Selfhosted

If you've been using passkeys, you'll need to generate new ones when you switch. AFAIK, they aren't exportable from Google or Apple. Which, among other reasons, is why I'll just stick to high-entropy passwords. I've had some sites like Amazon try to sneakily make me register passcodes, I've had to go back and tear them out before they screw me somehow.

I use KeePass (Keepass2Android, KeePassXC, OG KeePass, and KeePassium) for everything. Been using KeePass in general for 20-ish years.

Recently, I decided to export all of my passwords from Firefox, Chrome, and Edge, import the data into my KeePass database under their own folders, then delete everything from the browsers. That way I can move entries that weren't already in the database to their respective locations in the database hierarchy, delete duplicates, and change insecure passwords.

The database is hosted on my phones (work and personal), laptop, gaming PC, and a server at home, all synced with Syncthing. My work laptop also has Portable KeePass that accesses the database via WebDAV to my server.

if you need to share passwords with other people and do that often then that would be the only reason i would recommend a server-client based password manager. otherwise theres too many points of failure for my liking, especially for something that i use on a daily basis.

KeePass on the other hand is just a single file thats stored locally and all you need is an app to read it. you dont need an internet connection or a VPN to access it remotely. your wifi could be down, even your power could be out and you would still have access to your database

being able autofill desktop program logins was the main reason i switched away from bitwarden years ago

KeepassXC on desktop has a feature called "Autotype" which basically simulates keystrokes to fill in your passwords. theres also an option to integrate with the KeepassXC browser extension, but with Autotype your browser has no connection to your database at all. i kind of feel this is a huge elephant in the room that most other password managers just gloss over. sure, you are getting a lot more convenience by having your browser autofill your passwords but its also adding a huge attack surface just for the sake of a few seconds or a few clicks.

that said, Autotype isnt great at guessing all sites you might be trying to log into but there is this browser extension that will change your browsers window title to show the full site url which KeepassXC can then read

one really underrated feature that i dont see any of the others doing is giving you the ability to use multiple vaults at once. you can have one vault for things that are really important, then everything else in another vault and have different strength passwords/passphrases for each one. i have maybe 300 logins but only around 10% of them are important. its kind of a pain if all you want to do is just log into some random forum but you have to type a long secure master password just to open your vault

Sandpass on sandstorm

It's dated, but phenomenal (and secure)

I switched to Bitwarden after the LastPass stuff a couple years ago, and I just got around to installing Vaultwarden on my TrueNAS system at home. Using a single Cloudflare Tunnel to handle secure external connections for that and other services like Emby easily. Took a little bit to setup following some guides, but has been working flawlessly for me and some friends. You can use the regular Bitwarden apps and extensions since they natively support self hosting.

KeepassXC + Syncthing. Using for 2+ years no issues. Have separate database files for each device and merge them as needed.

I look at it like this:

• I don't absolutely trust the security of my server. Sure, it hasn't had a breach.....yet, but that possibility is inevitable, given the amount of bots that keep trying to get in by the minute. It's secure, yes, but is it secure enough to entrust the keys to my bank account, my business ventures, et al? IF somebody got the key to my Lemmy account, it would be bothersome, but not cataclysmic since all online accounts are silo'd with only a couple that are linked.
• Bitwarden spent a lot of time and money building a large infrastructure that is, imho, far more secure than my little server. Bitwarden has a pretty good track record. They have had some vulnerabilities, even as recent as '23 but these have been remediated.
• Confirmation bias...I've been using Bitwarden for untold years now and have never had an issue, other than the recent UI theming schema that was so castigated by users that they offered a way to switch back.

While hosting my own password manager would fit right in with the rest of my selfhosting, I think sometimes it's better to defer to more secure options when dealing with highly sensitive data.

I use GNU pass synced through an internal Gitea. Have wireguard to sync remotely. Works pretty good, I would recommend not setting an expiration on the key, the git history keeps the old encryption anyways.

It's strange how I never see this mentioned anywhere, but there's a way to get unique secure passwords for every site/app without needing to store them anywhere. It's called LessPass, and essentially generates passwords based on 3 fields (site, username, master password) and works relatively well, because the advantages are quite obvious I'll list the potential downsides:

• If one password is compromised or needs changing for whatever reason you need to increase a counter and need to remember which counter for which site (this is less problematic than it sounds, except in places that have a password policy that forces you to change your password periodically)
• Android can store the master password and use fingerprint to input it, but in PC you always have to type your master password which can get annoying.
• You need to change your passwords to this new format, which can take a while, and years down the line you're trying to login somewhere and don't remember if you've already migrated it or not.

Why not use KeepassXC? It's a completely local encrypted db but it integrates with cloud storage apps like nextcloud for sync. It has plugins for integration with Firefox and KeepassAndroid is pretty smooth on the current Android OS.

If you don't have a hard requirement of it being fully (!) OpenSource, then I would recommend Enpass. Relatively pleasing UI that runs native on Win, Mac, Linux, Android and iOS. It has browser plugins for Chrome and Firefox that talk directly to the running fat client (so no multiple authentication with different browsers necessary).

The password db is completely local, but it offeres several sync mechanisms like WebDAV or Dropbox or also iCloud; basically whatever can store files. If it's a NAS in your home, it simply will sync once you are back home.

It also offers "WiFi Sync", in which case you designate one machine running Enpass as the server and link other clients to it, then you don't even need to run a separate hosting for it (but that machine needs to be on and running Enpass when you want to sync, obviously).

It's basically a less open but much more convenient and beautiful KeePass(XC).