Hacker News Reader

Comment by imafish | Hacker News Reader

For self-host - is it better than KeePass?

Absolutely. Keepass gives you only a file that you have to sync by yourself and when you have multiple device editing the same file... Well...

On the other hand, Bitwarden lets you self-host a complete server that handles everything. If you want something less resources intensive you can take a look at Vaultwarden which is a re-implementation of the server in Rust instead of C#. The main advantage is that it uses MySQL or Postgres instead of the heavy MS SQL Server.

It is funny, because to me "only a file you have to sync (and backup)" sounds more like an advantage than setting up an entire server environment just so you can access your passwords.

I guess it depends if you sync you passwords across multiple devices, and also potentially add new passwords on multiple devices.

I personally don't.

Sure I have a password manager on my phone, but it only gets a small subset of my passwords anyway. Similar any password I add on my phone is very likely to be somewhat irrelevant mostly throwaway.

I use Nextcloud to sync to my Android. On iOS it was more annoying.

If you're the sole user, it's probably not worth self-hosting {Bit,Vault}warden. However, the ability to share passwords and, optionally, TOTP codes is super helpful. My wife and I both used KeePass before and the combination of syncing the DB across devices and inability to share (a subset of) passwords was a killer.

{Bit,Vault}warden} both now support emergency access which will be useful if it's ever needed

Yes, I agree. For multiple users, I would definitely switch.

Meh, heavily depends on your setup. The lack of good apps on mobile devices that integrate with their respective OS (iOS/android) is a bit of a problem. It's also 3rd party apps (some closed source) and not official ones which is its own problem (-> trust).

Apart from that bitwarden is just wayyy easier, you simply tell the (official) app the URL to your vault and it's basically good to go. You don't have to worry about synchronization one bit. The app is also fairly nice and has all the features you need. Bitwarden also does the browser integration well, unlike keepass where it's a major pia.

Are you using Vaultwarden?

> It's also 3rd party apps (some closed source) and not official ones which is its own problem (-> trust)

Isn't the self-host server (Vaultwarden) also 3rd party?

You can use sqlite with valutwarden which ia more suitable for personal/few users usage.

> when you have multiple device editing the same file... Well...

You are implying that this is a problem, but KeePass actually explicitly supports this and merges your changes. I've been using KeePass like this for many years and never had a problem editing the database from multiple devices.

Depends, self hosting the main project will require a Microsoft SQL Server instance amongst other things which ends up with a quite heavy endeavour.

There's an alternative implementation of the server API called Vaultwarden that works nicely with all the frontends but is unofficial.

If Keepass works for you, you're likely not gaining much from switching. They're both just password managers at heart.

Vaultwarden is pretty nice. I had it set up in minutes and it works perfectly.

For self-host, use Vaultwarden [1]

[1] https://github.com/dani-garcia/vaultwarden

If you do self-host, please consider still buying premium from Bitwarden. It's only $10 per year. It's well worth the money and since you're still using the clients, which are still developed Bitwarden, it'll help towards keeping the product alive.

Considering it costs a fifth of 1Password, and has had an almost-fully-featured free option since early days, I suspect that Premium income is not their main source of funds. Maybe they got investment to survive while they built a business-friendly product. Maybe they consult for businesses running their own servers.

Agreed, I'm doing the same. I used the TOTP feature before I self-hosted.

This works very well for me indeed, just add this to you docker-compose.yaml (includes Traefik configuration under labels, for https) and boom:

  bitwarden:
    container_name: bitwarden
    networks:
      - bitwarden
    image: vaultwarden/server:latest
    restart: always
    environment:
      SIGNUPS_ALLOWED: "false" # Set to true when making your accounts
      DOMAIN: "https://bw.domain.nl"
      WEBSOCKET_ENABLED: "true"
      #      ADMIN_TOKEN: "SomeTokenForResetPurposes"
    volumes:
      - ./bw-data:/data
    labels:
      - traefik.enable=true
      - traefik.http.middlewares.redirect-https.redirectScheme.scheme=https
      - traefik.http.middlewares.redirect-https.redirectScheme.permanent=true
      - traefik.http.routers.bitwarden-ui-https.rule=Host(`bw.domain.nl`)
      - traefik.http.routers.bitwarden-ui-https.entrypoints=websecure
      - traefik.http.routers.bitwarden-ui-https.tls=true
      - traefik.http.routers.bitwarden-ui-https.service=bitwarden-ui
      - traefik.http.routers.bitwarden-ui-http.rule=Host(`bw.domain.nl`)
      - traefik.http.routers.bitwarden-ui-http.entrypoints=web
      - traefik.http.routers.bitwarden-ui-http.middlewares=redirect-https
      - traefik.http.routers.bitwarden-ui-http.service=bitwarden-ui
      - traefik.http.services.bitwarden-ui.loadbalancer.server.port=80
      - traefik.http.routers.bitwarden-websocket-https.rule=Host(`bw.domain.nl`) && Path(`/notifications/hub`)
      - traefik.http.routers.bitwarden-websocket-https.entrypoints=websecure
      - traefik.http.routers.bitwarden-websocket-https.tls=true
      - traefik.http.routers.bitwarden-websocket-https.service=bitwarden-websocket
      - traefik.http.routers.bitwarden-websocket-http.rule=Host(`bw.domain.nl`) && Path(`/notifications/hub`)
      - traefik.http.routers.bitwarden-websocket-http.entrypoints=web
      - traefik.http.routers.bitwarden-websocket-http.middlewares=redirect-https
      - traefik.http.routers.bitwarden-websocket-http.service=bitwarden-websocket
      - traefik.http.services.bitwarden-websocket.loadbalancer.server.port=3012
      - traefik.http.routers.bitwarden-ui-https.tls.certresolver=mytlschallenge

