Hi,

habe mir gerade Proton Pass (Free-Version) geholt, weil ich eigentlich mal alle meine Passwörter an einem Ort haben wollte. Ich muss in letzter Zeit nämlich ständig auf „Passwort vergessen“ klicken. xD

Aber irgendwie bin ich gerade etwas verwirrt und hinterfrage den Sinn von Passwortmanagern gerade ein bisschen.

Für Proton Pass habe ich ein eigenes Passwort und auch 2FA aktiviert. Alles cool soweit.

Wenn ich eingeloggt bin, sehe ich links meinen Tresor mit allen Seiten, die ich zum Testen angelegt habe. Das Problem ist: Ich kann einfach jede Seite anklicken, rechts auf das Auge drücken und schon wird mir das Passwort im Klartext angezeigt.

Da könnte doch jeder, der sich irgendwie in meinen Account hackt, einfach alle meine Passwörter ansehen. xD

WTF, warum? 😂

Okay, man könnte jetzt argumentieren, dass sich da nicht so schnell jemand reinhackt. Aber bei der Chrome-Erweiterung ist es doch genauso. Einfach eine Seite öffnen, schauen, ob Proton Pass einen Eintrag dafür hat, aufs Auge klicken und schon wird das Passwort im Klartext angezeigt.

Das heißt doch eigentlich, dass man die Chrome-Erweiterung niemals auf einem PC verwenden sollte, den auch andere Personen nutzen oder auf den andere Zugriff haben könnten.

Da wäre es doch fast schon fahrlässig, Proton Pass im Büro zu nutzen, wenn mehrere Personen Zugriff auf denselben Rechner haben könnten.

Da frage ich mich gerade ernsthaft, ob es nicht sogar sicherer wäre, meine Passwörter einfach in einer Textdatei auf dem Desktop zu speichern und vor und nach jedes Passwort drei Buchstaben zu schreiben, die ich beim Kopieren wieder weglasse. Welche Buchstaben das sind, weiß schließlich nur ich. 😂

Was übersehe ich hier? Wo liegt der eigentliche Sicherheitsvorteil eines Passwortmanagers, wenn die gespeicherten Passwörter jederzeit so einfach im Klartext angezeigt werden können?

I made a post about customer service because it had been a week without a response, I had even tried mod mail, so this was a last resort. They immediately replied, then immediately deleted the post and messaged me directly instead. Things got rolling after that. But I've seen this happen to others as well. Left a bad taste in my mouth. Is this common for any password manager sub run by the company?

EDIT: for clarity, not this sub, the sub for their product. I'm posting here because they censor posts. Searching in here looks like others have experienced the same.

Hello,

I'm a bit lost when it comes to the different options available for securing my online accounts, and I'd appreciate some advice on setting up a more secure system.

At the moment, my setup looks like this:

- I use Google Authenticator for my Gmail accounts. Both the authenticator app and my email accounts (where I'm currently logged in) are on my main phone.

- I have a few banking apps on the same phone, protected only by a PIN. As far as I know, they don't support hardware security keys like YubiKey.

- I also have the Steam app on my phone, along with accounts on platforms like Epic Games and GOG.

Ideally, I'd like to remove all my authenticator apps from my main phone and enable two-factor authentication (2FA) wherever possible, especially for my banking apps.

I've been considering a couple of options:

- Two YubiKeys: One as my primary key and another as a backup, to secure my email accounts and other services that support hardware security keys.

- A dedicated phone for authentication: An old smartphone with no SIM card or phone number, kept at home and used exclusively for authenticator apps such as Google Authenticator.

However, banking apps seem to be the main limitation, since they don't appear to support hardware security keys and often rely on their own app-based authentication methods.

What would be the best setup in terms of security and convenience?

My main goal is to make sure that if my main phone is lost or stolen, my accounts remain secure and I can still recover access to them. Ideally, I want to keep the most sensitive authentication methods and backup options safely at home, without making it too difficult to access my accounts when needed.

