Hacker News new | ask | show | jobs
by mikece 1140 days ago
For cloud-synched across devices: BitWarden.

For maximum security (no cloud sync): KeePassXC

In both cases an essential feature applies: if you forget your master password you've lost access to your password database.

6 comments

I've used KeePass for ages and every time another password manager comes up in the headlines it's only ever made me feel more confident about that decision. Zero games, no cloud/other party to be dependent on, and I have total freedom to implement whatever backup/sync methods work best for my situation.
KeePass is not KeePassXC. The former is written in .NET, the latter in C++; numerous open source audits have shown that KeePassXC is far and away more secure than KeePass. Not to mention that cross-platform performance for KeePassXC is superior.
> numerous open source audits have shown that KeePassXC is far and away more secure than KeePass.

Could you link some?

I mean, that sounds like a major claim, but it doesn't appear to be mentioned on either of their Wikipedia pages, in their FAQ's, nor on some of the top-results from Google.

For example, from [KeePassXC's "FAQ"](https://keepassxc.org/docs/ ):

> Why KeePassXC instead of KeePass?

> KeePass is a very proven and feature-rich password manager and there is nothing fundamentally wrong with it. However, it is written in C# and therefore requires Microsoft's .NET platform. On systems other than Windows, you can run KeePass using the Mono runtime libraries, but you won't get the native look and feel which you are used to.

> KeePassXC, on the other hand, is developed in C++ and runs natively on all platforms giving you the best-possible platform integration.

, where they don't appear to claim a security-advantage.

[This security-audit [PDF]](https://keepassxc.org/assets/pdf/KeePassXC-Review-V1-Molotni... ) claimed:

> It is interesting to notice, that the code of KeePassXC is organized in classes cleaner than the code of KeePass in C#. The classes are smaller, the functions are shorter. See e.g. the code to read a database. The reason for this might be that KeePass grew organically into a more complex logical structure and maybe it could enjoy some refactorings. In any case, right now, it is easier to review KeePassXC code for security and to understand it than to do so for KeePass.

, which seemed like a point in KeePassXC's favor.

Same project, two versions of the software. I use both. New devices all get KeePassXC.
I'm hoping for one written in a safe language.
You could sync the KeePassXC database with Syncthing, to have e2e encrypted sync across devices, fully open source and without servers.
I feel safe using KeePass. Its hotkey auto-fills most of the time. You can regularly sync/backup the database to cloud.
KeePass seems to sync via a preferred cloud provider fine.
You can sync a KeePassXC database using a provider like Google Drive/iCloud/Dropbox/etc but that's not a feature of KeePassXC, it's you doing semi-manual cloud synch.
Use Vaultwarden and self host the backend
This ^