  No. The user experience of 1Password is just frustrating. I use it daily for work and don’t like it. I’ve used it longer than I’ve used bitwarden.
Subdivide8452 3y ago
I’m relatively new to this site. Why is this post popular? For me it links to the Bitwarden front page.
- notnef 3y ago
  afaik this site is for showing interesting things and discussing them. this post is to show the bitwarden password manager, nothing more to it.
  - Subdivide8452 3y ago
    OK, thank you :)
nathell 3y ago
I’ve been a happy user of Pass (https://www.passwordstore.org/ https://www.passwordstore.org/) for a few years now. Can’t see it being monetized any time soon, which is a Good Thing. So is its strict adherence to the Unix philosophy.
- BanazirGalbasi 3y ago
  I really wanted to try switching to pass, but I use my password manager on my phone too much, and I dual-boot on my desktop besides. WSL solves the desktop issue, but I'm not sure what the best option is for syncing Linux, Windows, and an Android phone. Heck, I don't even know how `pass` stores the db so I don't know if it can be synced. Got any insight there?
  - severus_snape 3y ago
    There is no "database", it's just a bunch of GPG encrypted files synced with git. (Their default location is ~/.password-store.) For Android there is https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S.... The only Windows client listed at https://www.passwordstore.org/#other https://www.passwordstore.org/#other is unmaintained.
imchillyb 3y ago
I /vastly/ prefer Dashlane password manager. The $60 per year fee keeps the VC money at bay. I’m the customer, not my data. Dashlane, it’s well worth the price for my piece of mind and the security of my passwords.
debo_ 3y ago
I was about to try this out a while ago, but I installed Syncthing on my machines at around the same time. Keepass db + syncthing works astonishingly well, and the Android keepass client works great for me. I prefer the simplicity of this setup to yet another web service, especially if I'm going to self-host.
wurstehans 3y ago
I'm using Apass and am happy with it https://github.com/balu-/a-pass#readme https://github.com/balu-/a-pass#readme
neilsimp1 3y ago
Is there a desktop client for Bitwarden that isn't Electron-based yet? I tried this years ago and didn't like it. Not only because Electron, but I thought it was missing a lot of basic features (folders/organizing passwords was sorely lacking). I'm not looking to try it again, to be clear, just curious. KeepassXC won my heart.
- jjice 3y ago
  Depends on if you count a command line tool as a desktop client or not [0]. I personally just use the browser extension instead of the desktop client (the GUI one) since it was a bit slow and the extension is fine. [0] https://bitwarden.com/help/cli/ https://bitwarden.com/help/cli/
stormed 3y ago
For anyone that's interested in self-hosting Bitwarden on your server, I would highly recommend checking out the Rust implementation, Vaultwarden. It takes less resources to run, doesn't paywall certain features (I.E MFA logins), and (in my experience) has been a lot easier to work with compared to the official client. https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden
jjice 3y ago
Huh, more negative than I expected. For some reason I had Bitwarden as an HN darling in my head. Not sure where I got that from. I pay for premium for $10 a year. Not sure what I actually take advantage of with that honestly but I just really like the product. That said, it's not based on a lot of competition searching. Am I missing out on some big benefits in other managers?
- StevePerkins 3y ago
  Really surprised by this as well. So many comments are of the generic nature, "<COMPETING PRODUCT> is miles ahead", without any specifics on what that's supposed to mean. My last few employers have used LastPass and 1Password, while I use Bitwarden for my personal stuff, and I prefer the latter by far. The browser plugin is more reliable about recognizing when I'm entering or updating a password, and offering to store or update it. The iOS version has smoother integration with password autocomplete in other native apps. It MAY be that Bitwarden lags behind in "team" sharing features, I don't know. For personal use, that class of use cases is irrelevant to me. As near as I can tell, there seems to be a lot of HN rage that "most" of Bitwarden is open source, but there are still some proprietary bits that keep it from 100%. I never understand this mentality, that software should fall from the sky like manna from heaven and not support a business. I also don't understand why these resentments never seem to stick to products like VS Code, that are the exact same way. Maybe Bitwarden should just try a sexier-looking dark mode UI?
  - nativeit 3y ago
    I’m with you on this. I tried every popular option a few years ago and found all of them to be rather atrocious, but settled on self-hosting VW, and found its mobile integration (using BW clients/apps) to be as close to native as anything, and its 2FA (for TOTP anyway) is superb. Nothing else thus far allows me to launch a website or app and login with 2FA faster than Bitwarden. I operate under the assumption that everything has a weak spot, at least Vaultwarden isn’t hiding the source code and if BW’s VC backers dictate some kind of rule-breaking change to the service, it won’t affect my data and forks/OSS alternatives will be easily readied to interface with it.
- 3y ago
AbraKdabra 3y ago
You should use Vaultwarden if you need self-hosting it https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden.
running101 3y ago
1. keypassxc + keypassxc browser plugin on google drive 2. on iphone strongbox using shared db on google drive The syncing works fairly well.
darrmit 3y ago
Bitwarden is not perfect, but calling `pass` "easy" is comical - especially for those of us sharing passwords with far less technical family members - and 1Password has a very opinionated UI that seems to get more in the way than anything. I find Bitwarden to strike a good balance between security, price, and design. That said, I do share in the concern about the funding and exec changes.
tamimio 3y ago
Bitwarden is great, KeepassXC is even better.
hestefisk 3y ago
Happy user for two years and going strong.
xnasero 3y ago
I want to like bitwarden but 1 year subscription ended without notification. Then they disabled 2FA a no go. Now I use KeepassXC better to have full control over sensitive data
ZuLuuuuuu 3y ago
Do any companies use Bitwarden? Are they satisfied with it? We tried using Keepass but people were resistant to using it. The UI is not very user-friendly for non-technical people. Keepass also lacks some of the features we would like to have, for example: We would like to push a new user/password to a person's vault (for example let's say IT creates a printer account for a person, we would like to put the account information to the relevant person's vault), or we would like to share a common password among a group of people. But I am not sure if Bitwarden is a good choice in practice for this kind of things.
ryanmcbride 3y ago
I've been using bitwarden for years and I love it
amq 3y ago
I'm still looking for a product that offers a completely passwordless SSO and has a good and simple UI (keeweb, anyone?) Unfortunately, Bitwarden fails at both.
- sufficient 3y ago
  You can try https://www.heylogin.com https://www.heylogin.com if you are looking for a new approach without a Master Password. I am one of the founders.
walteweiss 3y ago
Oh, how much I enjoy those infinite discussions about password management software, looking from my pass¹ side. I cannot imagine migrating from pass anywhere, I have almost a thousand of entries there (my and my family’s plus some friends). The funniest part those discussion well never cease to appear. And they are so much alike, again and again! [1] — https://www.passwordstore.org/ https://www.passwordstore.org/
- walteweiss 3y ago
  To anyone wondering whether I would recommend pass for family and non-techy friends. No, I wouldn’t. I just recommend them to use whatever is built into their smartphones (usually Apple’s or Google’s). Those integrated tools are plenty for their 15 entries. And I may back up the crucial ones to my pass vault, just in case of a smartphone loss or anything that may never happen, just to keep my peace of mind. That works for me and my close ones quite well.
holyrood 3y ago
Am I stupid for feeling that Google Chrome and my iPhone keychain is all the password management I need? What am I missing out on with solutions like Bitwarden or 1Password?
ValentineC 3y ago
This is incredibly superficial, but I wish Bitwarden used the system font stack for its apps instead of forcing Open Sans on everyone. I found that it helped make Bitwarden slightly nicer to use for me and some others I provided a one-time fork of the Mac app to try. If I could figure out how to sign and ship Mac and iOS apps, I'd ship a fork that continually pulled from upstream, with just the two `variables.scss` files patched.
sigunder 3y ago
[flagged]
mikestaub 3y ago
I'm just waiting from Proton to stabilize theirs then I'll switch.

