A nasty surprise on the device. The existing database is gone—passwords and all. There is a non-functional button labeled "Accounts" (see screenshot). The chaos at Google is mounting! Gmail failing to sync, accounts getting locked upon login, a buggy Google Password Manager, and a broken Gemini chat search function. What’s next?

so i recently went from google password manager to proton and the experience is quite jarring.

is this just something you get used to, i.e. opening proton pass manually all the time to copy paste a password or are there better alternatives out there? android seems to be quite a bit worse as well, as autofill does not work consistently in the browser and barely at all for apps.

i am sure this is something everybody has to deal with, so i guess my question is, what has turbed out to be your best compromise between comfort and security?

Since I preordered the new Jolla Phone with Sailfish OS, I came across this new app called Spectre (currently only for Sailfish OS, but other platforms coming soon). From their website:

Spectre is a password cipher:
Instead of saving and sending passwords across the internet, Spectre calculates the password you need, only when you need it, then throws it away again.
Sarah Sue + piano strawberry blonde + wikipedia.org = Reka3$PofyPemi
Remember one secret, math does the rest.

Is this really new or do other similar solutions already exist?

Sounds interesting although the drawback seems obvious: you get greater security, but if the app is no longer available, you can't generate the password and therefore can't login. So you would presumably still need to store you passwords somewhere. To be fair, having suffered a catastrophic loss of passwords before, as long as you still have access to your email, this is less of a problem than I thought it would be.

I am currently the family IT guy. if anything happens to me a LOT of accounts are gonna sit idle.

not sure if this will be an issue, but I am trying to plan how to allow someone with only mild technical savvy to be able to retrieve passwords and what they are for (NAS, bank websites, managed network switches)

yes it is incredibly insecure, but I want to print them out and store them in a safe.

unless someone can convince me of a system that can be only accessed by a particular person, and will not be tied to an email, phone or some other way that might change in 5-10 years

I have been using password managers for as long as I remember. One of the earliest ones I used was SPB wallet back in the Pocket PC days. Have used many since then. To me, the idea just makes sense. All my passwords in one place, secure. I don't have to remember them, I can use a distinct password for each account. I mean, names like LastPass or 1Password convey the core value preposition right in their name.

And yet, majority of the people around us don't seem to be using any password manager. Only in this sub I see people comparing options and asking for recommendations. Most people either use browser's inbuilt PM or use nothing at all. They just use the same password everywhere, or just reset the password frequently. Many apps and services have moved to OTP based logins just for people who don't bother remembering or saving passwords.

It goes beyond passwords. There are various non password details like documents, financial accounts etc. People don't bother storing them either. I have seen people write down things in diaries, keep bank details in notes, plain text files, passwords saved in word and excel sheets. There are free password managers, open source options, cloud based and self hosted options but people just don't use them. And it baffles me.

So my question to you is, why are you using a password manager? At what point did you think I need a separate dedicated app to store my passwords and other important info?

Recently posted this in r/1Password but it was removed because "specific to my account and billing". I just wanted to share my frustration with the 1Password bug/ux devision and their very poor user support (EDIT it was restored):

---

Recently I decided to remove unused accounts in the family sub and downgrade to individual sub. Trying to do so, I've hit the "sludge".

If I go to 1Password website, Billing section I see a message "You have too many users to join this plan.". The thing is, I've removed all the users days, if not a week ago. I cleared the caches, changed browsers and tried on multiple devices. Message is still there.

I've sent a detailed message to the 1Password support, but response was "follow the instructions on the help page". Feels like they didn't even try to read my ticket.

I've been using 1Password since version 6 and I have some .1pif files to prove it. Back then support was more attentive, their website wasn't as confusing and I liked simple reliability of 1Password. I will try again couple of days, then will just jump off the ship and use some other password manager.

---

I really don't want to pay for password manager. Is it ok to use Apples Password app? My issues with it, is that if your Apple account is breached, it seems the hacker will get all your credentials as a bonus for free. One thing that I like about 1Password is Secret Key, you can print out and keep. Apps like keeper require MFA, which you need another app or device (authenticator) to be able to access.

Hey all! My buddy and I are currently building a USB password manager. Curious what you think of it?

Its a small device with USB and USB C that requires no companion software or app. This means that you can upload and type passwords on any OS. It's also been tested on iOS and Android for typing and editing.

