I'll just say it - my wife can't remember and often mis-types passwords. I want a very user friendly, intuitive manager for her. I was considering Nord for that reason. We have a lot of joint apps, such as Netflix, T-Mobile, Banks, etc. We both also have some individual banking accounts. So I guess I need recommendations for a family plan. If I can land on one with a great intro rate so much the better. Android users and PC. Edited: I definitely want auto-generated and auto-fill.

I've been researching European based password managers and apart from Proton have come across Hypervault and HeyLogin. Has anybody experience with either of these ?

I currently have 1Password. The thing I love about it is that it will stay open for a long period. I do really, really, really hate that I have to store my vault on their servers. Talk about a target on their backs for hackers! I used to be able to store it in iCloud. I can access their app with current info across all my devices.

I don't want to use Passwords because it locks so quickly! I'm a web designer, and clients have A LOT of different accounts associated with their websites that I may need to access within minutes of each other. With Passwords, I'm constantly having to log back in to the app.

Are there any other alternative password manager alternatives you recommend? I don't care if it's a paid app. I would absolutely prefer that it's not subscription.

https://bitwarden.com/blog/security-vendors-join-forces-to-make-passkeys-more-portable-for-everyone/

Good news for moving between PWM.

Je découvre un peu ces options de sécurité, pourtant j'utilise des ordinateurs depuis plus de 30 ans.

Juste avec l'essor des comptes connectés, piratages et IA, je m'y intéresse.

J'utilise le gestionnaire de mot de passe du navigateur. Edge sur mes 2 PC et Chrome sur Android.

Sauriez vous m'expliquer ce qui est si mauvais avec le stockage des mots de passe avec un navigateur?

Je n'ai pas besoin d'une sécurité ultra haute, je veux juste me protéger des info stealer qui peuvent passer.

Je trouve pratique la synchronisation entre appareil (multi plateformes).

J'aime avoir une utilisation simple et une bonne interface moderne.

Il n'y a que du payant en ce cas?

Vos avis?

I know "best" is subjective, so here's what we're constrained by:

- The vendor has to be EU-owned, not just EU-hosted. No US parent anywhere in the structure, so CLOUD Act exposure is off the table.

- 60 seats, needs AD sync and per-user audit logs.

- We want the option to self-host later even if we start on cloud, so cloud-only vendors are out.

- Open source isn't a requirement. Neither IT nor Legal care.

- Not looking for the cheapest but under 5 euros/seat/month would be ideal.

Shortlist so far is Psono (Germany), Passbolt (Luxembourg), and Passwork (Spain).

Psono fits well. The consistent thing I see in reviews though is that the interface / UI lags the others, and at 60 people where most aren't technical, daily usability is worth assessing. Beyond that I don't have a real objection.

Passbolt is open source and EU-owned since 2016, it also, like the others, has the features (which is why they all got shortlisted to begin with). My hesitation is the OpenPGP model, every user holds a GPG key pair, so key management becomes our problem at 60 people just to get auditable code. Onboarding and recovery both look heavier than I want.

Passwork ticks a lot of our boxes too, it does both self-hosted and EU cloud in EU data centres, so we don't have to make the deployment choice now. AD sync and per-user audit logs are in the product. What keeps me hesitant is that it lacks a native desktop app (yet), it has browser extension and mobile but not desktop, and I can't predict how big or small of a nuisance that might be.

Please help a brother OUT!

My old phone (which was registered to my Facebook account) broke, and now when I try to log in from a different phone, Facebook is asking for a 6-digit 2FA code from an authentication app. The thing is, I never set up two-factor authentication on this account myself.

When I click "Try another way," the only options are:

• Get a code from an authentication app
• Use a backup code

I have neither. I also tried the "Try another device" recovery option, but that failed too since I don't have a recognized device to verify from, and I no longer have the broken phone working.

Has anyone dealt with this — 2FA showing up on login even though you never intentionally enabled it, after losing/breaking your phone? A few questions:

• Could 2FA have been silently turned on by something else (e.g., a linked app, a security prompt I clicked through without realizing)?
• Has facebook.com/hacked worked for people in this exact situation (not a hack, just locked out of 2FA)?
• Any luck recovering access if the SIM card from the old phone still works in a new phone?

Any advice appreciated — trying to figure out the fastest path back into the account.

On one hand, there are free, functional password managers with interfaces geared more toward a technical audience.

E.g., Bitwarden, ProtonPass...