455 points by punnerud 3y ago

nomercy400 3y ago

I am a KeepassXC user, yet this sounds interesting. What does Bitwarden offer to make me want to switch?

KJBweb 3y ago
better cross platform user interface integration
harrytodorov 3y ago
From what I can see, the major feature would be that it stores the password database on their premises and then lets you access it through multiple devices. Whereas in the case of KeepassXC, you have to have your own place where to store the password database and set it up on you different devices. So Bitwarden offers more convenience.
b1476 3y ago
For what it’s worth I was a longtime KeepassXC user. Switched to Bitwarden to have easier shared passwords between myself and partner/family however I’m now moving back to KeepassXC. I support Bitwarden fully however the app itself is just so badly designed. The UI is dreadful (both the website and desktop app) and I find it very frustrating to use. The whole layered concept of folders and inability to have tags is a nightmare when you have a large collection of passwords. The iOS app seems to quit unexpectedly after opening as well. I’m just very underwhelmed with what I was hoping would be a nice alternative to having to sync my Keepass database everywhere. On the KeepassXC side of things I’ve had zero issues with the app itself (using it on Linux, OSX and Windows) and I use Strongbox on iOS which is one of the very few apps I’m happy to pay for to support the developer, it’s so much more polished than Bitwarden.
- caoilte 3y ago
  Keepassxc is great and works well with keepass2android via file sharing. I can imagine how the password sharing would be a problem tho.
sebstefan 3y ago
Vault synchronization between devices without needing to self-host anything, for free
antioxidant 3y ago
Nothing. Adding 2FA codes to logins costs money, and self-hosting is deliberately difficult so you’ll be using the cloud. Also you can’t edit while offline.
- vincentkriek 3y ago
  Self hosting is incredibly easy with vaultwarden (https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden)
  - LinAGKar 3y ago
    That's a different implementation though
    - vincentkriek 3y ago
      A different implementation for the server though, not the clients. So, as a user you wouldn't see the difference. And as an admin it's much easier to maintain.
    - ghosty141 3y ago
      Theoretically yes but its comptible with the official cliente like the iOS app so it practically works the same.
- r4indeer 3y ago
  > Adding 2FA codes to logins costs money If you don't want to pay $10/year for Premium, you can still host Vaultwarden instead and get the features for free. > self-hosting is deliberately difficult so you'll be using the cloud [citation needed] in my opinion. Yes, the current self-hosting method is rather complex, but still not that difficult to set up. Just follow their guide. They are even working on a new "unified" deployment method [1] where you can choose your own DB and all the Bitwarden containers are merged into one. The resulting docker-compose.yml looks as simple as any other service I self-host. Why would they do this if what you said were true? [1] https://bitwarden.com/help/install-and-deploy-unified-beta/ https://bitwarden.com/help/install-and-deploy-unified-beta/
silversmith 3y ago
Same boat. I'm also curious how does device sync happen with bitwarden - from a cursory glance it seems to rely on their cloud. Can you manually manage the database file, like with keepass?
- Tmpod 3y ago
  You can use their cloud, but if you're technical you can also self-host a server instance. In that case, it's usually recommend to stay way from the complicated official implementation and instead pick vaultwarden, like another commenter said.
Octabrain 3y ago
I did the same for years: KeepassXC + Database being synced through Google Drive + keyfile stored only locally on each device (Linux personal laptop, Windows work laptop + Android personal phone) + Safe strong password that was only in my head. The main reason I decided to switch to Bitwarden it's because the Google drive client I used on Linux (GVFS in Gnome) gave me a few good headaches. Basically, everytime I made a modification to the database, it changed the name of the file, therefore, when opening the database later from another device, I had to be listing files by modification date to try to guess the most recent one and open it. Also, sometimes from Linux, I got errors from KeepassXC saying that the database was not writable, so I had to save it in a different location that wasn't the Google drive FS and then move it manually to it. Perhaps not a big deal for some people but after years of this I just got tired of shenanigans on something I consider too critical. The reasons for me for switching specifically to Bitwarden were: - Price. - Open source. - Multiplatform client. - Simple and straightforward to import stuff from KeepassXC. - MFA. - Possibility of self hosting. (Although I'm using the saas version for now)
dsissitka 3y ago
It's been a few months since I've used Bitwarden but I can think of a couple things: - Fewer people to trust. You have to be a little more careful with KeePass clients: https://news.ycombinator.com/item?id=36020196 https://news.ycombinator.com/item?id=36020196 - Templates. Bitwarden's implementation is pretty basic but the KeePass ecosystem is still sorting it out: https://github.com/keepassxreboot/keepassxc/issues/8228 https://github.com/keepassxreboot/keepassxc/issues/8228
Phelinofist 3y ago
I also use KeePassXC and commit my DB to git. On PCs I just clone the repo and am ready to go. On mobile I download the DB via a web interface. No fancy automatic sync, but my DB doesn't change that often, so the manual effort is still small.
landmass 3y ago
As a long-time user of KeePassXC, I switched because of the difficulty of syncing databases. Basically, I used the sneakernet and a thumb drive whenever I thought I needed to for five or six devices - it became wearing. At first after the change I kept the critical account - banks, email, and the like - solely on KeePassXC. As I began to trust Bitwarden I began to slowly add those accounts, too. Also, while I trust Bitwarden sync, I'm not quite as sure of the various apps that implement the KeePassXC on iOS. I'm still not aware that any have been audited, so to my mind Bitwarden is more secure. Still, the possibility of a change of management philosophy at Bitwarden also wore on me, so not wishing to be solely dependent on an app that I might no longer trust, I continued to maintain my KeePassXC vault, duplicating any new Bitwarden entries. It's a simple way to backup Bitwarden, though a bit time-consuming. Syncing KeePassXC is simpler now than before I migrated; sneakernet is no longer required, having been replaced by Signal and "Note to Self." It's still not as simple as Bitwarden's sync, so I'll maintain that unless I have a trust reason to change. FWIW

