Bitwarden. Its dead simple and cross-platform + regularly audited. And either FREE or $10 a year for 2FA and some other nice to haves.
Obviously there's other choices for those who want more control over it but you can't go wrong with BW.
back
3 comments
Notably, Bitwarden is also self-hostable, which, in combination with the good mobile clients, was enough to get me to switch to it from Keepass.
Vaultwarden is even easier to self-host, it's basically a single binary that uses a SQLite database: https://github.com/dani-garcia/vaultwarden
I am currently trialling Bitwarden. I have found that it's not that great at picking up that you are creating an account, offering to generate and then saving the result (using Firefox with Bitwarden extension). I am looking at the other options as they are reportedly better at that sort of thing.
It's a shame though because Bitwarden is philosophically what I'm looking for.
I noticed that as well, the fix for me is pretty easy: just create the account in bitwarder first and then autofill it in the actual account creation page. No extra work, and becomes habit quite quickly.
This is fine on desktop. It's less great on mobile.
I used to agree with this until I thought about the order in which to do it. The issue was that I'd open BitWarden manually to create credentials, rather than doing it during the autofill popup.
Here's how I do it on iOS:
1. Select the password field and open BitWarden through the button above the keyboard.
2. The password list will be empty. Press the + to create new credentials.
3. Enter a username, generate a password and press save.
4. The list will now have a single entry. Press it to autofill.
I haven't found it to be too bad on mobile... but ymmv of course.
I do the same on mobile, not sure I noticed any reason it's worse there.
Think you might have missed a not in there, if I'm reading sentiment correctly. "...found that it's that great..."
I did - edited to fix.
2FA in the same app as your password defeats the point doesn't it?
2fa is mitigation for weak passwords. With a password manager you can use a strong password, and 2fa becomes redundant.
It’s not my preferred method because I want 2FA to save me if my device is compromised, but it does still add protection against traditional password attacks, credential stuffing, etc. It even adds a layer of phishing resistance, as long as the user doesn’t blindly jump to copy/paste when autofill fails.
What is the phishing resistance it adds? Bitwarden auto copies TOTP to the clipboard.
Depends on the password manager. 1Password will not autofill if the domain doesn’t match. It’s up to the user at that point to check the url before copy/pasting the code. My guess is that the average user would do that by reflex without a second thought.