There’s no guarantee anything is “secure,” anymore. Even if you run a self-hosted password manager, it could still be compromised at the package-level or down the road through some exploit. I will say that since I started using Bitwarden as my main password manager, I have had to worry less about company data breaches and stolen passwords. I have no need to reuse passwords for any site or service. I can use the built-in 2FA with sites that require it and don’t have to have multiple apps. I can share passwords with my wife if she needs to access something under my name.

In addition to storing logins, I can store secure notes, even storing login-specific notes within the login details for things like one-time-use passwords, etc. I can store various credit/debit cards and recall them into payment systems whenever I want, without storing them in a browser. When using the phone, I can tie the biometrics to the unlocking of my vault so, with the vault locked, I can easily unlock it to find the login/info I need to submit to an app or website.

Obviously, all this comes with their own risks, but the level of risk of a password management is far lower than the risk of reused passwords and the mismanagement of security at the corporate-level. If you’re really hard-up to keep your stuff offline, other products exist that are locally stored, but you’ll likely miss out on access from outside the home in the event you need that login info somewhere else.

Edit: I’ll also point out that the best passwords are ones that rely on unaffiliated words, with numbers or symbols sprinkled in. If I need to remember the password without my phone/outside help, I’ll rely on a password of 3-4 random words. Many of the password management tools available have some sort of password generation and Bitwarden’s can generate randomized character passwords or randomized word passwords. Once I find a word combo I like and can remember somewhat, I add a capital randomly, a number somewhere, and maybe even a symbol to make a password that would take million of years with current tech to decipher.

As always, you do you, but I find password management tools such as Bitwarden, with a minimal yearly price tag, worth it for the ease of password generation/storage and the ability to access those passwords wherever I need to.

Bitwarden and keepass are. Don’t use lastpass or the other bullshit youtube sponsors.

Can’t believe noone mentioned this yet:

Any good password manager encrypts and decrypts your password file client side. The server should not even have the ability to read your passwords.

Even in the case of a leak of all of the server’s data, as long as your password for the manager was good, you’ve got nothing to worry about.

I’d say pick a PW manager where both client and server are open source. Pick a strong passphrase. Enjoy.

I think they can be much more secure than:

• remembering your ( probably weak ) passwords

• writing passwords on paper, which is slow, you can lose paper, break it, or someone can steal it

• storing passwords in unencrypted text file

• reusing passwords/password!

I use KeepassXC, which is offline, encrypted password manager. Every password is stored in one file, which to access, I must enter the one password I do remember. I recommend having backups of this file.

It has password generator included, so all my password are long, strong and unique. It also can auto fill password/login which saves time.

To increase security of your account even further you should also use multiple factor authentication, for example app which generates one time codes on your phone offline. It will protect you, even if your password gets leaked, or cracked.

I like to keep all my eggs in one basket, that way you can really keep an eye on them.

I think your question has been answered by other pretty well but I’ll add: If you decide a password manager is overall beneficial and choose one that looks secure, don’t assume it will stay that way. LastPass taught us that a couple decisions that valid one day can turn into huge liabilities in a few years as threats escalate. You to have to periodically check in on what sevops pros are saying about your manager and make sure they haven’t been resting on their laurels. Security is a job we all have.

Yupp, just away from Lastpass. 🤮

Like the other commenter said - people recommend them for peace of mind so you don’t have to think about knowing a password for the 2653rd account you set up once and are never using again. It’s the next best thing to just remembering complex passwords.

I’ve used Dashlane for years, personally, but I know people here will immediately shut that down for not being FOSS. Bitwarden is FOSS but requires some technical setup and has no redundancy.

Don’t get me wrong, I love self-hosting as much as the rest of us but I’m not trusting my server from 2013 with all my passwords to everything.

It’s a balance of probabilities, like everything in security. Which is more likely? A. People are careful, using good, strong passwords, and maintain vigilance, but are targetted by an advanced attacker who will hack the protonpass system to get their database and the necessary keys to open it? Or B. People get lazy, use the same password for everything because remembering stuff is hard, and everything they own ends up protected by the modern equivalent of combo 1, 2, 3, 4, 5?

If you are truly capable of generating and memorizing enough good passwords to handle all of your accounts, that is technically more secure, because a password manager can create a single point of failure for all accounts. However, most people aren’t able to do that and will resort to crap passwords or using the same single crap password for every site.

The only big danger of a good password manager is the fact all your passwords are stored under one.

To mitigate the risk, follow these practices:

• Use a good trusted, much preferably open-source option (for example, Vaultwarden, KeePassXC);
• Use a strong password;
• Do not EVER use the same password you use for password manager elsewhere;
• Use 2FA on both your password manager itself and all the accounts you store passwords for;
• Backup your password database in an encrypted way.

Together, these measures should save you from any trouble.

Now, why they are good:

• They can generate and store very strong passwords you would never make up, much less remember;
• You can be sure you won’t forget your password;
• They are convenient and can auto-fill passwords for you.

Generally, using a password manager is considered a superior option in terms of security and availability compared to keeping your password elsewhere, including your head.

What makes you think they aren’t secure?

Most will tell you how the password is stored and assuming they implemented the encryption algorithm correctly it should be rather difficult to break the vault open.

Risk assessment is a big part of this. Risk when reusing passwords is very high. Risk of forgetting passwords or using weaker/guessable passwords when they’re unique, is high. Password manager mitigates these risks. A good one will also bark at you when you try to use a password in a website that isn’t the one you saved it in (ie phishing warning)

The risk of your PW manager somehow leaking passwords is worth considering. So we ask: How are the passwords stored? Where are they stored? How are they accessed? Different tools work differently; some keep the storage local but others sync in the cloud. Local storage can also mean “in my Dropbox folder”. If it’s a secure format with a strong password (or perhaps Yubikey), that’s fine, but if it’s an excel sheet, you’re leaking to Dropbox. But is that really a problem for you? Think of the steps between an adversary and your password file.

1Password has some white papers published about how they secure the data you entrust them with.

It is my strong opinion, and that of most security experts, that using a password manager to create unique, long, and secure passwords is a lot better than the alternative. It’s usually the opinion that a password notebook in a reasonably secure location (in your desk at home) is better than recycling weak passwords.

deleted by creator

Remember to think about your backup strategy if you use locally managed password software. I’ve helped (and been unable to help) some non-technical folks who relied on popular magazine/new site articles for software selection without good knowledge of how to properly backup their data.

It means that you can use more secure passwords rather than using easy to guess passwords/one password for everything. Using cloud based ones like Bitwarden means you have to trust the company hosting your passwords to not screw up and suffer from a data leak. I think Bitwarden is pretty trustworthy, but I might be wrong on that one.

Alternatively, you could selfhost (with something like Vaultwarden) or just use something local like KeePass. For the latter, you can choose to sync with SyncThing if you want.

I personally use KeePass, but don’t use SyncThing.