tiffanyh 3y ago

FYI - Bitwarden took $100M in VC money last year. At some point, the pressure to aggressively monetize will unfortunately happen. https://techcrunch.com/2022/09/06/open-source-password-manager-bitwarden-raises-100m/amp/ https://techcrunch.com/2022/09/06/open-source-password-manag...

FirmwareBurner 3y ago
My take in life: whenever VC or PE investors take over, start moving away from that product and pronto.
- 22289d 3y ago
  The new CEO concerns me. I didn't know who the founder was but I always had the impression it was a lone hacker. They passed the baton. Now it's some old Web 1.0 guy who was the CEO of eFax in the 90's. That's not the type of service I thought I was using. I looked up their headquarters in Santa Barbara and it's a co-working space. That doesn't sound very secure. Though that could be their corp address and they're hiding where they work.
  - louthy 3y ago
    > The new CEO concerns me. I didn't know who the founder was but I always had the impression it was a lone hacker. They passed the baton. Now it's some old Web 1.0 guy who was the CEO of eFax in the 90's. This sounds like ageism to me. I don't know if this guy is any good or not, but calling out someone as a 'concern' just because they were successful in the past isn't a good look. Is there anything more substantive behind your concern?
    - oooyay 3y ago
      I've never heard "web 1.0 guy" as a pejorative, on top of what you said. For the curious, Michael Crandell is the CEO and he founded Right Scale in 2007 which exited in 2018 with 250 employees. He was EVP at eFax in the early aughts, which would have been somewhere in his twenties. He's a Stanford and Harvard graduate as well as a self-taught programmer in assembly. Here's an interview with him: https://medium.com/authority-magazine/michael-crandell-of-bitwarden-5-things-you-need-to-know-to-optimize-your-companys-approach-to-6844f97dd875 https://medium.com/authority-magazine/michael-crandell-of-bi... Kyle Spearrin is still at BitWarden and is listed as the Founder & CTO: https://bitwarden.com/about/ https://bitwarden.com/about/ It looks like he lives in Jacksonville, FL and has a lot of hobbies. Maybe this is some internalization, but thinking about another engineer referring to me, pejoratively, as a "web 1.0 engineer" would probably leave me confused. Am I supposed to be ashamed I played in the early days of the web?

woernsn 3y ago

Here, I also want to mention vaultwarden which is an open-source Rust implementation of the server: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden

notpushkin 3y ago
Using Vauldwarden for my team passwords (for personal ones I have Password Store). Zero problems except when I had to migrate to another server and it didn't pick up the database from the Docker volume I restored the first time (although it's equally likely a Docker problem or me doing something wrong).
- quaintdev 3y ago
  > it didn't pick up the database from the Docker volume I restored the first time This happened to me too. Moved to KepassXC with syncthing and I haven't looked back
  - notpushkin 3y ago
    KeePass is nice from my experience, but how well does it perform in a multi-user environment?
    - teekert 3y ago
      I went away from keepassxc after too many sync conflicts. Perhaps it was my own Nextcloud that was the cause, but now with passwords sharing between me and spouse and no more sync issues (on Vaultwarden) I’m very happy I switched.
preya2k 3y ago
Only thing missing from Vaultwarden is SSO/Oauth. There’s a PR for it that’s been open for years. I’ve lost hope that it’ll ever land.
- 3y ago

firtoz 3y ago

Does it have syncing 2fa support? That's what keeping me paying for 1Password. I know it's controversial, it's a risk I'm willing to take.

vincentkriek 3y ago
Yes
Tmpod 3y ago
It does, in the premium plan ($10/year).
- firtoz 3y ago
  Time to reconsider :D
- guerby 3y ago
  vaultwarden also has 2FA support. I'm using it (FIDO2/webauthn)
Try1275 3y ago
yes it does, in addition it allows you to access the authenticator key after you save it.

