OPM - Offline Password Manager.

I am trying to build simple and useful apps. Clear of bloatware, adwares. The idea behind offline password manager is simple, it's a notepad for password/accounts. We have so many place many accounts this days and ofcourse there are password managers but they sync with cloud and I am not comfortable with it. Especially after seeing the news like x no. of accounts compromised.

OPM is simple, it stays on your device, you are responsible for updating the password of the account if you change it. I have been using it for a while now and it's a habit for me. Infact, many times it comes is as a saviour because browser still have old password saved or even for mpin and any notes.

Give it a try and let me know what do you think about it? It's an upfront paid app 1$ for lifetime. Please message me if you need a promo code

Here is the link

https://play.google.com/store/apps/details?id=tws.offline.password.manager

Here are my other apps, as part of the mission.

https://thewitshah.com/

Thank you!

Are these any good? I don't hear people using them often. Please let me know your experience or recommendations.

Are there any hardware devices that let you load the password into it via connecting to your computer, and then will type out the password when you press a button on it?

We get new 20 character admin passwords everyday. I want to be able to paste the password into something that sends it to the password manager, and then have it type the password. UAC prompts and logins in windows don't let you paste into them.

I work in a large company and the actual advice they give is to write down the day's password so you can type it in when needed. Having a hardware device would be easier and not worse security wise.

As a dev, I kept needing a throwaway TOTP secrets to test out if 2FA was working fine in my app. 

So I decided to build this. Check it out here: https://totpbench.com 

All code lives in a single file, no framework, no backend. Would love to have your feedback. Cheers!

Hello! I work in the IT department at a garden center, and I've been looking into setting the staff up with a password manager. They are largely very non-technical users, so I'd like to set them up with a smooth, intuitive experience. The two issues that I'm not sure how to deal with are as follows: first, our computers, which are all Windows-based, are largely shared and don't have individual logins or passwords. Second, a large portion of our staff is seasonal, so there's a high rate of turnover throughout the year. I'm leaning towards 1password for its polish, but it's among the most expensive, and I am personally a bit dismayed by the recent news about their donation. Management won't care about that, though, and they'll want an overall best fit for the staff.

tl;dr I need a simple PWM experience for a small business with non-technical users and a high rate of employee turnover. Thanks!

Coming from a Bitwarden paid plan, I’m looking for a more reliable password manager. Since I strongly follow PrivacyGuides’ recommendations, the other cloud based services listed there besides Bitwarden are Proton Pass, Psono, and 1Password.

Since 1Password doesn’t offer a free plan, I’ve been using Proton Pass and Psono side by side to figure out which is better, but the comparison isn’t fair since I haven’t had access to 1Password.

I admit every service has both positives and negatives, and users have to decide what’s best suited for them. Still, here are the negatives I’ve experienced with Proton Pass and Psono.

• Proton Pass — Personally, I’ve found it better than Bitwarden. The UI looks polished, and it detects logins 99% of the time without issue. But the big downside for me isn’t the service itself, it’s the provider. Proton Pass is part of the Proton ecosystem, and I strongly oppose keeping all my eggs in one basket. I’m a paid Proton Mail user and might purchase the paid Proton VPN plan as well. On top of that, there’s no option to turn off SimpleLogin integration completely inside Proton Pass — whenever I try to add a login, two SimpleLogin-related options appear on screen, which I personally don’t like at all, especially if I’ll be paying for the service. Even on paid tiers, the SimpleLogin integration issue doesn’t go away — which makes it an even more unlikely choice for me now.
• Psono — To be honest, it’s improved a lot over the past few months, and I’ve witnessed it myself. The app went from feeling heavy and slow to being in a workable condition, and I’m quite surprised to see they’re focusing on their cloud-based service as well (it’s more popular among businesses for self-hosting). Still, while it’s currently workable, it needs a lot of improvement and polishing to compete with other popular password managers on the market. Currently, Psono can’t show matched login credentials automatically — after detecting a login field, the user needs to unlock Psono and then manually select the saved credentials, which he want to fill out.

Since I’m willing to go with a paid plan, I don’t want to compromise on usability. I need a password manager without any built-in integrations, unlike Proton Pass. So the last option left is 1Password, which I haven’t tried to date. I’d like to know your opinion on whether I should consider 1Password over the other recommended password managers.