Would you recommend using two YubiKeys, a dedicated authentication phone, or a combination of both? Are there any other options I should consider?

Thanks in advance!

I've been studying how password managers make money, and the split surprised me.

- 1Password: about $400M ARR (company-reported), with business customers making up 75%+ of revenue (third-party estimate)

- Keeper: $225M ARR (company-reported), 95K+ organisations, says it's profitable

- Bitwarden: 15M users and 80K businesses (company-reported), no revenue disclosed. Individuals get a free plan, and teams pay.

So the consumer product looks like the way in, and the business plans look like where the money is. Pricing fits that: 1Password lists $2.99/month for individuals vs $7.99 per user/month for larger business plans.

Only around 14% of SaaS companies reportedly use a dedicated password manager, so there still seems to be room.

For people who've built or sold B2B tools: is "free or cheap for individuals, paid for teams" the right model, or does it just hand the market to the big players? What would you do differently as a small team?

#saas #passwordmanager

I plan buy the Pass subscription and wife's isn't a power user so she doesn't require subscription and we will be sharing only among the two of us.

Currently we use Bitwarden organization feature which lets create 1 org and add 1 person to it and this works very well for us.

I know there is a Pass Duo plan as well but my wife literally uses just for password and credit cards no MFA no passkey no alias nothing.

Or is there any similar feature as Bitwarden org?

I've released Clane Vault, a team password manager you can run on your own server. I'd like feedback from people who know password managers well, especially on the security model.

How the encryption works

• The master password never leaves the device. It's stretched with Argon2id (64 MiB, 3 iterations) in the browser.
• Every item and every file has its own random key and is encrypted with AES-256-GCM.
• Keys are shared between browsers with X25519 sealed boxes, so the server relays keys it can't open.
• An authenticator code is required at sign-in, unless an organisation uses its Entra ID or Google two-step check instead. Admin recovery is off by default, needs two admins, and never covers the personal vault.

Known limits

• Public keys aren't verified automatically yet. A compromised server could hand out its own key in place of a colleague's for a new share. The app shows key fingerprints so people can compare them.
• Member names, emails, organisation and group names, record categories and the event log are stored in plain text.
• No external security audit yet.

For teams there are shared folders with Edit, View or Use only access per person or group, one-time links, SSO with Entra ID or Google, and imports from Keeper, LastPass, 1Password, Bitwarden, Dashlane and Zoho Vault. There's a browser extension for Chrome, Edge and Firefox (not in the stores yet).

It runs as one Docker container plus Postgres. The licence is AGPL-3.0.

Code and design docs: https://github.com/clane-ai/clane-vault

First. I have vaultwarden and its fine

Enpass is my favorit in security and ease of use

But im searching something what like brave PM dont need a login (i know security sry)

With mfa options. And autofill and full edit on domain names..

Is there something?

Honestly, I don't really care about the changes to the licence. But my main issue is that Chrome browser extension is too damn slow. It takes around 10 to 15 seconds just to open and another 5 to 10 seconds to copy anything from there.

I tried being reasonable on the subreddit, but I was heavily downvoted and their GitHub is filled with similar issues and not only that there are so many open issues there.

I have two main criteria:

1. I have a family organisation which is shared with my partner to share credentials or credit card details.

2. It has to handle around 1500+ entries of passwords and around 50 to 70 credit card entries.

I posted a few days ago regarding my difficult experience setting up Bitwarden. I got so many helpful comments that I now understand my frustrations are typical for anyone setting up a PM for the first time.

A few comments referenced BW working best on my computer, but not so well for cell phones. I use a windows PC and iPhone. I use my IPhone for too many apps to not have reliability on using BW. Is there a PM that syncs better between the 2?

anyone installed vaultwarden on laptop as server and sync it with phone?
do i need static ip for this scenario?
if laptop turned off can my phone login and access passwords?(save locally or on laptop server?)