Try1275 3y ago

I am a happy user and find it very convenient but how safe is it really to have all your jewels centralized in the cloud, including 2FA. It seems such a worthwhile target. On the other hand keeping everything in sync manually seems a hassle and in the end you just encrypt on your machine and the syncing goes through the cloud anyway, so where's the difference? I'd be happy to hear thoughts on this.

autophagian 3y ago
For this I self-host vaultwarden (https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden), an implementation of the bitwarden server, on my raspberry pi at home (and back up the DB frequently). It works well enough for me, and doesn't have my stuff stored in a single company's cloud.
- hollander 3y ago
  So what if the disk crashes? Do you keep backups? In the cloud?
  - tuhriel 3y ago
    There are different places to keep backups My relevant data is synced regularly to my nas (running a raid-1) and I weekly back the whole thing up to an offsite disk at my parents house. Can someone who really really want it, get to it? Sure, how big of a target am I against a cloud provider?
  - sigio 3y ago
    Always have backups... but in the bitwarden/vaultwarden case (just like with git), every client has a full copy which can be syched back to a new server, so even if you lose a server, you still have all passwords on (every) client. In my case, that is multiple browser instances on multiple laptops and the bitwarden client on android.
  - hanniabu 3y ago
    can't backup to usb?

vincentkriek 3y ago

Bitwarden is great. I use it everywhere and it manages passwords well. The key feature for me is the ease of use of "organizations", which allows me to share passwords with my wife easily. A lot of accounts regarding our financials or children are shared, so we both need the password. Bitwarden makes this trivial.

deleted 3y ago
[deleted]
this_is_not_you 3y ago
I also use the sharing feature (aka organizations) and maybe I am too dumb but it seems that you can't see or copy the password anymore once you have shared it (even the one you yourself shared with somebody else). Which is fine for when you can use the auto-fill but that just doesn't always work or isn't always feasible.

Beijinger 3y ago

I use https://www.enpass.io/ https://www.enpass.io/ (free version). Not open source but very good and very convenient. (I see they changed. There may not be a free version anymore, not sure)

tkubacki 3y ago

Open source and easy to use https://www.passwordstore.org/ https://www.passwordstore.org/

proaralyst 3y ago
Note that pass by design leaks both the websites you have set up and the metadata of the history of each record. This might suit your threat model, or it might not.
- fryktelig 3y ago
  Wouldn't the attacker need to breach your git server first before that was leaked?
- zikduruqe 3y ago
  If I'm looking in your ~/.password-store directory and see entries named Finanace/, Travel/, Streaming/, Work/... you have bigger problems.
  - xcdzvyn 3y ago
    Could I ask why?
    - zikduruqe 3y ago
      That means I have access to your local machine if I can view your ~/.password-store directory. I might not be able to view or decrypt the contents of every entry, but I still have access to your machine.
      - xcdzvyn 3y ago
        Ah, right, I didn't consider that. Thanks.
chx 3y ago
Note https://github.com/passff/passff https://github.com/passff/passff

deleted 3y ago

[deleted]

bad_user 3y ago

I wanted to like Bitwarden, due to its “open source” nature. But 1Password is really miles ahead, and it's a little ironic, as 1Password 8 went through a major refactoring to a Node-enabled UI, which many people disliked, and it's still miles and miles ahead. I tried teaching my father to use Bitwarden for the sole reason that it seemed to be translated into my native tongue. In his use, Bitwarden turned out to be completely unreliable. As techies, we stop noticing the little glitches, the times when Bitwarden is unable to auto-complete, or to detect a login that needs to be saved. Or the times Bitwarden logs you out of the account, or fails to use your biometrics in the browser because the app is no longer running in the background. Or the management UX of the app that's terrible. For us, these are little annoyances, but for my father it was the difference between usable and unusable. The individual plan is very cheap, but the family plan is costly. And you can self-host, sure, but it's expensive to self-host. When talking of self-hosting, people actually mean the alternative built from scratch in Rust (vaultwarden). Well, that project was never audited to my knowledge. Open source or not, it may have security vulnerabilities that could be exploited remotely, and I don't understand how people can trust it. Bitwarden also took VC investments. Which is fine, I guess they need to grow, but I'm longing for projects that are owned by sustainable businesses that don't need to grow. Why does everything need freaking VC investments? The problem being that startups that took such investments are not trustworthy to be around in another year from now, sorry. Although this is true of 1Password as well.

rcxdude 3y ago
AFAIK the vaultwarden is just easier to set up for self-hosting. You can self-host the same server bitwarden use, but it's a lot more effort (unless they have stopped developing this recently).
j1elo 3y ago
I'm a paying user because 1€/month is the perfect price for what I'd like a password manager to cost. But you're right and the flaws are there. Before, I used LastPass, and for me, the form field detection was miles ahead. Not a tiny bit, but _a lot_ better. And the UI built on the ephemeral pop-up was a very bad idea that after years and years they haven't decided to ditch and do it the proper way on a new tab, like LastPass, uBlock Origin, o TreeStyleTabs do.