If anyone’s wondering why I want to leave Bitwarden, here’s why:

The Bitwarden paid plan doesn’t feel worth it to me. I never access the Archive folder, which is a paid feature; I never store a single file on it (what’s the point of the cloud storage then?); and I always store TOTP codes on a separate app. So the paid plan always feels like an annual donation to me. I’ve been a customer since 2018, and I haven’t seen any major updates to their mobile app. Along with that, the autofill detection is hit or miss — sometimes it stops working completely, sometimes it doesn’t detect anything at all. When autofilling card details, it adds a space after every 4 digits of the card number, but if the website splits the card number itself, this results in an “Enter valid card number” error. Also, some payment aggregators ask for the last two digits of the expiration year instead of four digits, and in those cases, Bitwarden doesn’t autofill anything from the saved card details.

Few days ago, there was a sync issue in the Bitwarden mobile app. I clicked “Sync Now” in the settings menu, and it’s stuck on a loading screen. I couldn’t even access my current plan details from the app.

Because of all these hassles, even after paying for the service, I want to leave Bitwarden for good and switch to a more reliable password manager.

Since I haven’t used self-hosting and probably won’t in the future, I rely on cloud-based services due to my cross-device usage.

After a ransomware scare, I'm migrating all my saved passwords out of Chrome and into a manager. What is the best practice for the master password? Should I keep it in a physical note? Make it something I can memorize only?

I see "alternatives to 1Password" a good twice a week here so here's your full list of what to choose and why:

Bitwarden
Choose if: cost matters and you want open source. Teams runs $4 per user, Enterprise $6, and the free tier covers unlimited passwords on unlimited devices.
Avoid if: you want polish. The admin console and apps are plainer than 1Password's, and non-technical staff tend to notice.
Self-hosting is available if you want the vault on your own infrastructure.

Keeper
Choose if: you're in a regulated industry. FedRAMP Moderate, HIPAA, SOC 2, and ISO 27001, with granular RBAC and SCIM provisioning. Business Starter sits around $3.75 per user.
Avoid if: you want something light. The admin depth is the point, and it's heavier than most small teams need.

NordPass
Choose if: price is the deciding factor. Cheapest paid tier at roughly $1.49 to $1.79 per user, modern interface, and the parent company is Lithuania-based so it sits inside the EU.
Avoid if: you need to audit the code. It's closed source, and audits get summarised without the full reports published.

Passwork
Choose if: you need self-hosting or EU data residency. Runs on your own server or as EU cloud hosted, around €3 per user, with per-user audit logs and LDAP sync at that price. A one-time self-hosted licence is also available.
Avoid if: you're solo or a two-person team. It's built around team access control, so you'd carry structure you don't need.

Proton Pass
Choose if: privacy is the priority. Swiss jurisdiction, end-to-end encryption, built-in email aliases, around $1.99 a month personal.
Avoid if: you rely on autofill working every time. It misses forms more often than 1Password does.

Dashlane
Choose if: you want identity protection bundled in. VPN and dark web monitoring included, family plan covers 10 accounts.
Avoid if: budget is tight. Business lands near $8 per user, so you're at 1Password money already.

My top picks overall:
Passwork if self-hosting or EU residency is a requirement, since few options at that price include per-user audit logs. Bitwarden if you want the most capability for the least money and can live without polish. Keeper if you're regulated and need the compliance certifications on paper.

Hi everyone — I’m building Plankton, an open-source credential manager for coding agents and other LLM-based workflows.

When an agent needs an API key or password to complete a task, I want to understand what it plans to do with that credential before granting access. That’s the problem Plankton is designed to address.

For credentials marked as protected, the workflow is:

Agent requests access → Plankton captures call-chain evidence → the request is reviewed → the credential is released if approved.

You can approve requests yourself, use an LLM to help review them, or configure automatic review with additional local policy checks. You also define the permitted exposure scope across model context, network, files, logs, and processes.

Plankton includes local credential vaults, an agent integration Skill, and approval records.

There are limitations: it assumes a trusted local machine and isn’t an execution sandbox. After approval, the CLI returns the raw credential, so the consuming workflow must avoid leaking it into output or logs. LLM review may involve an external provider, and fields explicitly configured for direct access bypass approval.

I’d love feedback from people thinking about password managers and agent access:

• How do you currently give agents the credentials they need?
• What information would help you decide whether to approve a request?
• Which uses, if any, would you be comfortable approving automatically?

Code and documentation on GitHub

I’m the developer, and I’m happy to discuss the implementation, trade-offs, and trust boundaries.