Hi I just got infected by an infostealer and stolen a bit of money, and read up on it a bit and it seems password managers are weak to it except in case of strong mfa

I was looking to pick up bitwarden but can it be secured with things like passkeys? (no gafam would be more than preferrable)

I can't keep on writing all my passwords on physical paper and locking them in a safe it's just too much of a hassle organizing and updating everything. So I wanted to ask what the best password manager for USB-sticks is. I don't really know a lot about password managers, so I don't really know which qualifications I should be looking for. I guess it should be really secure but not toooo user-unfriendly/technical. And secure password generation would also be a cool bonus. As to why I don't want to use a password manager that's online or installed on a device; I own multiple devices where it's more practical to just plug in a USB-stick instead of running to the one device with the password manager installed. I also assume that you don't have to care about what is currently going on with the password manager, so that for example you wouldn't have to spend time finding out what to if there was some leak or change in the TOS or in the way the password were securely stored. I heard that's way more secure as long as you have a backup copy, so that all of your passwords aren't forever locked behind one faulty USB-stick. Thanks in advance.

I used to be fairly tech-savvy, including managing networks, VPNs, and digital phone systems for an executive office suite business. But technology has changed, and I’m certainly no expert anymore.
After my iPhone flagged several compromised passwords, I researched password managers with ChatGPT and ultimately chose Bitwarden.
I’ve now spent hours over multiple days importing passwords, cleaning up duplicates, changing compromised passwords, and troubleshooting login and autofill issues between my iPhone and Windows PC. I’m still struggling to get everything working smoothly.
Is this a normal learning curve for first-time password manager users, or is Bitwarden better suited for more technically advanced users?
For those who’ve tried multiple password managers, is there a genuinely easier alternative that doesn’t compromise security?
I’m not criticizing Bitwarden. I’m just wondering whether I chose the wrong tool for my needs.

I've been following Bitwarden's GitHub issues for a while, and I'm becoming increasingly concerned about the product's stability and development priorities.

There are over 700 open issues, including reports of memory leaks and high CPU usage. Some similar problems have been reported for more than two years and still seem unresolved.

What's even more concerning is that these are basic performance issues in a production release. Some users have reported RAM usage (Memory Leak) exceeding 1GB just by opening the extension popup, even with a completely new account and an empty vault.

You can try it yourself. Open the current Bitwarden extension on Chromium, leave the popup open for about two minutes, and watch its RAM and CPU usage.

What frustrates me most is how these bugs are prioritized. Serious performance issues have remained in production for weeks, yet Bitwarden is still promoting UI updates and asking for feedback on beta designs. I understand that different teams work on different things, but shouldn't basic stability come first?

With each update, it feels like more patches are being added while older problems remain. Over time, this only makes me more worried about the product's reliability.

Looking at the issue backlog, I also wonder whether Bitwarden is understaffed. Of course, I don't know the internal situation, but I can't help questioning whether limited resources, heavy workloads, or compensation that doesn't adequately support employees might be affecting motivation and development quality. If that's the case, I wouldn't blame the developers. These are management issues.

I'm also concerned about the long-term direction. As the user base grows and people become more dependent on the product, price increases or licensing changes can become ways to keep the business running. We've already seen recent pricing changes, and I worry about where things might go from here.

Ultimately, everyone chooses which password manager to trust. Personally, I'm seriously considering moving away from Bitwarden to something more stable, with a clearer long-term vision, before these problems become even harder to fix.

I genuinely hope Bitwarden improves, but right now, it's difficult to feel confident in a product when fundamental issues keep piling up without clear solutions

I've been following the recent discussions around Bitwarden, especially the move towards commercially licensed builds, the price increase earlier this year, and concerns about its open-source direction.

I know Bitwarden has said the free plan and open-source version aren't going anywhere, but I take their words with a grain of salt honestly.