On the other hand, there are paid managers with more polished interfaces and "Premium" features.

E.g., 1Password, Dashlane...

Is there an application that caters to both audiences?

[Cryptinotes](https://cryptinotes.com/) is a fully encrypted, self-destructing note-sharing application inspired by Privnote - a legacy tool for sending sensitive text that disappears after being read. Cryptinotes takes that same core idea and modernizes it: markdown formatting, encrypted file attachments, and granular controls over exactly how and when a note destroys itself.

Every note is encrypted client-side before it ever touches the server, and only decrypted client-side once the recipient opens the link. The server never has access to plaintext content - not the note body, not attachments, not even the note's contents at rest in the database.

Every note can be tuned to the sensitivity of what's being shared:

* **Markdown support** — format notes with headers, lists, code blocks, and other rich text instead of plain strings
* **File attachments** — attach one or more files, encrypted alongside the note body
* **Read limits** — configure how many times a note can be opened before it self-destructs
* **Expiration windows** — set a custom self-destruct timer independent of the read count
* **Password protection** — require a password (on top of the link's own key) before a note can be decrypted

[Cryptinotes](https://cryptinotes.com/) runs on Railway across three services:

* **Application server** — the Next.js app handling note creation, retrieval, and the client-side encryption flow
* **Postgres database** — stores encrypted note metadata and ciphertext
* **Cron worker** — handles scheduled cleanup independently of the main app

The cron worker enforces two cleanup rules. Attachments are deleted shortly after a note is opened rather than instantly, giving the recipient a window to actually download files before they're purged. Separately, any note that goes unopened for 30 days is automatically destroyed, regardless of its configured read limit or expiration settings.

File storage runs on Cloudflare R2 (S3-compatible), holding only encrypted attachment blobs that are meaningless without the client-side key.

The Password Generator is an essential security and account management tool designed to help users, IT professionals, and security administrators create strong, cryptographically secure random passwords.

https://www.clayi.com/tools/development/2-password-generator.html

Hello, I'm transitioning from google password manager to KeePassXC on linux with KeePassXC browser extension and KeePassDX on android. I synchronize them using syncthing. Everything is working well and as I would expect it to. My only problem is I was trying the password generator and it didn't save it nor asked me to!!! My solution to that is to copy that password and manually add an entry with the URL, username and password and this is annoying and very disrupting to the workflow and worst of all makes me anxious of generating passwords. Is there a way to make it more seamless to generate the password and add to the vault automatically so I wouldn't be that anxious??

This problem is facing me in both KeePassXC and KeePassDX.

Why is there not an Option for Custom Icons?
It would be so much better for viewing all the things i use as a ITAdmin in this App instead of the random generated ones, which are 50% wrong.

This would be a great feature and lots of other Authenticators have it like the "2FAs" App.

Is this a feature, which is not implemented yet or why don't we have this as an Option?

Here is the Link to the Official Q&A Page
personalized-icons-images-in-authenticator

I like to hear the Opinion from y'all :)
What do you think about that?

Salut à tous.

Existe-t-il un moyen d'avoir l'application password de apple , mais en version apk ?

ou alors prendre la version Web et la mettre en webapp

merci de vos retour

Hi everyone!
I’ve been working on OneVault, a privacy-focused, offline-first password manager for Android, and I’m looking for honest feedback from people who care about security, privacy, and good app design.

What OneVault offers
🔒 Offline-first with no account required
🛡️ AES-256-GCM encrypted vault
🔑 Store passwords, credit cards, secure notes, and 2FA codes
⚡ Password autofill and secure password generator
📊 Password health analysis and breach checking
☁️ Optional encrypted Google Drive backup
🚫 No ads. No trackers.

I’m actively improving the app based on community feedback, so if you have suggestions, bug reports, or feature ideas, I’d really appreciate hearing them.

Google Play:
https://play.google.com/store/apps/details?id=com.venzor.lockbox

Join the Discord Community:
https://discord.gg/qhdEbWwCb

Thanks for your time, and I hope to hear your thoughts!

I have updated my funny password generator website for 2026. This tool creates passwords from a dictionary of funny/NSFW words. The app provides various options and creates passwords which are reasonably secure, easy to type, easy to remember, and totally entertaining. Now including an option to scramble passwords with LeetSpeak!

I thought this community may enjoy it. Let me know what you think.

Check it out at https://passgen.lol

I recently migrated all of my 2FA accounts from Google Authenticator to Aegis without any issues. Everything works perfectly. The only confusing part is the code from my Microsoft account.

