I dumped LastPass for Bitwarden a few years ago. So glad I did.

So what makes Bitwarden better than LastPass if you're using Bitwarden's hosted option (I know you can keep it locally).

I'd be willing to bet that people store their key phrases in the notes section in LastPass which was not encrypted at rest

Are you not worried your vault is still on their servers? I feel most companies don’t delete shit. Most have ways to get around it saying they keep some info for taxes, accounting, etc.

I wouldn’t sleep well knowing my passwords were on there at any given time.

But who is running the bitwarden server? Bitwarden the private company.

I self host vault warden, but it's really not something everyone can do.

I personally use KeepassXD on my phone, although it hasn't had a security audit. There is also KeepassXC for desktop, which has had an audit

Bitwarden, the host, is a private entity

I prefer local password managers. Synchronisation is achieved with a syncing service of our choice.

Keepassxc and syncthing? Are you a clone of myself? :D

Same setup, working as a charm

A-fucking-men... but I was always given shit for saying this.

Anything can be hacked or stolen, I don't trust any company to secure my information. :/

Except you’re giving your passwords in an encrypted format. So if the company is trustworthy, it’s safe to let them store your passwords because it’s encrypted in such a way that even the company who own the password manager couldn’t access your passwords even if they wanted to.

(Note the caveat of “IF the company is trustworthy”, which rules out Lastpass)

Now I accept that there are legitimate arguments against storing passwords in the cloud via a password manager… so in that case, you may wish to use a local password manager (like Keepass) instead. But realistically, a typical person isn’t capable of memorising lots of unique, secure passwords… so the passwords need to be written down or stored in a password manager, just to avoid weak passwords or password reuse.

Use KeePass.

My concern with using a text file is you have to defrost it to use it and whenever it's not encrypted it's potentially exposed. You are also vulnerable to keyloggers or clipboard captures

KeePass works entirely locally, no cloud. And it's far more secure/functional than a text file.

I personally use KeePass, secured with a master password + YubiKey.

Then I sync the database between devices using SyncThing over a Tailscale network.

KeePass keeps the data secure at rest and transferring is always done P2P over SSL and always inside a WireGuard network so even on public networks it's protected.

You could just as easily leave out the Tailscale/SyncThing and just manually transfer your database using hardware air-gapped solutions instead but I am confident in the security of this solution for myself. Even if the database was intercepted during transit it's useless without the combined password/hardware key.

Yes, if you write the decrypted file to disk, it could be recovered. Deleting files only removes the file system entries - it does not wipe the content.

Use a local password manager. KeePass (use the KeePassXC variant on Linux) is the most popular choice. If you prefer a command line tool, pass (passwordstore.org) is an option.

People with less might just not complain loudly

At one of my clients, a large institution, they go further: you're not allowed to use the local browser's password manager. And still have to abide by the usual password rules: rotate every 3 months, complex passwords, etc.

As a result,, users store a plain text file on their desktop (some go as far as printing it), that conveniently allows them to retrieve their passwords.

Too much security kills security.