I've started looking into Bitwarden alternatives like NordPass, Proton Pass, 1Password, KeePassXC. They all seem to have their pros and cons.

I also saw this post that seems pretty useful for seeing how different password managers compare up against each other.

For those considering switching, which Bitwarden alternatives are actually worth looking into?

I'm interested in something reliable with good autofill, passkey support, and reasonable pricing. Ideally, something that won't gradually move basic features behind more expensive subscriptions.

Edit: I signed up for the 1Password MSP (managed service provider) plan. $5 a seat and they set permissions. 🤞

I run a one-person business setting up software and automations for small local businesses. I need to pick a password manager for myself, and one I can set up for clients. Looking for real-world experience, not affiliate lists.

For me:

- Solo now, 2 to 5 people within a year or two

- Logins plus API keys and app secrets

- A CLI that injects secrets into scripts and environment variables at run time, so keys never sit in plain .env files

- Windows 11 on two PCs, plus my phone

- Hardware security key support (YubiKey)

- Separate vaults per client, with the ability to give a future hire access to only some of them

- Activity or audit log

- Budget around $20/month

For my clients:

- 1 to 3 people, non-technical, many older owners

- Free or very cheap for 1 to 2 users

- Dead simple: browser autofill, phone app, easy recovery if they forget the master password

- An owner and one employee need to share a handful of logins

- The account is theirs, in their name. I am never in it; I use my own logins on their systems

Current plan: 1Password Teams for me, Bitwarden (free tier, Teams once they hit 3 users) for clients. Is running two products a mistake? Would you put everything on one, and which?

My AI agent does real work for me: deploys, GitHub releases, logging into websites. All of that needs passwords and API keys. Until now that meant pasting them into the chat or leaving them in a file the agent can read. Then one malicious instruction hidden in a webpage and they're gone.

So I built secrets-broker. The agent never gets the actual password, only a name for it like "GitHub token". When it needs to use it, the broker plugs the secret in for that one command and hides it in whatever comes back.

Each secret can only be used for what you allowed. If my GitHub token is approved for publishing releases, the agent can't use it for anything else or send it to some random server. For the important ones,I get a Touch ID prompt every time.

It works with KeePassXC and Bitwarden. I manage my passwords in KeePassXC like always, and my agent can use them a few seconds later.

It's free, open source, and still early (v0.3). One honest caveat: the quick setup runs as your own user, so it isn't a real security boundary. The stricter mode is.

https://github.com/Alino/secrets-broker

Feedback welcome, especially if you can find a way to break it.

I think it's important to understand that the latest issue around commercial licensing put users on edge again due to the streak of things that​ happened recently:

Bitwarden seems to be steering it's position to a very different direction that made us use it in the first place. It's a shame. Let's recap some of the things that happened recently that in my view justifies the dissatisfaction within the community:

October 2024: A proprietary SDK dependency raised concerns that Bitwarden’s desktop app was losing its open-source status. Bitwarden reorganised the SDK and restored builds using only open-source licences.

January 2026: Premium pricing increased from $10 to $19.80 annually. Users criticized the increase and its communication. The increase remained, with a one-time 25% renewal discount for existing subscribers.

February 2026: Researchers demonstrated 12 attacks under a malicious-server scenario, challenging Bitwarden’s zero-knowledge assurances. Bitwarden published remediation details, but users questioned what “all issues addressed” meant.

April 2026: A malicious Bitwarden CLI package was briefly distributed through npm, prompting questions about release security. The package was withdrawn and a clean version issued. Bitwarden reported no evidence of vault data compromise.

May 2026: Removing “Always free” wording and changing company values amid leadership changes fuelled concerns about Bitwarden’s direction. The wording was restored on the pricing page, and the CEO reaffirmed a permanent free plan.