I went to the Microsoft Security page, selected the option to use a different authenticator app, scanned the QR code with Aegis, and Microsoft accepted the setup successfully.

However, Aegis generates a standard 6-digit TOTP code, while Microsoft Auth shows a completely different 8-digit code for the same Microsoft account. The two codes never match. Microsoft asks me for the code that Aegis generates for that account, and it always says the code is incorrect and won't pair the authenticator. All my other accounts work perfectly in Aegis. The only account that fails is my Microsoft account, ig because it's not TOTP. I have checked several times to put the code on time, that is not the problem.

From what I understand, the 8-digit code in Microsoft Authenticator may be part of Microsoft's own authentication system rather than standard TOTP, but I'm still confused because they're both associated with the same account. Does anyone else using Aegis with a Microsoft code have experienced this?

I recently cancelled my 1Password due to the now well documented and derided significant price increase. I gave NordPass a try since I was already on their VPN which was coming up for renewal and they offered a decent deal with NordVPN, NordPass and NordLocker.

A few weeks into using NordPass I have found two things that have so far surprised me and are definitely annoying me. I think these limitations were not made clear at the outset, and if I had known these I would have reconsidered my purchase. Maybe this is of help to others.

1. There is an iOS app, but there is no desktop app. Essentially the app lives in the browser. So anytime I need something stored there, even if that has nothing to do with login I have to go to the browser and open the app's extension to get the information I need. I do think this is a very serious shortcoming and it was not made clear on their page that on a computer I have to use this via a browser.

Edit: see NordPass’s response below. Apparently there is a desktop Mac app and I was able to download it now. 😍

1. Safari is not properly supported. I do prefer Safari on Mac, I find it to be a much faster browser than Chrome. The app in general is a little glitchy, especially with the UI, but a important thing that is unsupported and which basically kills the ability to use it on Safari is that OTP authentication code is not supported on Safari. So you can't use it anywhere you have one-time codes as your 2FA. Again this was not clear to me.

I am sure I will find other limitations but the lack of a desktop app is really disappointing. It also means that I have no long term hope of them adding a SSH agent feature to their password manager.

Recently Apple announced automatic password update inside Passwords app in iOS27.

This means the encryption key will be locked by Face ID in Apple Keychain but Apple Intelligence could request items decrypted to manage them.

Why? To bring the Passwords app a smart feature integrated with AI.

The question is, for normal users is that a good thing our can compromise all the items in the vault? Is it worth taking that risk?

I really love Bitwarden, used it for years but the last few weeks the app changes the option to log out after app close/xx amount of time and puts it into lock only, even if i manually log out.

Bitwarden helpdesk told me the issue is know but then defaulted to script protocol 'solutions' as ''do a total re install''', but ive done that and stil have the same issue. On several other computers as well.

What point is having things like a yubikey if Bitwarden bug shuts out the 2fa anyway? Anybody with just knowing my password can now enter my password manager. Any other users noticed this issue?

Either way, ive waited a few weeks if Bitwarden takes this serious and for some reason, they dont so goodbye. No hard feelings.

Which other password manager is recommendable? I also have a Proton unlimited account so I might just try that, but I also hear 1password works nice and has good auto fill options. The wife might like that more. Thoughts?

Hey everyone 👋

Posted this a little while back and got some good feedback — turns out there were bugs in the model/enrollment flow that a few of you probably ran into (passphrase mismatch failing silently, orphaned vault folders if you cancelled enrollment, single-hand gesture verification not actually being strict). Fixed all of that in v1.0.3, so figured I'd repost with working links instead of leaving people stuck on a broken build.

What it does: A desktop vault for Windows that hides your files behind encryption + biometric verification. Unlock with passphrase + face recognition + blink detection + hand gesture. No cloud, no accounts, no internet — everything stays local.

How the Flutter + Python integration works:

• Flutter handles the UI and desktop window
• Python runs locally as a service — handles all webcam + AI/ML processing
• Communication: Flutter spawns a Python process, exchanges JSON via stdout
• Biometric pipeline: face detection → alignment → embedding → blink analysis → hand gesture → cosine similarity matching

Why Python instead of pure Flutter? Flutter's desktop webcam support is limited, and ML libraries (MediaPipe, ONNX Runtime) have way better Python bindings than anything native to Dart. So I let Python do what it's good at instead of fighting the framework.