tjrgergw 3y ago

I wish our industry would adopt the custom that to pitch your product you need to compare yourself to the best competitor, or no one will even look at you. There's only one thing I wanna hear from Bitwarden: What do you do that KeePassXC doesn't, and what are the trade-offs?

mikae1 3y ago
> What do you do that KeePassXC doesn't, and what are the trade-offs? Bitwarden offers free hosting for personal use. Also, consistently named apps (even for mobile).

geekrax 3y ago

Since nobody has mentioned: iOS 17 and macOS Sonoma brings family sharing to password managerm. Sonoma also brings support for using native passwordsl manager in Chrome using a chrome extension developed by Apple. For families who are hooked into Apple's ecosystem, this can provide a much better password management than third party tools.

jacooper 3y ago
Then your iCloud account gets banned and you lose everything.
- zshrc 3y ago
  Should’ve had better backups.
  - antgiant 3y ago
    You can’t backup the entire iCloud Keychain, only export to csv which doesn’t contain everything. (For instance passkey secrets)
cebert 3y ago
It’s a great way to get further locked into Apple’s ecosystem. Good luck if you ever need to move to an alternative platform.
- throwaway2990 3y ago
  Good luck ever having a better alternative platform to move to.
  - jacooper 3y ago
    Oh there are so many. Especially ones better than MacOS.
- afavour 3y ago

polyrand 3y ago

I really like Bitwarden, but I found it buggy in terms of user experience, and I'm now considering switching. Some annoying bugs I've experienced: * Desktop app not focusing correctly when opening it * Browser extension asking to save password even if it's already there * Log-In suggestions not showing * Slow and laggy on iOS * Biometrics log-in breaks half of the times I try to use it I like the fact it's open-source, although that doesn't make it more secure, and I don't think I would like to self-host.

syntaxless 3y ago
If I create a new login on mobile it never syncs to the vault/desktop correctly. I have so many empty vault items that then sync back to mobile. Nothing seems to fix it.

gaborme 3y ago

I’m using KeePass since decades.

wmal 3y ago

The title is misleading. This is not fully "free and open-source". I'm actually puzzled by the licensing structure. Bitwarden server is dual-licensed [1] - part of it is licensed with AGPL (Open Source) - some features are licensed with a source available Bitwarden license Now, even the Open Source core requires you to register if you want to self host. This is to provide you with complementary services like security updates, push relay servers (?), and licensing checks. [2] Although not stated in the docs, I guess this also improves their telemetry data, as they suggest to never share the license keys between installations. I completely understand the need to use source available licenses instead of open source. What I don't understand is why to even license parts of your app as Open Source? The resulting product is not free. Neither as in beer, nor as in speech. Does anyone know good reasons for doing that? I'm asking seriously. I'd like to better understand how companies benefit by marketing their products as Open Source, even if they are barely open source. [1]: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.md https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.... [2]: https://bitwarden.com/help/hosting-faqs/#q-what-are-my-installation-id-and-installation-key-used-for https://bitwarden.com/help/hosting-faqs/#q-what-are-my-insta...

the_gipsy 3y ago
You said it yourself, marketing.
skjoldr 3y ago
"Commercial.Core and SSO integration: Code for certain new modules that are designed and developed for use by larger organizations and enterprise environments is released under the Bitwarden License, a "source available" license." The rest of Bitwarden is free both as in beer and as in speech. Dunno why you think otherwise. Vaultwarden exists, and Bitwarden clients are compatible with it.
- wmal 3y ago
  Thank you, and other people, for mentioning Vaultwarden. I’ll check that out. This is, however, a separate software package, coming from different people, so not related to my question. Bitwarden is not free as in speech, as it requires me to register with Bitwarden, Inc and get a license key to be able to self host. Also, then it uses some closed cloud services. As for the free as in beer - this is more nuanced, but I still think it is far from free. For individuals - hosting something that requires 2-4 GB of RAM [1] is definitely not free. For companies - hosting something that doesn’t include SSO is pointless. The Bitwarden source available license, that includes SSO, does not allow production use [2], and requires a paid subscription instead. BTW I completely understand the reasons to not open source everything. What I don’t understand is: why not use the source available Bitwarden license for the entire server codebase? [1]: https://bitwarden.com/help/install-on-premise-linux/ https://bitwarden.com/help/install-on-premise-linux/ [2]: https://github.com/bitwarden/server/blob/master/LICENSE_FAQ.md https://github.com/bitwarden/server/blob/master/LICENSE_FAQ....

blacklight 3y ago

I've been self-hosting it for years and I love it. I mean, being a MSSQL + .NET app it's quite an exotic beast in my self-hosting garden, but it definitely does its job without skipping a beat. I'm also happy to support them with a modest $10/month contribution - for that price you get a few extra perks on your instance, but most importantly for me you get to store OTP codes / support for MFA, so I don't have to use a separate app for that. I feel like it's important to keep financially supporting projects like these, even if we host them ourselves, even if we only get one or two extra perks for the extra bucks. External pressures towards enshittification are inversely proportional to profitability. If a company can make money out of a business model where 80% is free to self-host and 20% is additional subscribe-only stuff, then things can remain like they are. If it doesn't, then we're all going to lose also the remaining 80%.

