KeePassXC + Nextcloud has surplanted any other password manager for me for the last two years. The OTP integration is great as well.
I use Keepass2Android, which works great with Nextcloud and handles very well offline usage and subsequent merge of the database. On iOS the experience is much worse: I use KeePassium but it does not connect natively to Nextcloud, so I use BoxCryptor for that. The downside is that if Nextcloud is unreachable, I cannot see my saved passwords. Anyone managed to have a good experience on iOS?
I find the 2fa should be separate, even on a separate device, from the password store.
Which is why I never use this OTP/2FA feature in my favorite passwordmanager Bitwarden.
If you store both the password and 2FA in something that secure, is it really causing any real harm?
If your threat model dictates that this IS a threat for you, then by all means, don't do that. But I think for the average person this is far more secure than some of the alternatives they'd be doing otherwise.
(I mean, I say this as someone who also keeps 2FA separate, but I do see some benefit to 2FA even stored with the password)
I can't take software like bitwarden seriously because they still require you to have a cloud account and/or run your own server which I also have no interest in. I want something I can actually backup natively on a client without extra effort like a script running agaisnt an api. A single file encrypted database is more than adequate. Control and ownership of the password blob is just so absolutely critical if you invest heavily in password management, especially with sites that take a stance of "password/otp or we'll never recover the account"
Worked great, until some support person on the phone actually wanted to know the answer...