If just one or those passwords gets leaked you might find a lot of other ones get cracked as well.

It may not be sites that you care about. But using a password manager is a lot less effort and a lot safer than whatever technique the average Joe will come up with.

Any password that leaks which could indicate a potential system ( e.g.: sitename in lower/upper/leetspeak) makes the whole thing even more vulnerable.

Just use something. Bitwarden, vault warden, keepassxc, ...

Knowing my social circle I'd recommend bitwarden. Even paying for it costs a measly 10$/year, while the free version is very usable in itself. And generating passphrases or 32char passwords will be a lot safer than whatever the hell they can come up with.

Just avoid the default browser ones, big tech and LastPass.

On mobile I indeed also had that issue once. However I made sure they can't lock me out completely. The db is stored using the opensource sqlcipher, so one can open it and extract everything manually, if absolutely necessary. As long as they don't change this, I am fine. In the worst case that would still be a lot of effort for me, but not impossible.

The export has also improved a lot. You can now also export to JSON which includes all the data one could need.

KeepassXC is the only thing that makes sense to me.

I don't want all my passwords stored with some huge target like lastpass or bitwarden.

Encrypted local (and synced) DB is the only way.

Shamelessly shilling my OSS project, rook. It provides a secret-server-ish headless tool backed by a KeePass DB.

• Headless server
• Optional and convenient integration with the kernel keyring (on Linux), for locking the server to only provide secrets to the user's session
• Provides a range of search, list, and get commands
• Minimal dependencies and small code base make rook reasonably auditable

You might be interested in rook if you're a KeePassXC user. Why might you want this instead of:

• Gnome secret-server, KDEs wallet, or pass? rook uses your (a) KeePass DB, while most other projects store secrets in their own DBs and require (usually manual) sync'ing when passwords change.
• One of the browser secret storage? Those also keep a bespoke DB which needs to be synced, and they're limited to browser use. Rook supports using secrets in cron jobs or on the command line (e.g. mbsync, vdirsyncer, msmtp, etc, etc).
• KeePassXC? KeePassXC does provide a secret service that mocks Gnome secret-service, but you have to keep KeePassXC (a GUI app) running even if you only rarely use the UI. Rook can also be used on a headless machine.
• The KeePassXC command line tool? That requires entering the password for every request, making it tedious to use and impractical for automated, periodic jobs.

Rook is read-only, and intended to be complementary to KeePassXC. The KeePassXC command line tools are just fine for editing, where providing a password for every action is acceptable, and of course the GUI is quite nice for CRUD.

I have more than 120 electronic identities, impossible to track the counter or to remember the tld of all websites I visit.

The concepts is only useful in a very small and defined scenario.

I use GNU pass synced through an internal Gitea. Have wireguard to sync remotely. Works pretty good, I would recommend not setting an expiration on the key, the git history keeps the old encryption anyways.

Hahaha, that's the point of a password manager. If remembering worked, we wouldn't need any of this.

Also, I have 300+ unique logins.

My point is that of those 120 probably 110 have never been compromised nor forced you to change the password due to expiration policies. The remaining 10 are the ones that require some mental gymnastics, so while the problem exists it's not as serious as it sounds. I probably have more than 120 identities using this method since I've been using it for years, and I don't think I ever had to use the counter, it's a matter of being consistent in how you think about websites, for example if you know how you refer to a site slugify it and use that for the field, so you would use spotify, netflix, amazon-prime.

I look at it like this:

• I don't absolutely trust the security of my server. Sure, it hasn't had a breach.....yet, but that possibility is inevitable, given the amount of bots that keep trying to get in by the minute. It's secure, yes, but is it secure enough to entrust the keys to my bank account, my business ventures, et al? IF somebody got the key to my Lemmy account, it would be bothersome, but not cataclysmic since all online accounts are silo'd with only a couple that are linked.
• Bitwarden spent a lot of time and money building a large infrastructure that is, imho, far more secure than my little server. Bitwarden has a pretty good track record. They have had some vulnerabilities, even as recent as '23 but these have been remediated.
• Confirmation bias...I've been using Bitwarden for untold years now and have never had an issue, other than the recent UI theming schema that was so castigated by users that they offered a way to switch back.