BrunoBernardino 3y ago

I'm surprised no one's mentioned Padloc [1] yet. It's end-to-end encrypted, open source, easy to self host, and with a really UI + UX. I got all my family to use it and used it for a over a year, before eventually contributing actively to it. There's even a Tauri-based desktop app! Full disclosure: I have "contributing power" but do not make money from its sales or anything like it. [1]: https://padloc.app https://padloc.app

xd1936 3y ago
"This app isn't available for your device because it was made for an older version of Android". Cannot install. —Google Play on an Android 13 Pixel 7. That and the star rating are not confidence inspiring.
- BrunoBernardino 3y ago
  Sorry, I install from the APK directly, available in the GitHub repo. I see someone already created an issue for it at https://github.com/padloc/padloc/issues/725 https://github.com/padloc/padloc/issues/725 so thanks for bringing it up!
haizhung 3y ago
Does it have WiFi sync? Seems like all the big players are committed to removing that, and that’s like the one single thing I want from a password manager: don’t store all my passwords in the cloud.
- neandrake 3y ago
  Check out CodeBook, it’s not open source but it’s a 1-time fee for device type (windows, Mac, iPhone, android), up to five installs. I’ve purchased for phone, MacBook, and windows pc and been using for the past 5+ years and am satisfied with it. The product itself isn’t open source but the company which makes it does develop an open source module/extension of SQLite for encrypted database. All syncing is manually done, across Wi-Fi or it can use Dropbox or google drive. https://www.zetetic.net/codebook/ https://www.zetetic.net/codebook/

monlockandkey 3y ago

I don't agree with the self hosted Bitwarden philosophy. Having a "server" to manage passwords is overkill for most people. The best is to use an encrypted keepass file stored on your cloud storage (Google drive, Dropbox etc). It is portable and easy to access from anywhere ( don't need to VPN to your local network). Not a fan of the self hosted server password management model. Doesn't make any sense unless managing multiple users.

2rsf 3y ago
I agree with the first part of your statement, but how do you access an encrypted keepass file from mobiles?
- debo_ 3y ago
  There are mobile apps for keepass e.g. KeypassDroid https://play.google.com/store/apps/details?id=com.android.keepass https://play.google.com/store/apps/details?id=com.android.ke...
- monlockandkey 3y ago
  https://keeweb.info/ https://keeweb.info/

Aerbil313 3y ago

I have no passwords. Don't get me wrong, I don't use a password manager either. Not a single one of them is truly portable, safe or secure. What if you lose all your electronics? All your belongings? Your house burns down in a fire? The cloud gets hacked? You have conflicting interests with US government and they kindly request your passwords from Apple? You have conflicting interests with any other country and they find and use the backdoors installed in US companies by US agencies? I use an algorithmic password which is: * Trivial to run in my head (I got used to it) * Compliant with all silly password character requirements * Has password rotation built in for apps/websites which require you to change your password every X monts * Has a shorter version for apps/websites which have a password length limit of 20 chars * Has a third easier-to-spell version for passwords I need to share with family and friends * Completely ASCII * Impossible to tell with bare eyes it's the password for amazon.com from the resulting password. It looks like randomly generated gibberish. * Leaves the Caps Lock off (so that you won't try again and fail again when you fail once and the Caps Lock is on) I only have an algorithm in my head. The downsides? It's a bit more slower to enter a password if I haven't entered it in a while. Still doesn't take more than 30 secs. And it can only be brute forced in a million years instead of a billion. And yes, you need these features in your algorithmic password. It took me about a year of trial and error to get to this point.

ishtanbul 3y ago
Can you please explain this more?
- Aerbil313 3y ago
  I cannot disclose the algorithm. What feature do you want explained?
  - nashashmi 3y ago
    How do you solve for password expiration and prohibited reuse?
    - 3y ago

nichtverstehen 3y ago

I use and pay for Bitwarden. I want it to succeed, but I still find it weird. 1. Security. Bitwarden's documentation on its security model is quite thin. 1password has a great write-up about how it works in detail: https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p.... Corresponding doc for Bitwarden is much lighter on detail: https://bitwarden.com/help/bitwarden-security-white-paper/ https://bitwarden.com/help/bitwarden-security-white-paper/. The security audits they list of https://bitwarden.com/help/is-bitwarden-audited/ https://bitwarden.com/help/is-bitwarden-audited/ are focused on the client software implementation bits, and make no judgement on the overall security model. My main concern is that the password is the only key that is needed to both log into the server and to decrypt the vault. There is no additional key that is completely offline, like 1password Secret Key (that is presumably stored in Keychain / Secure Enclave at rest). A password seems somewhat more easily stealable (with keyloggers or clipboard loggers etc). I am not a security expert, but I know enough to be concerned :). I wish there was more discussion on the implications of this difference on security models. 2. Offline access. Bitwarden does not like to work offline. You can unlock and view the vault, but you cannot make any changes without active connection to the internet! And Bitwarden will show you a very generic error ("failed to fetch") if you try editing while offline, it won't give you any suggestion on what to do. Moreover, apparently they will delete the local copy of the vault if internet connection is missing for 30 days: https://www.reddit.com/r/Bitwarden/comments/vtaqi0/comment/if7cigx/ https://www.reddit.com/r/Bitwarden/comments/vtaqi0/comment/i.... That's just nuts if true. I should not rely on the Cloud to have access to the vault as stored locally as long as I have the password. While there is a general fear about trusting The Cloud as the source of truth for accessing the passwords, this caused very tangible practical issues. I have actually run into needing Bitwarden while on the go. Also the CloudFlare IP that Bitwarden uses was somehow blocked by my provider for some time, and that broke Bitwarden completely (both the provider and Bitwarden neglected to do anything about the problem when contacted). 3. UX. You get used to it, but it's simply not great. Worst of all, the UI of the browser extension is prone to data loss. The Bitwarden popup resets the state every time it is unfocused. So imagine the scenario: * I start creating a new entry and generate a password. * I briefly dismiss the Bitwarden popup to paste the password into the website. * I open Bitward popup again hoping to finish entering the data and save. But the entry is gone. I just need to hope that the generated password is still on the clipboard. 1password in contrast keeps full UI state and partially entered data even if the vault is locked in the interim.