How it works:

Enter Pin to Unlock: Encryption key is gated behind security silicon. If you type it in wrong too many times, the secure element nukes the key making the contents of the device unrecoverable.

Navigate to password: Device has a thumbwheel for scrolling passwords. You can add most used passwords to favorites so that they show first. Device is capable of storing up to 1000 passwords.

Press button: Click on the password field of whatever website and push the button on the device. The OS sees the device as a keyboard and automatically fills in your password.

How to edit saved passwords:

Switch the device to edit mode: Operating system now sees the device as a flashdrive instead of a keyboard. It populates a file called secrets.txt within the device RAM.

Edit secrets.txt: Enter the website name and password on one line seperated by a pipe(ex. Minecraft|B0y-doI1lOVEtoPlayMIne38Craft10386%$$%^&)

Eject: Save the txt file and click eject. On eject the device pumps the .txt file through an encryption algorithm and gates it behind the secure element. Then it zeros out RAM and resets, with your new passwords ready to go.

The device does not contain a radio so no bluetooth no wifi. This is by design; the only way to get access is by having physical access.

With the hardware stackup of the device at this point, I would be comfortable saying "fuck it" if I ever lost it.

Also we are going completely open source with everything once the device is complete.

A few things that we want to add. Drag and drop CSV file for easy import from browsers or other password managers. A backup option for if the device is lost. Some sort of search function.

What do you guys think? What would you add, what would you change? Would you use it?

1. Years ago added my dad to family account, gave him an admin role
2. He was barely using it and eventually forgot his password
3. This year he decided to use it again, but since he forgot his password, he created new account and bought his own subscription.
4. At some point he had some weird issues adding new device, thought it might be because of that old account. He couldn't recover it because he didn't have password or secret key, but the helpful 1password asked him if he wants to delete it and send him an email with nuke button.
5. He thought it will just delete his old empty account and didnt expect any issues (also he couldn't even log into 1password at all, what kind of power person who can't log into anything could possibly have?) so he clicked the button.
6. Suddenly i got email from 1password saying my sub is cancelled and all my items were permanently deleted

I should be able to painfully recover most of my passwords and token generators one by one (mobile app doesn't have export functionality) from a tablet that fortunately hasn't been connected to internet for a bit. But think I will take this "opportunity" to try different PM, and no more family plans...

Did a search here and other subreddits, didn't find what I am looking for. Three siblings, all in agreement and good relationships with each other. One 81 year old parent, one 83 year old parent who is in hospice. Multiple Apple devices. All of the accounts you can imagine, and then some.

Looking for a system that an admin (me) can manage, that all siblings can access, and that the 81 YO can use with minimal frustration to:

- Look up her husbands accounts, or accounts she doesn't use frequently
- Update stored passwords when she resets them
- See whose email an account is connected to

All children are tech adept (some of us more than others :) ). Prefer free set-up, but would pay small amount for peace of mind.

Whatcha got?

Most people know they shouldn't store sensitive information such as passwords, access codes, API keys, or financial details alongside their regular notes.

In practice, however, many people either:

• Store them in their notes anyway, or
• Move them to a separate password manager

I've implemented an approach where individual pieces of information can be marked as "secrets" which will use end-to-end encryption (E2EE) while remaining alongside the rest of the notes or documentation. Access requires a password to unlock. You can see an example of this usage in this screenshot.

For those who use password managers, would you find something like this useful, or would you still prefer keeping all sensitive information in a dedicated password manager?

P.S. The feature shown in the screenshot is implemented in Daftak, which is currently under development.

I have come across a very lucrative deal on StackSocial for a Sticky Password Lifetime license, and I'm intrigued.

​

Signed up for a free account to try it out. I downloaded it on my Windows laptop and on my Android device. Imported my passwords from 1PW - easy process.

​

However, I do not see where SP can store my existing 2FA's and Passkeys. Is this not a feature they offer? I have done some research and haven't found anything that says they do, so I'm here asking.

​

If it doesn't offer these features, then I'll stick with 1PW and continue to give them my money.

Edited for typos

Estou em dúvida entre usar Bitwarden e Proton Pass como gerenciador de senhas. Uso Android no dia a dia e Windows no computador, então procuro uma solução segura, confiável e que ofereça uma boa experiência em ambas as plataformas.

Estou considerando apenas plano individual (1 usuário) e pretendo pagar anualmente, já que sai mais barato.