While hosting my own password manager would fit right in with the rest of my selfhosting, I think sometimes it's better to defer to more secure options when dealing with highly sensitive data.

This is the way to go.. though I've moved from pass to go pass which is basically the same thing but written in go and looks to be better maintained.. also moved from gitea to forgejo since I think gitea has had some maintainer changes over the last couple of years that may not have been in the spirit of remaining fully FOSS

KeepassXC + Syncthing. Using for 2+ years no issues. Have separate database files for each device and merge them as needed.

This. And to add to what other commenters have said, by using Bitwarden and paying for their Premium plan (very cheap, just $10/year), even if you don't use all their features, you're supporting a good project. It's critical infrastructure, I think the price is more than fair.
Either way, you should always make periodic backups from any cloud service you use, encrypted of course.

theres also the option of using a "key file" with Keepass, which can be any file, an mp3, an ebook or whatever, and then you select that file when youre entering your password. so as well as someone trying to brute force your password they also have to guess what key file youre using, which would be next to impossible if you had a folder full of hundreds of files

using passphrases instead of passwords can make this a lot easier as well. a lot of times i just glance at a passphrase on my phone and then type the whole thing in one go into my laptop

I switched to Bitwarden after the LastPass stuff a couple years ago, and I just got around to installing Vaultwarden on my TrueNAS system at home. Using a single Cloudflare Tunnel to handle secure external connections for that and other services like Emby easily. Took a little bit to setup following some guides, but has been working flawlessly for me and some friends. You can use the regular Bitwarden apps and extensions since they natively support self hosting.

Sandpass on sandstorm

It's dated, but phenomenal (and secure)

Damn, that sounds very interesting! The use of a Keepass DB instead of a new one makes it great to have as option. It's something I hadn't think about for a long time.

I'll check it out later and maybe install it after I restore my server, I'm planning to reduce my attack surface too:)

I do the same thing on my laptop and gaming PC. My only beef with KeePassXC is that they refuse to implement WebDAV, despite the OG KeePass having it. Otherwise it's fantastic.

if you need to share passwords with other people and do that often then that would be the only reason i would recommend a server-client based password manager. otherwise theres too many points of failure for my liking, especially for something that i use on a daily basis.

KeePass on the other hand is just a single file thats stored locally and all you need is an app to read it. you dont need an internet connection or a VPN to access it remotely. your wifi could be down, even your power could be out and you would still have access to your database

being able autofill desktop program logins was the main reason i switched away from bitwarden years ago

KeepassXC on desktop has a feature called "Autotype" which basically simulates keystrokes to fill in your passwords. theres also an option to integrate with the KeepassXC browser extension, but with Autotype your browser has no connection to your database at all. i kind of feel this is a huge elephant in the room that most other password managers just gloss over. sure, you are getting a lot more convenience by having your browser autofill your passwords but its also adding a huge attack surface just for the sake of a few seconds or a few clicks.

that said, Autotype isnt great at guessing all sites you might be trying to log into but there is this browser extension that will change your browsers window title to show the full site url which KeepassXC can then read

one really underrated feature that i dont see any of the others doing is giving you the ability to use multiple vaults at once. you can have one vault for things that are really important, then everything else in another vault and have different strength passwords/passphrases for each one. i have maybe 300 logins but only around 10% of them are important. its kind of a pain if all you want to do is just log into some random forum but you have to type a long secure master password just to open your vault

I use KeePass (Keepass2Android, KeePassXC, OG KeePass, and KeePassium) for everything. Been using KeePass in general for 20-ish years.

Recently, I decided to export all of my passwords from Firefox, Chrome, and Edge, import the data into my KeePass database under their own folders, then delete everything from the browsers. That way I can move entries that weren't already in the database to their respective locations in the database hierarchy, delete duplicates, and change insecure passwords.

The database is hosted on my phones (work and personal), laptop, gaming PC, and a server at home, all synced with Syncthing. My work laptop also has Portable KeePass that accesses the database via WebDAV to my server.