activitypea 3y ago

I try to use open-source wherever I can, but Bitwarden's UX just can't compete with 1Password or even LastPass. The Firefox extension in particular is pretty wonky.

carstenhag 3y ago
Agree. MacOS app is bad. Chrome extension bad. I use it at work and for that it's fine, I barely have to use it.

newscracker 3y ago

I’ve been using Bitwarden more as a backup since it lags in more ways than one. With iOS 17 bringing password sharing, I may be able to rely on that and switch to KeePass (and its derivatives) as a cross platform backup where needed. Products like 1Password and Dropbox first made a good consumer product before pivoting to enterprise and making the products worse. Even before the VC funding of $100 million, Bitwarden started pivoting to cater to enterprise features and neglected the consumer side. This has resulted in Bitwarden doing a minimum set of things in a very mediocre way. Its desktop clients are based on Electron and suffer with the common issues related to that (don’t behave like native apps for keyboard shortcuts or navigation, sluggish, etc.). Its mobile app, at least on iOS, is also sluggish and has poor UX. People have asked for additional predefined item types (like WiFi passwords, software licenses, etc.) and that’s been on the roadmap for more than five and a half years [1] with no timeframe for release in sight. It just recently changed the timeframe for this from the first half of 2023 back to “Under Research”. [2] In all likelihood, it’ll be six and a half to seven years by the time that’s done, if at all. One positive about Bitwarden is that its free tier offers something that’s somewhat good (ProtonPass is nowhere close to this as of yet). But I don’t see anything in the password management market that’s cheap enough (like Bitwarden’s personal plan), has good features (including browser extensions) and stability, and is managed by courteous and helpful people (1Password fails on some of these). [1]: https://community.bitwarden.com/t/additional-item-types-pre-defined/228 https://community.bitwarden.com/t/additional-item-types-pre-... [2]: https://community.bitwarden.com/t/bitwarden-roadmap/12865 https://community.bitwarden.com/t/bitwarden-roadmap/12865

luczsoma 3y ago

1Password is miles ahead. Its UX is WAY better, as is its cryptography architecture and its security whitepaper (https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p...). Bitwarden doesn’t even come close.

alt227 3y ago
Unfortunately 1Password doesnt have the main feature that most of us are probably using bitwarden for, self hosting. EDIT: I have just noticed this. Everyone whos interest should submit! https://survey.1password.com/self-host/ https://survey.1password.com/self-host/
- throwawaaarrgh 3y ago
  and 1Password doesn't work from behind corp proxies with custom traffic inspection certs
  - somehnguy 3y ago
    It does fine here
  - kstrauser 3y ago
    We added a steering exception to our Netskope setup for 1Password. All the traffic going there is encrypted twice anyway, once by the app and again my TLS, so inspection doesn’t show you anything interesting.
- belthesar 3y ago
  Ironically, I tried to fill out that form, and I receive a 429 when trying to submit. I guess they aren't going to get a lot of requests to make this product a reality if they can't get feedback that folks want it.
throwaway2990 3y ago
No. The user experience of 1Password is just frustrating. I use it daily for work and don’t like it. I’ve used it longer than I’ve used bitwarden.

Subdivide8452 3y ago

I’m relatively new to this site. Why is this post popular? For me it links to the Bitwarden front page.

notnef 3y ago
afaik this site is for showing interesting things and discussing them. this post is to show the bitwarden password manager, nothing more to it.
- Subdivide8452 3y ago
  OK, thank you :)

nathell 3y ago

I’ve been a happy user of Pass (https://www.passwordstore.org/ https://www.passwordstore.org/) for a few years now. Can’t see it being monetized any time soon, which is a Good Thing. So is its strict adherence to the Unix philosophy.

BanazirGalbasi 3y ago
I really wanted to try switching to pass, but I use my password manager on my phone too much, and I dual-boot on my desktop besides. WSL solves the desktop issue, but I'm not sure what the best option is for syncing Linux, Windows, and an Android phone. Heck, I don't even know how `pass` stores the db so I don't know if it can be synced. Got any insight there?
- severus_snape 3y ago
  There is no "database", it's just a bunch of GPG encrypted files synced with git. (Their default location is ~/.password-store.) For Android there is https://github.com/android-password-store/Android-Password-Store https://github.com/android-password-store/Android-Password-S.... The only Windows client listed at https://www.passwordstore.org/#other https://www.passwordstore.org/#other is unmaintained.

imchillyb 3y ago

I /vastly/ prefer Dashlane password manager. The $60 per year fee keeps the VC money at bay. I’m the customer, not my data. Dashlane, it’s well worth the price for my piece of mind and the security of my passwords.

debo_ 3y ago

I was about to try this out a while ago, but I installed Syncthing on my machines at around the same time. Keepass db + syncthing works astonishingly well, and the Android keepass client works great for me. I prefer the simplicity of this setup to yet another web service, especially if I'm going to self-host.

wurstehans 3y ago

I'm using Apass and am happy with it https://github.com/balu-/a-pass#readme https://github.com/balu-/a-pass#readme

neilsimp1 3y ago

Is there a desktop client for Bitwarden that isn't Electron-based yet? I tried this years ago and didn't like it. Not only because Electron, but I thought it was missing a lot of basic features (folders/organizing passwords was sorely lacking). I'm not looking to try it again, to be clear, just curious. KeepassXC won my heart.