I’ve been trying to switch from KeePass to Bitwarden so that my partner and I can share some passwords but KeePass just works, so it’s been hard to change over.

If I may ask, how do you share passwords when using KeePass?

I am not poglet, but I use Strongbox to manage Keepass databases in iOS and macOS and share it via iCloud Drive.

I was using KeepassXC, but I liked the the TOTP backup/share with partner functionality and iOS strongbox app.

Thanks I will give this a go.

She just askes me to get the password for her. I have chosen to store some of her rarely used account passwords to save her from having to go through the password reset process every time she wants to access the accounts.

I attempted to set her up with her own database but it's difficult to manage accounts that we both share in two separate databases.

share the password database, do not add passwords at the same time in multiple places, always sync->add->sync.

Most people do not add passwords often, so that works just fine.

You also can have multiple database file, one for the common shared password which is always read only synced from a single source. And one for local passwords which are not yet, or should not, go into the shared database.

If you use Keeweb, you can put the database file on a shared drive and open it from there. I set that up for some shared passwords in our company with Google Drive.

It depends how you use it, if you dont need to synchronise the database between machines (much) then KeePass is likely the easiest solution and works very well, beyond that Vaultwarden makes it easy to maintain a single centralised database accessed from multiple systems

It scratches different itches; Bitwarden (/Vaultwarden) is good if you need to sync lots of devices and users to the same database; KeePass is less overhead with 3 or fewer devices and a single user.

I've found the multi device syncing easier and the integration with iOS works very well.

This was my reason to go away from KeePass(XC) with NextCloud for sync. I would inevitably run into a sync issues (also due to the need for NextCloud to be always up of course, also self-hosted) and I never found a nice way to integrate KeePassXC into android or iOS, Bitwarden just works, on any OS (allthough what I find annoying is that you have to sync the vault before you get new stuff by going into the app and syncing, just using it does not update it, so frequently I find myself missing passwords on iOS and then I need to manual sync first). Oh, and there is an issues with using it in private tabs on FireFox which has existed since I started using it.

> you have to sync the vault before you get new stuff

I had that problem on iOS, and it disappeared since I moved to Android. There is probably an issue in what they are (not) allowed to do in background on iOS.

> I would inevitably run into a sync issues

Could it be that you weren't using it correctly? KeePass database files aren't supposed to remain open (for security of course) and it has quite a number of options to automatically close it after certain amount of time or when the window isn't focus, computer is locked, etc. This would trigger a sync with the (NC) server and assuming that all your clients follow the same usage pattern and close the DB after a small window of time, there shouldn't be any conflict.

> NextCloud to be always up of course, also self-hosted

You could use NextCloud's own hosting. But then Bitwarden's server needs to always be up too, and optionally self-hosted.

> Bitwarden just works

A low bar to recommend a password manager, don't you think so?

My remarks are from the self hosting perspective. To ensure an up-to-date KeePassXC db across all my devices I needed Nextcloud to always be reachable. KeePassXC was not smart about sync, so add one pw on a device before syncing, add one on another and you have two divergent databases that you have to manual reconcile. Bitwarden does not have this issue, and it also keeps itself synced, even if I only set up the add-on in the browser (with KeePassXC you always need the full program installed). With KeePass(XC) it's just an extra layer you need to be aware of, decoupling sync from the db.

For me BW has always just worked, meanwhile I have several KeePassXC dbs with a date in their name because of conflicts. Which arguably is because of NextCloud issues, which are my own "fault" (issues include, on work PC file sync services are not allowed, on Server somehow NC disconnects after every container update, since it is "headless" I often notice this very late, the shitty state of NC client packaging on Ubuntu will let you install very old clients that may stop syncing, you need to be aware of this... etc). Perhaps KeePass(XC) just works if you outsource syncing, but then still, it is easier to have sync conflicts than with BW.

And then there is the ability to share PWs with relatives with a BW account on the same server, KeePass does not have this concept as far as I am aware.

My own setup which works beautifully is:

KeepassXC on the desktop 'Keepass2Android Offline' on android Keep my database in dropbox. Keep things synced on Android via Dropsync.

I know it's not a self-hosted solution, but I think dropbox as a sync solution in this particular case is a pretty good solution for personal use.

Reply on news.ycombinator.com