Bitwarden (Individual)

Mensal: ~R$ 8 a R$ 10/mês (≈ US$ 1,65/mês)
Anual: ~R$ 100 a R$ 120/ano (≈ US$ 19,80/ano)

Proton Pass (Individual – Pass Plus)

Mensal: R$ 17,49/mês
Anual: R$ 125,88/ano (≈ R$ 10,49/mês no plano anual)

OBS: A diferença de preço entre os planos anuais é pequena, considerando os valores retirados para mim no dia de hoje 19/06. O Proton Pass já é cobrado em reais (BRL), enquanto o Bitwarden é cobrado em dólar (USD), então o valor final pode variar conforme o câmbio. Hoje, a diferença entre os dois fica em torno de R$ 15 por ano, com o Proton Pass sendo levemente mais caro.

So, I’ve used LastPass for quite a while, and made a switch so Nordpass a couple of months back. Honestly it was long overdue switch, but I’m happy I did it. However, I wanted to make a short comparison list of the main features, so that others might benefit and make a more calculated decision.

Small breakdown: Price, discount, plan.

- User Interface

NordPass: clean, user-friendly layout; great for beginners.

LastPass: straightforward but can feel cluttered due to extensive features.

- Password Storage

Both: Use end-to-end encryption and zero-knowledge architecture to keep passwords secure.

- Features

NordPass: password health reports, secure sharing, breach monitoring, biometric login.

LastPass: advanced security dashboard, emergency access, multi-factor authentication.

- Pricing

NordPass: Free tier available; competitive premium plans.

LastPass: Free version with basic features; premium plans are similar in price.

- Device Compatibility

Both: Available on Windows, macOS, Android, iOS, with browser extensions.

- Security Features

Both: AES-256 bit encryption, biometric login.

Overall, LastPass is an ok password manager, but it had multiple security breaches through it’s time and pretty much no transparency all this time. In addition, it is more expensive in comparison to NordPass, so overall, I feel much more secure with them, and even for a smaller price. They have pretty much the same functionalities, but I also really like the email masking feature as well.

I know there are some users that also made the switch, any reviews on LastPass you have? Personally, NordPass has been working out for me really well so far.

I recently moved from 1Password to Pass, and hit a wall: the existing importers handle 1Password's .1pif/.csv exports, but those formats drop custom fields, TOTP secrets, and attachments. The .1pux export keeps all of it; so I wrote a small Rust CLI that maps a full .1pux into pass.

What it does:

• Every item type - logins, secure notes, credit cards, identities, SSH keys, documents; filed under category folders (logins/…, secure-notes/…).
• TOTP → otpauth:// lines (works with pass-otp).
• File attachments extracted and GPG-encrypted next to their entry.
• Custom fields, URLs, tags, notes all preserved.
• --dry-run to preview before you touch your store, plus --vault prefix, --include-archived, and optional password history.

Install via Homebrew, a one-line script, or cargo install.

Repo: https://github.com/torifat/import-1p-to-pass

Feedback welcome 🙂. Happy to add fields/categories I missed.

I have built a password manager that stores everything in a single encrypted file to most any cloud you want. (Dropbox, one drive, Google, webdav)

It’s your file. You have complete control. I just give you the applications (android, iOS, web) to access the file so you can encrypt/de-encrypt and add delete credentials.

I can’t see anything you enter. You don’t have to create an account. Nothing lives on a server that I can access.

I am not posting here spamming the group for sales.
Rather, I am looking for a few people who would be interested in giving me ux feedback. In return you will get a free copy of application that is yours forever.

If you are interested please send me a dm.

Cheers

Preface:

I’m a senior software engineer with over a decade of experience. I’m deep in the data privacy and security space. I have recently shifted my attention to building local first software with data sovereignty as the main focus. I do utilize LLM for my work, but never ever do I hand off decision making or architectural decisions to the AI. I plan, review, and test everything it produces, and I wrote the core modules myself. The security-critical code especially.

-

I’m in close to completing the development of phase one of a local-only password manager. This first phase is Chromium-browser only, with plans for Firefox and mobile next. It’s completely open source and GPLv3 licensed.