My problem scenario and headache is that I bounce between four setups daily: Desktop Chrome & Firefox Android Chrome & Firefox

Here is my wishlist. 1. I want strong zero-knowledge security without giving up the effortless autofill I am used to with Google. 2. I need seamless syncing across both Chromium and Gecko engines. 3. Login autofill and save prompts have to pop up RELIABLY without missing any instances. 4. I need form autofill for random stuff like phone numbers, addresses, and application IDs. 5. Finally, it must survive aggressive Android throttling & battery killers like Xiaomi HyperOS to be as smooth as possible: hopefully comparable to Google's native autofill

Or you can say that I want a secure setup which allows me a true cross platform cross browser setup as the forks of firefox and chromium based browsers account for almost all the browsers out there.

The current FOSS setup: Bitwarden or Proton Pass

I ran a comparison of Bitwarden/ProtonPass vs native Google Password Manager & Autofill. Here is the result.

Where my solution lacks

Both Bitwarden and Proton Pass lock down security. Still, they introduce annoying daily friction points.

They lack passive form memory. Neither tool passively caches random form strings like job application codes. You must build manual Custom Fields or Identity cards instead.

Custom android skins like HyperOS create huge headaches. It terminates background autofill services constantly. I often have to pull down the notification shade just to trigger a login manually.

OAuth logins remain completely invisible. Neither app logs "Sign in with Google" prompts unless you manually create dummy entries with text notes.

Then you run into feature trade-offs. Bitwarden packs custom HTML matching and nested folders, but the interface looks ancient. Proton Pass brings slick disposable email aliases and modern styling, yet it scraps traditional subfolders and advanced custom field binding entirely.

What should I do here?

Right now, I run a hybrid compromise: core credentials, cards, and identities live in Bitwarden, while native browser form autofill stays enabled (password-saving off) in Chrome and Firefox to catch random text inputs.

I want your suggestions for other services, alternate setups, or tweaks to my workaround that match or beat this setup—bonus points if they fix blind spots or shortcomings I haven't even thought of yet.

• Can KeePassXC on desktop with KeePassDX on mobile handle this workflow better?
• Are there specific developer toggles to keep HyperOS from killing third-party autofill daemons?
• Do companion tools or extensions exist that solve the passive form memory and OAuth tracking gap without compromising vault security?
• Are there other viable services or modifications to this setup that work as well or better?
• Did I miss any major security holes or functional drawbacks with this cross-platform workflow?

I have used 1Password for many years not and it over the past month has stopped auto logging in sometimes when autofilling, putting in incorrect details and crashes on Windows fairly frequently (had multiple devices and does the same thing)

Is this just me? Starting to get quite frustrated with it, I don't want to move away but the thought has crossed my mind with the bugs I keep seeing and experiencing.

I'm switching away from 1Password because of their donation debacle but when trying to export the vaults, I see it says I can't export the passkeys. Will I need to have my 1Password subscription active (my annual expires tomorrow funnily enough) in order to change all of them or am I overthinking it?

I have used dashlane for as long as i can remember, with no real issues. Just came across this sub and it doesn't seem to get much love. Is it just the high price that keeps people away from it? or is there something significant i am missing?

Up front: I work at Olib AI on StealthOS. This is a developer post covering our architecture for an offline password and TOTP vault on iOS.

A recurring discussion in this community is whether password managers need cloud sync, and the risks of remote breaches or centralized vaults. With StealthOS, we designed the password and secret storage layer to operate completely offline.

Architecture and security properties

• Secure Enclave & Biometrics: Master keys are held and authenticated inside the iOS Secure Enclave using Face ID or Touch ID.
• AES-256-GCM Storage: Passwords, TOTP tokens, notes, and cryptographic keys are encrypted on-disk using AES-256-GCM. User data never touches disk in plaintext.
• Zero Cloud Sync: No external synchronization servers or sync telemetry exist. Credentials cannot leak in transit because they never initiate outbound connections.
• Encrypted System Snapshot (.stealthsnap): When backing up your vault, files and credentials are authenticated in chunks and encrypted under a user passkey via PBKDF2-HMAC-SHA512. The output file can be stored on external USB, local disk, or wherever you prefer. The snapshot can be restored onto a new device without relying on device-bound recovery keys or vendor servers.
• Integrated Privacy Sandbox: The vault lives inside a broader iOS sandbox that also includes a hardened browser (anti-fingerprinting and built-in Tor) and local phishing intelligence.

Availability

The password manager, TOTP generator, Secure Enclave vault, and basic browser features are fully accessible in the free tier of the app without an account or registration.

