Ask HN: What password manager tools do you use or recommend?

This won’t be popular here, but I use LastPass extensively (300+ saved credentials) and works like a charm: 2FA via TOTP, incredibly reliable Chrome extension (I almost never have to copy/paste passwords from it, the auto completion aggressively works even with the websites that explicitly try to prevent it or change frequently), beautiful ios integration and seamless synchronization across 6+ devices. I take a csv backup on an encrypted usb stick monthly just in case. I don’t remember any of the passwords I use (besides the LastPass master password), including the most important ones such as gmail and bank accounts (for which I also rely on TOTP whenever possible). Always automatically generated and stored in LastPass.

I would love if someone convinced me to move to something that would work just as well, for me user experience is the most important thing, I don’t want to deal with complicated workflows, considering password completion is something I have to do ~50 times a day or more, so even just a few additional seconds become exponentially annoying for me.

If Gmail gets hacked and they leak your password, thereby requiring you to change your password, how will you remember the changed password?

I wrote my own, MemPa [1, 2].

I'm not sure I'd recommend it because it's basically iOS-only now and with no iOS12 integration, but I'd definitely recommend a deterministic approach for at least your most important sites (banks, google?, facebook?). The main reason is availability in case of real need, when for example your phone could be broken or inaccessible. I wrote about my use case here [3].

Happy to discuss deterministic approaches, please make sure to read also the counter arguments [4].

In addition, I strongly encourage setting up 2FA, especially on the most important sites. My choice for passwords is also related: I really want my password to be something I know (not something I need a device/password manager for) because with 2FA you prove already something you have. Another totally valid option is to setup 2FA on your password manager and call it the day. For completeness, I'm also building a security key called Solo, open source and FIDO2 [5].

[1] https://mempa.io

[2] https://hackernoon.com/mempa-a-modern-deterministic-password...

[3] https://hackernoon.com/how-i-manage-my-passwords-technical-v...

[4] https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw...

[5] https://solokeys.com

Seconded. KeePassXC + Nextcloud Sync for me.

Firefox native password manager. Works fine and it syncs with my phone automatically.