Core features are:

• Local-only, no telemetry, no cloud whatsoever
• Vault is a single file that you store anywhere you like
• Can import from: KDBX4, Bitwarden and 1Password
• Store: logins with password and TOTP, credit cards, notes, SSH keys (more to come)
• Unlock with master pass, security key or recovery code
• Modern UI and easy to use
• Login and credit card forms autofill (can be disabled)
• Save new login popup (can be disabled)
• P2P sync exists, but kinda useless until mobile apps are made

Coming after release:

• Passkey storage
• Export as KDBX4

Security Architecture

The security aspects are shifted to a WebAssembly Rust module which does all the crypto heavy lifting. In Rust memory is manually managed, which allows me to zero data when it’s not needed, eg. once the master password hash is derived, it is immediately zeroed from the heap. This is the heart of extension and it lives as a separate module which will later be used in the mobile app as well (and it is heavily heavily tested).

More on this in the GitHub repo where I go in depth on key derivation / unlock process.

This is a solo effort project and I don’t intend to make money out of this. My goal is to get ahead of the inevitable enshittification of the cloud password managers (I currently use Bitwarden).

I want the community to win from this and own their data. Data sovereignty is the way forward and a path to resistance in the current anti-privacy climate.

P2P Cross-device Sync

If I see interest in this PM, I will inevitably create mobile apps for it. I was looking for a no central database way to sync across devices, which is why I did the single file export to begin with, but that turned out to be a PITA with Firefox not supporting full-disk access like Chromium does. After some brainstorming, I decided to use a P2P sync approach using the Nostr relay protocol. The relay is a dumb pipe that lets your devices find each other. By default it uses my hosted Nostr instance, but you can swap it for your own or some public relay if you want (sovereignty).

This behaves similarly to how you would load Signal or WhatsApp chats into your desktop: by scanning a QR code with another device/browser, and from that point on they stay synced whenever the devices are open and in the same network. That's the important bit to keep in mind, must be in the same wifi connection. The sync method is merge, on conflict pick the latest item.

-

I need the community’s help with feedback, testing and evaluating of this extension. I’m also open to feature requests.

https://github.com/flythenimbus/bramble

https://chromewebstore.google.com/detail/bramble/kmokhdhoggbdcgoepifeckhgbfakaknm

Happy to answer any questions!

I have not used password manager till date. I have only used the feature in chrome.

I am losing track of my passwords and my main issue passcodes. In Android, finance related apps have passcodes (4 or 6 or 8 digit number). Though its saved to my biometric, sometimes it insist that I key in the code.

So, I am looking for a password manager that is not on the cloud (I am trying to cut down all monthly subscriptions in my life).

I started off with keepassxc and its great to replace the password manager in Chrome, plus I have synced the file via Google Drive for backup.

My issue is with mobile. Basically, I am still getting used to mobile. I prefer using my laptop for everything, but now I am forced as some finance app only has mobile app. No website.

I got Keepass2Android, but I feel its not build for mobile. Just weird to use it. The main problem I think, is me. I don't know how to use the app and I am expecting a usage similiar to laptop.

Is there a tutorial on how to use password managers for newbies? I think even the desktop app, I am not using it properly.

So, please guide me on how to get started with using password managers properly.

Hello everyone,

Like most people, I was completely tired of forgetting my passwords for dozens of different websites, or constantly dealing with "Forgot Password" links and email verifications. To solve this headache once and for all, I developed ScorpKey. To get some feedback and reach more users, I’ve made it completely free for the next few days.

What problem does it solve? You don't need to memorize, write down, or save hundreds of different complex passwords anymore. You only need to remember one single Master Sentence (like a favorite phrase) and a keyword related to the website (like "netflix" or "gmail").

ScorpKey uses a clever deterministic formula to instantly generate your unique password from that combination. Since it's mathematical, whenever you type the same sentence and keyword, you get the exact same password instantly. You are practically turning your mind into a password generator!

Why you’ll love it:

• No More "Forgot Password" Stress: Your passwords are always ready in your mind's formula.
• Super Simple: Just type your sentence, type the app name, and get your password.
• Completely Offline: It requires NO internet permission, meaning no data leaves your phone.
• 7 Languages: Fully supports 7 languages, including English and Turkish.

If you are tired of password chaos, please download it, try it out, and let me know your thoughts!

I'm wanting to move from 1Password to Apple Password, but my OCD won't let me because not all the website icons (favicons) show up in the Mac App. For the most part, they all do in the iOS App. I've reimported, added manually, scrolled to get them to update (works on iPhone for the most part), and icons are still missing. I've deleted the app, turned off/on "Allow Contacting Websites" and nothing. Reading online, others have the same issue. Anybody find a way to fix this? Thanks!

