Ask HN: LastPass Alternatives

Self-hosted vaultwarden is my choice.

I did a write up on it for anyone interested.

https://www.abortretry.fail/p/vaultwarden-on-an-rpi

As someone historically adjacent to the security industry, and having worked with some of the best, all I can say for sure is that questions like these really bring out some of the worst, most bespoke, and operationally insecure password management strategies that fail miserably to understand the problem.

I use 1pass. I don’t know if they’re actually better. I wouldn’t recommend rolling your own here, however, even if you can’t think of why your solution would have flaws.

It takes a special kind of mind to accept the limitations of your perspective, and this is a field ripe with that exact kind of bias.

KeepassXC is a thick client password manager. Password store might be even more secure.

If you want “seamless sync of your secrets” by a trusted 3rd party with an online vault, well, then, Bitwarden or 1Password. But the architecture is roughly the same as that of lastpass (though they also encrypt URLs, and might have better KDF, and operational security).

In particular, you should assume that 3-letter agencies snapshot data in cloud placed at their feet, have your vault, and may attempt to crack it should that be needed.

I've been so satisfied with it that I showed it to my manager, he started using it as a private customer, and we adopted it as the company wide password manager some months later.

For a while I used an encrypted excel spreadsheet (AES-256 but no idea about other tuning) and stored in OneDrive. Could open just about anywhere since Office is everywhere and OneDrive pretty ubiquitous (I’m guessing no Linux though except Wine?). I have moved to BitWarden now because so many passwords a spreadsheet is cumbersome and prone to fat fingers.