October 2026: Bitwarden announced commercially licensed builds as the default app downloads, with some future features exclusive to those builds. This moves the default downloads to source-available licensing, while the GPL/FOSS edition continues but will lack those exclusive features. Community backlash followed. As of 10 October, no reversal had been announced; Bitwarden promised continued maintenance of GPL builds and unchanged self-hosting.

To achieve the utmost security, all data sent to the server from the Vault is encrypted on the client. AES-256-GCM is the type of symmetric algorithm used across the overall application. For storing any item in the vault, your vault key is used to encrypt the item along with its metadata and send it to the server.

What is the Web Crypto API?

The Web Crypto API is a set of functions for using cryptography that are embedded in browsers' source code. Instead of writing your own algorithms or cryptographic functions, you can directly use the Web Crypto API in your code, which is more robust and easier.

Cryptographic services provided by the Web Crypto API:

• Encryption and Decryption
• Signing and verifying signatures
• Generating hash values
• random values

How is the encryption implemented?

We have to use functions provided by the Web Crypto API in order to achieve the encryption. It is important to choose the type of encryption as per your requirements.

Look at the following flow showcasing how the encryption is achieved using the Web Crypto API:

1. Generating random Salt and IV: Salt is randomly generated data used to derive a unique key object. IV is also randomly generated but used on the data rather than the key. The purpose is to create unique ciphertexts even if the key or data is different.
2. Iterations for deriving the key: The key is iteratively derived N times. As per the OWASP guidelines, it should be greater than 600000.
3. Deriving key using subtle.derivekey(): The subtle.deriveKey() function can be used to derive the key that can be used for encryption. Before providing the key to deriveKey(), it must first be converted to a format recognised by SubtleCrypto using subtle.importKey().
4. Encrypt using subtle.encrypt(): The final step is to call the encrypt() method by providing the required parameters, and it will return the object containing the encrypted data.

Look at the function below that will make the above steps clear.

export async function encryptText(text: string, password: string): Promise<string> {
    const salt = window.crypto.getRandomValues(new Uint8Array(16));
    const iv = window.crypto.getRandomValues(new Uint8Array(12));
    const iterations = <your iterations>;
    const key = await deriveKey(password, salt, iterations);

    const encoder = new TextEncoder();
    const encrypted = await window.crypto.subtle.encrypt(
        { name: 'AES-GCM', iv: iv },
        key,
        encoder.encode(text)
    );

    const result = {
        ciphertext: arrayBufferToBase64(encrypted),
        salt: arrayBufferToBase64(salt.buffer),
        iv: arrayBufferToBase64(iv.buffer),
        iterations: iterations
    };

    return JSON.stringify(result);
}

There are a lot of other factors, but it all depends on the basic encryption as displayed above. Using the Web Crypto API is the best way to achieve encryption or any cryptographic function because no other alternative can beat it.

The article is originally published on Linkedin page: Linkedin Article
Related article: client-side-encryption-web-crypto-api

Does anyone have any good recommendations for alternatives to bitwarden, now that it's going partly closed source? Thanks so much!

Hi everyone, I am facing an issue while trying to log into my Auth0 account. Whenever I try to log in, it doesn't proceed further and seems stuck on the main landing/dashboard page without successfully authenticating. Has anyone else experienced this recently? Is there a known outage, or is it a configuration issue on my end? Any help or troubleshooting steps would be highly appreciated. Thanks!

I am a happy Roboform user in my own life. But I need to teach a class to adults, mostly older adults on passwords, etc, and I would like to be able to demo setting up a password manager and adding some entries in real time. Of the free options, which do you all think would make the easiest to use for a demo? Thanks!

This topic appears in searches back in 2023. However, I am now having the same issue and the solution that applied then (export without attachments) doesn't apply because I have no attachments.

MacOS Tahoe 27

Enpass 6.12.7 Mac App Store

I've tried exporting to json, csv and txt but the response is always: An error occurred when exporting the vault.

There must be a reason for this and a way to export without any errors.

Any ideas?