[ufo]

For me the biggest difference is that you have a single encrypted database file, and that no metadata is stored unencrypted. By default, pass uses file names as keys, so website names are stored in the clear. (To fix this on pass.you need to use pass-tomb, which I found very clunky, and could never get working quite right)

Another thing I like about keepassxc is that it has lots of features. It comes with a flexible passwird generator, has a friendly GUI UI, can be integrated to the web browser using an extension, and there are compatible android apps you can use on your phone.

[benoliver999]

I agree about the metadata. I like pass but it's a flaw for sure. At least it's upfront about it.

Most other issues are covered with pass, like a good android app etc etc.

[elagost]

You could always use pass-tomb, which is an extension that stores the entire tree encrypted.

https://github.com/roddhjav/pass-tomb#readme

[ufo]

As I mentioned further up, pass tomb needs to be installed separately (which is not trivial depending on your distro) and is clunky to use. AFAIK it also cannot be used to encrypt the password database on Android.

It also really bugs me that an important security feature like this one is not the default.

[alexnewman]

tomb seems fine on ios and android. I don't use it though

[alexnewman]

This is a common claim, and besides that fact that tomb fixes it and is supported on all distributions, I'm not convinced it's a problem. What's the threat model? That folder should be 700 anyway? Or is this just paranoia?

[alexnewman]

but exposes to who?