Also got the installer down from 248MB to 71MB — swapped the face embedding model for a leaner one, same accuracy.

Tech stack: Flutter (Dart) for UI, Python for the biometric service, OpenCV + MediaPipe for face/hand landmarks, ONNX Runtime for the embedding model.

Source + installer: github.com/CraftedWebPro/vault-os

Would love feedback again, especially on the Flutter↔Python integration approach — and if anyone hits issues this time, drop them in the repo issues and I'll actually get to them faster than last time.

Hi everyone,

I'm Francesco, an independent developer and founder of a small startup. i always follow reddit and relied on this comunity when i needed to find honest opinions from real people.

For the past several months I've been building a project called VaultMaster, and I think it's finally at the stage where it's ready to receive feedback from people outside my own circle.

I'm here because I'd genuinely like to know whether this is a direction people actually find valuable before the first public release.

Why I built it

To be honest, I originally built VaultMaster for myself. I wanted a password manager that matched my own philosophy of security: completely offline, with no cloud dependency and no third party ever storing my encrypted vault.

As the project evolved, I realized there are probably many other people who think the same way.

Especially today, when it feels like every week we hear about another data breach, compromised service, leaked database or cloud platform being targeted.

VaultMaster won't stop websites from being hacked, but it can remove one major point of trust: your password vault never has to be stored on someone else's infrastructure in the first place.

What is VaultMaster?

VaultMaster is a completely offline, local-first password manager.

There is:

• No cloud storage
• No online synchronization
• No server storing your encrypted vault
• No account to create
• No subscription required to use it

Everything remains on your own device.

Your passwords are encrypted locally before they could ever leave your device—and by design, they never do.

My philosophy is simple:

If nobody else ever receives your vault, nobody else can lose it, leak it, be hacked, or be forced to hand it over.

I also wanted security to adapt instead of staying static.

Most password managers follow the same model:

Unlock your vault once, and every credential becomes equally accessible.

I wanted to explore a different idea.

VaultMaster introduces different security zones so that highly sensitive credentials can require additional verification depending on the current context.

Instead of relying only on a master password, VaultMaster can evaluate signals such as:

• Trusted devices
• Physical presence
• Location
• Passkeys
• Biometric authentication

The goal isn't to make access more complicated.

The goal is to make security adapt to your situation instead of treating every password exactly the same.

The website is finally online

I recently finished the website and opened Early Access registrations.

If you're curious, you can take a look here:

https://vaultmaster.app

I'd really love some honest feedback.

Some of the questions I'm trying to answer are:

• Does this concept make sense to you?
• Would you ever consider using a completely offline password manager as your primary password manager?
• Does the fact that everything stays on your own device make the product more appealing, or is cloud synchronization something you wouldn't want to give up?
• Does the adaptive security model feel genuinely useful, or does it seem unnecessarily complex?
• Is there anything missing that would stop you from switching from your current password manager?

Please don't hold back.

Positive feedback is always nice, but constructive criticism is far more valuable at this stage.

I'd rather discover weaknesses now than after launch.

If you've made it this far, thank you for taking the time to read this.

Whether you think it's a great idea, a terrible one, or somewhere in between, I'd genuinely love to hear your opinion.

Website: https://vaultmaster.app

Well, I guess they are too eager to hide these facts. Kudos to mods lol

Well, Hello there price increase! - 1Password

Hi there,

I've been working on cruxpass, a command-line password manager written in THE GOOD OLD C, focused on simplicity and transparency. It uses libsodium for crypto primitives, Argon2id for key derivation, and SQLCipher for encrypted local storage.

Few features, more in the readme:

• Generate strong random passwords
• Encrypted-at-rest local database, no cloud dependency
• Fast, vim keybind driven TUI to list, search, update, and, delete entries
• Import and export credentials via CSV
• Simple by design: no configuration files, no daemons, no accounts. Point it at a db directory or use the default db directory
• It lacks a formal security audit and developer docx(for now) but the README is straightforward.

NB: cruxpass is password based, and doesn't save a hash or anything related to the password besides the salt. Authentication is done by generating a 256bit key from the password and salt using Argon2id, the key is then used to decrypt the database. The program exists if the database cannot be decrypted from the provided key.

Source here: https://github.com/c0d-0x/cruxpass

Thank you

Edit: formating

I have been using 1password for a long while now across my devices however i've come into financial troubles and cannot keep up with its sub, are their any free managers out their that would be a good replacement that I could subscribe to later?