jjice 3y ago
Depends on if you count a command line tool as a desktop client or not [0]. I personally just use the browser extension instead of the desktop client (the GUI one) since it was a bit slow and the extension is fine. [0] https://bitwarden.com/help/cli/ https://bitwarden.com/help/cli/

stormed 3y ago

For anyone that's interested in self-hosting Bitwarden on your server, I would highly recommend checking out the Rust implementation, Vaultwarden. It takes less resources to run, doesn't paywall certain features (I.E MFA logins), and (in my experience) has been a lot easier to work with compared to the official client. https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden

jjice 3y ago

Huh, more negative than I expected. For some reason I had Bitwarden as an HN darling in my head. Not sure where I got that from. I pay for premium for $10 a year. Not sure what I actually take advantage of with that honestly but I just really like the product. That said, it's not based on a lot of competition searching. Am I missing out on some big benefits in other managers?

StevePerkins 3y ago
Really surprised by this as well. So many comments are of the generic nature, "<COMPETING PRODUCT> is miles ahead", without any specifics on what that's supposed to mean. My last few employers have used LastPass and 1Password, while I use Bitwarden for my personal stuff, and I prefer the latter by far. The browser plugin is more reliable about recognizing when I'm entering or updating a password, and offering to store or update it. The iOS version has smoother integration with password autocomplete in other native apps. It MAY be that Bitwarden lags behind in "team" sharing features, I don't know. For personal use, that class of use cases is irrelevant to me. As near as I can tell, there seems to be a lot of HN rage that "most" of Bitwarden is open source, but there are still some proprietary bits that keep it from 100%. I never understand this mentality, that software should fall from the sky like manna from heaven and not support a business. I also don't understand why these resentments never seem to stick to products like VS Code, that are the exact same way. Maybe Bitwarden should just try a sexier-looking dark mode UI?
- nativeit 3y ago
  I’m with you on this. I tried every popular option a few years ago and found all of them to be rather atrocious, but settled on self-hosting VW, and found its mobile integration (using BW clients/apps) to be as close to native as anything, and its 2FA (for TOTP anyway) is superb. Nothing else thus far allows me to launch a website or app and login with 2FA faster than Bitwarden. I operate under the assumption that everything has a weak spot, at least Vaultwarden isn’t hiding the source code and if BW’s VC backers dictate some kind of rule-breaking change to the service, it won’t affect my data and forks/OSS alternatives will be easily readied to interface with it.
3y ago

AbraKdabra 3y ago

You should use Vaultwarden if you need self-hosting it https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden.

running101 3y ago

1. keypassxc + keypassxc browser plugin on google drive 2. on iphone strongbox using shared db on google drive The syncing works fairly well.

darrmit 3y ago

Bitwarden is not perfect, but calling `pass` "easy" is comical - especially for those of us sharing passwords with far less technical family members - and 1Password has a very opinionated UI that seems to get more in the way than anything. I find Bitwarden to strike a good balance between security, price, and design. That said, I do share in the concern about the funding and exec changes.

tamimio 3y ago

Bitwarden is great, KeepassXC is even better.

hestefisk 3y ago

Happy user for two years and going strong.

xnasero 3y ago

I want to like bitwarden but 1 year subscription ended without notification. Then they disabled 2FA a no go. Now I use KeepassXC better to have full control over sensitive data

ZuLuuuuuu 3y ago

Do any companies use Bitwarden? Are they satisfied with it? We tried using Keepass but people were resistant to using it. The UI is not very user-friendly for non-technical people. Keepass also lacks some of the features we would like to have, for example: We would like to push a new user/password to a person's vault (for example let's say IT creates a printer account for a person, we would like to put the account information to the relevant person's vault), or we would like to share a common password among a group of people. But I am not sure if Bitwarden is a good choice in practice for this kind of things.

ryanmcbride 3y ago

I've been using bitwarden for years and I love it

amq 3y ago

I'm still looking for a product that offers a completely passwordless SSO and has a good and simple UI (keeweb, anyone?) Unfortunately, Bitwarden fails at both.

sufficient 3y ago
You can try https://www.heylogin.com https://www.heylogin.com if you are looking for a new approach without a Master Password. I am one of the founders.

walteweiss 3y ago

Oh, how much I enjoy those infinite discussions about password management software, looking from my pass¹ side. I cannot imagine migrating from pass anywhere, I have almost a thousand of entries there (my and my family’s plus some friends). The funniest part those discussion well never cease to appear. And they are so much alike, again and again! [1] — https://www.passwordstore.org/ https://www.passwordstore.org/

walteweiss 3y ago
To anyone wondering whether I would recommend pass for family and non-techy friends. No, I wouldn’t. I just recommend them to use whatever is built into their smartphones (usually Apple’s or Google’s). Those integrated tools are plenty for their 15 entries. And I may back up the crucial ones to my pass vault, just in case of a smartphone loss or anything that may never happen, just to keep my peace of mind. That works for me and my close ones quite well.

holyrood 3y ago

Am I stupid for feeling that Google Chrome and my iPhone keychain is all the password management I need? What am I missing out on with solutions like Bitwarden or 1Password?

ValentineC 3y ago

This is incredibly superficial, but I wish Bitwarden used the system font stack for its apps instead of forcing Open Sans on everyone. I found that it helped make Bitwarden slightly nicer to use for me and some others I provided a one-time fork of the Mac app to try. If I could figure out how to sign and ship Mac and iOS apps, I'd ship a fork that continually pulled from upstream, with just the two `variables.scss` files patched.

sigunder 3y ago

[flagged]

mikestaub 3y ago

I'm just waiting from Proton to stabilize theirs then I'll switch.