Hacker News Reader

Comment by pault | Hacker News Reader

Can you recommend any reputable open source password managers?

https://www.passwordstore.org/ (windows, android, and ios clients exist in addition to the better known linux/osx cli client)

Keepass (and keepassX and keepassC)

https://bitwarden.com/

Gopass, the 98% `pass` compatible password manager with a lot of nice improvements on the UX side:

https://www.justwatch.com/gopass/ https://github.com/justwatchcom/gopass

KeePass, pass, PasswordSafe, KeePassXC, bitwarden, enpass

Sadly Enpass is not open source.

https://discussion.enpass.io/index.php?/topic/210-open-sourc... https://www.enpass.io/legal-end-user-license-agreement/

As well as https://github.com/mstarke/MacPass compatible with KeePass

bitwarden is good and open source.

KeePassX?

Why is this downvoted? is there something wrong with KeePassX?

It hasn't been receiving improvements or maintenance for almost two years, and as a result, it has been forked and is actively developed by a different team under the name of KeePassXC. So nothing inherently wrong with KeePassX but you need to be aware that it is almost abandoned at this point and that there is a better alternative

KeePassX is not actively maintained, as already mentioned but the original KeePass project (https://keepass.info/) that KeePassX was based off and the new cross-platform fork KeePassXC (https://keepassxc.org/) are both active and highly recommended.

I don't know whether [LessPass](https://lesspass.com/) is reputable, but it's notable for its approach.

It's primarily a password generator, rather than a password manager. It reproducibly generates difficult-to-guess passwords, using as input: the site's URL, your username and a master password. You save, sync and retrieve your passwords using your browser's built-in password manager.

I never previously used a password manager because I wanted to ensure I would always have access to my passwords. I started using LessPass because:

* When I need to log in on a non-synced device (such as someone else's computer), I can read the site's password from Firefox on my phone and transcribe it. * If I lose all of my devices, I can still retrieve my existing passwords, because the password generation algorithm uses only my master password as salt.

Lesspass is not notable for its approach; deterministic password managers have existed for quite some time.

They're often recommended against, and it's dangerous to use one without a full understanding of the significant caveats.

See https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw..., the hacker news discussion, https://news.ycombinator.com/item?id=13016132, and notably the top comment there.

Reply on news.ycombinator.com