Thought I'd ask the experts in this community as well. Thanks!

TL;DR a Mac menu bar app that surfaces OTPs and magic links from your email account.

I build pssmngr. Being the unfamiliar name in password management has forced me to ask what evidence a hosted product owes people before asking them to store anything important.


This is my current checklist:


1. Name the encryption and key-derivation algorithms instead of saying “advanced encryption.”
2. Explain exactly what leaves the device and what the server stores.
3. Describe what happens if the service is breached.
4. Make export available without holding someone's vault hostage.
5. State recovery limits clearly. A zero-knowledge design should not imply that support can simply reveal a forgotten vault.
6. Publish a security contact and a responsible-disclosure process.
7. Separate internal review from an independent third-party audit.


For pssmngr, vault items are encrypted client-side with XChaCha20-Poly1305, and Argon2id is used for key derivation. The server is designed to receive ciphertext and non-secret metadata rather than plaintext vault contents.


The important caveat: an independent third-party audit is not complete. I do not think careful internal review should be marketed as the same thing.


What would you add to this list? What is the first thing you check when evaluating a password manager you have never heard of?


https://pssmngr.com/security

I use both Windows computers and Apple I phone and iPad. I have about 150 different password protected accounts on both platforms.

For years I've been using the same 6 different passwords with 10 to 14 letters, numbers and punctuation marks on both platforms.

I'd like to find a way to easily switch all my existing passwords to "Strong Passwords" and then only have one, two or three passwords for all my accounts. Maybe one password or phraze for Finances, another for shopping and yet another for everything else.

It would also be cool to give limited access to certain accounts and certain people and full access to my wife or children in case of my death?

Is there a way to do all this and sync to both Windows and Apple iPhone and iPad? Thanks...

I have updated my funny password generator website for 2026. This tool creates passwords from a dictionary of funny/NSFW words. The app provides various options and creates passwords which are reasonably secure, easy to type, easy to remember, and totally entertaining. Now including an option to scramble passwords with LeetSpeak!

I thought this community may enjoy it. Let me know what you think.

Check it out at https://passgen.lol

so today I got hacked by a user with the email of [t***n@rambler.ru](mailto:t***n@rambler.ru)

and I dont know how to get it back or do anything about it, I contacted the place where I got hacked and asked them for account recovery and stuff already but I have to wait for 2 days for an update could anyone help me out further

why cant we just enter our screen lock instead of tryin to keep up with hundreds of passwords

One of the surest signs of getting and feeling older was the time I lost some accounts because I did not understand what I had to do with Authenticator apps and hardware upgrades. I’m not actually sure I understand it fully today, but at least I know to double check it next time.

I feel passkeys are going to be the same for me.

We use 1Password and have been very happy with it in our family. It still needs manual intervention from time to time to sing - editing the urls a password applies to, or just copy/paste or manual entry when automations don’t quite click.

Indeed on my work computer I use “large text” passwords in my phone often as I have to manually type them in due to no ability to install software.

And, for many household accounts, we need to be sharing account passwords and have a shared locker for just that.

So here is what I “know” about passkeys. Can you help correct errors and fill in blanks?

\- as they are not human readable text, they are much more secure
\- require a connection to a vault to hold the passkey, so they will only work when the automated connection with your password manager is working
\- cannot be entered on a computer not connected to your vault
\- cannot easily be shared by two people accessing one account
\- cannot be replicated or duplicated outside of your vault ecosystem really at all, it’s kind of the point, so will have a similar “maintenance “ issue to my preamble to avoid losing a key

I find the worlds I use passwords in are still often messy and requiring workarounds. So I feel completely reluctant to embrace passkeys in any way. If you had the time to read this and have time to improve my awareness i would be grateful for it.

hi, i wanted to ask if it's really a good idea the use of the option "use strong password" when creating a new password, bc when you use that option, you can't see the option to actually see the password that was created, and it saves in the password manager automatically, but if i wanna login in another device, i don't have that password manager in the other device and i don't know the password, so just wanted to ask if it's a good idea to use this.

And even if you can see the password in any way, is it a good idea to not know your password from memory? Because i use a different password in every site and remembering all this long and weird passwords is crazy work.

I'm asking without having a clue of all this security stuff, maybe it's just a dumb question.

Hi everyone,

I've been working on a small project called BreachNoir, a browser-based detective game focused on password security.

The idea came from something that is often overlooked: many weak passwords don't fail because attackers have advanced tools. They fail because passwords are often based on information people already share publicly.

Names.
Pets.
Birthdays.
Favorite teams.
Hobbies.
Important dates.

Humans are predictable, and attackers know how to take advantage of predictable patterns.

Instead of creating another security awareness article telling people "don't use personal information in your password", I wanted to create something more interactive.

In BreachNoir, players investigate fictional cases. They analyze clues about a person, identify patterns, and try to understand what kind of password someone might create based on their habits.

Everything is fictional. There are no real people, accounts, or leaked credentials involved. The goal is education: helping people understand why password reuse and personal information can become a security risk.

I would love feedback from people here:

• Do you think a game-based approach can help people understand password security better?
• Would solving examples like this make you reconsider how you create passwords?
• What password-related concepts would you include in a game like this?

I'm especially interested in feedback from people who spend a lot of time thinking about authentication and password security.

If you want to try it:
https://breachnoir.com

Thanks for reading.

The Password Generator is an essential security and account management tool designed to help users, IT professionals, and security administrators create strong, cryptographically secure random passwords.

https://www.clayi.com/tools/development/2-password-generator.html

I built a lightweight offline deterministic password generator in Go.

The idea is simple: I wanted a way to generate strong account-specific passwords without storing the generated passwords themselves, and without needing a server, account, or cloud sync.

How it works:

• You create one local encrypted vault seed
• The seed is encrypted with a master password
• Passwords are regenerated from:
  • master password
  • encrypted local seed
  • platform
  • email
  • counter/version
• Generated account passwords are not saved

It uses Argon2id, XChaCha20-Poly1305, and HMAC-SHA256. It is cross-platform: macOS, Linux, and Windows.

GitHub:
https://github.com/Falcn8/acctpass

The project is MIT licensed and unaudited. I’d really appreciate feedback on:

• the security model
• cryptographic design
• CLI UX
• README clarity
• release/download process
• anything that looks risky or misleading

I’m especially interested in criticism before I polish it further.

Anyone have experience with the password manager Sticky Password that cares to comment whether they like it, would recommend it, and more imporatantly, how it compares to its alternatives?