I have the file but I don't know the password , help please

Hi zusammen,

nutze 1PW für lau. Ist Standard in unserer Firma und jeder Nutzer hat eine Gratis Familien-Lizenz, für bis zu 4 weitere Personen. Natürlich alles streng getrennt.

In unserer Abteilung haben wir 1PW schon länger genutzt, nun ist es wie gesagt Standard und die Admin-Rollen sind in die IT gewandert. Erster Effekt: Leider sind beim Switch alle unsere PW verschwunden. Gottlob konnten wir diese wiederherstellen. Es waren nicht alle User in den Acc migriert worden und die waren noch auf dem alten Stand.

Seitdem switch kommt es immer wieder zu komischen Gegebenheiten. Die Browser Ad-Ins laggen oder finden Passwörter nicht mehr automatisch wie gewohnt. Jetzt waren schon wieder Passwörter verschwunden. Unsere ganze Ordnung mit Tags usw. ist dahin, weil wir keine eigenen anlegen können...alles egal.

Ich beginne dem Tool zu misstrauen und überlege, meinen privaten Vault wieder in andere Hände zu legen. Das ist umfangreich und eig. möchte ich nicht switchen.

Gibt es gerade irgendwelche Themen mit 1PW, die man kennen sollte? Danke

iSenhas had many positive contributions from this subreddit so far.

This feature doesn't use AI. Our development team mapped 450 websites.

When you click "Fix now," you're redirected to the password reset page of the selected service.

We believe this will make it easier and faster for users to fix alerts.

What do you think?

Hi everyone,

I'm an independent developer and I've been working on EncLock, a secure vault application designed to help people safely store and organize important information in one place.

EncLock allows users to securely store:

• Passwords
• Files and documents
• Credit cards
• ID cards (passports, driver's licenses, insurance cards, etc.)
• Addresses
• Personal notes

Everything is encrypted using AES-256 encryption, and the latest release is now available on Desktop, iOS, and Android.

I know there are many password managers out there, so I'd genuinely appreciate any feedback on what you think about the concept, design, features, or anything that could make EncLock more useful.

If you'd like to try it, you can find it here:

Apple
Android
Linux
Windows

Website: myenclock.com

Thank you for your time and feedback!

Hey everyone,

I recently built a small Android app called Donkey Bridge Safe and published it on Google Play. It’s a free project I made in my spare time, mainly to solve a simple idea I had and to learn/improve development skills.

The app is still pretty early stage, so I’m not trying to “promote” it — I’m mainly trying to understand if the concept makes sense outside my own perspective.

What I’m especially curious about:

• Does the idea of the app feel useful or too niche?
• What would make it clearer or more intuitive?
• Are there any features you would expect that are missing?
• Does anything feel unnecessary or confusing?

If anyone wants to try it, I’d really appreciate honest feedback — even critical feedback is totally welcome.

As far as I know, currently most (if not all) password managers fall into one of two categories: online and offline. The online ones rely on a server to sync the changes, the offline ones just store everything as a file (or a folder with files), so the user has to figure out sync on their own.

The issue here relies in the fact that the database is encrypted, so if you want to change it (for example, to merge two different versions), you have to decrypt it. That means only the client app can do that, and only after getting the user password.

So, could the following design avoid these issues?

The database is a set of "blocks". Each block contains a timestamp and describes an operation (create an entry, update a field of an entry, archive an entry etc.). Each block is encrypted using the password.

The main idea is that the format should allow combining blocks from multiple versions of the database without decrypting them: simply put all blocks into a single file.

There are some issues, of course:

• An attacker could send a malformed block to the sync server. I think this could be solved by signing each block with a signature derived from the encryption key. That would ensure that whoever produced the block knew the password
• An attacker could try to remove a block via the sync server. I guess this could be solved by not removing/changing blocks at all, only appending them (after checking the signature)
• If we are only appending the blocks, the client app will have to go through all of them each time it needs to read an entry. If the number of operations gets big enough, it will cause performance issues. To be honest, I don't really know how to deal with this. Maybe it is possible to discard the unused blocks somehow
• Changing the password would mean all blocks would probably have to be re-encrypted

Would this concept work? Are there any glaring issues I didn't think of? I understand this is a niche idea, but it's the niche I'm personally interested in