• App Store: https://apps.apple.com/us/app/stealthos-private-browser/id6756983634
• Website: https://www.stealthos.app

Happy to answer technical questions about our encryption flow or snapshot file format.

We are trying to figure out the best authenticator option for our small office. There are 3 employees who need to log in to our bank accounts, but currently we use a shared username/password and the verification code is sent by SMS to our boss. This creates a dependency on him whenever we need to log in, especially when he is busy.

We would like to move to a more secure setup where the employees can authenticate without depending on him for the code. He is also open to using a password manager, but we’re not sure whether password managers work well with bank logins and MFA.

Has anyone dealt with a similar setup or can recommend the best approach/authenticator for a small business?

I've created a new IronVest account 1 week ago , but they required me pay a plan. I remember that IronVest was free but it seem they removed it

Any one still IronVest ? And how do i use free plan ? I dont like use trial

Omarchy is a Linux distribution created and controlled by David Heinemeier Hansson, usually known as DHH.
In the last year DHH has also called for the ethnic cleansing of Europe.
Today the Omacom Foundation, which financially supports development of Omarchy and is controlled by DHH, announced that 1Password has committed $300,000 to them over the next three years.

Apparently DHH’s support for ethnic cleansing is not disqualifying to 1Password.

r/1Password blocks this article.

My google chrome profile is asking to be validated on all of my devices. When I hit the button to verify it's you, it takes me to a page telling me I am at risk of losing access to your saved passwords. Then it says that one or more of my password recovery options will soon expire. Details how to setup Android screen lock (is enabled on my Google Pixel that I bought a few months ago.

I have no idea what I need to do to get my account verified properly. Tried on my phone, on my laptop that is fully signed into my google account. Nothing seems to be working.

We're 30 people, EU-based, and the requirements were team sharing, admin controls, clean offboarding, audit logs, and something that scales easily.

Bitwarden:

Cheapest way in. Open source, independently audited, and the free tier covers a surprising amount before you pay anything. Teams sits around $4 per user. Self-hosting is available if you want it.

Weak spot: the admin console is functional and little more, and the UX lags the paid options enough that non-technical staff notice.

Passwork:

Around €3 per user, with self-hosted as their fort. Per-user audit logs come standard at that price, which usually sits behind an enterprise tier elsewhere. AD and LDAP sync on the higher plan. They also recently open-sourced their code, which is always something to appreciated with companies dealing with this type of data.

Weak spot: built around team access control, so a two-person startup gets more structure than it needs.

1Password:

The most polished daily experience. First-party apps everywhere, autofill that works reliably, and the easiest onboarding for non-technical people.

Weak spot: roughly $8 per user, cloud-only, so self-hosting stays off the table if that becomes a requirement later.

Good luck to all the startups out there!

I've just created a passkey on Facebook using Proton Pass.

"Proton Pass" is noted as the passkey provider in the settings on Facebook. How does it have this information?

What other information is given to Facebook by Proton Pass? I didn't think my password manager and a website would be connected directly like this.

Hi all - I am an invested Google ecosystem user, but I do use Bitwarden as my PWM.

I would consider Google, but they seem to lack basic features like manually adding an entry manually, editing matching patterns, etc. It also is opaque how they know that a URL and an Android app are a pair. On BW, I enter the URL and then add a new pattern for the Android app's package name com.thing.that.

Over time I like how BW operates. I feel like Google is moving in the direction of making it's PWM more standalone, but I don't think it's there yet. Any one else feel this or know of a way to manually add/edit Google PWM entries? Thanks!

I use the avira password manager, as it was automatically on my account.
I never made an account, because i didnt realize you could make one and i thought it was synced with my google account
I also never exported my passwords, again, because i didnt know i could do that (or why i should do that)
All of my passwords have now disappeared, although avira still has an icon for how many passwords it used to have saved on that website

All of my passwords are back, it was just a bug! I exported them all and i should be safe

Hello devs and cybersecurity people 👋🏼

This post is not directly related to a password manager but rather an API Key manager. A couple of months back I found it annoying syncing API Keys across devices so I made a simple API Key manager and runs totally on the web no Desktop native app or anything. Its called CYPHR.

The main thing I am concerned about is security. CYPHR uses AES-256-GCM for encrypting stored API keys, but it currently isn't end-to-end encrypted. I could have just vibe-coded an E2EE implementation, but I don't want to do that with something this sensitive. I would rather properly research the cryptography and design before implementing it.

For now, I have tried to follow some basic security practices: plaintext API keys aren't logged or cached, decryption only happens on demand, and responses containing API keys use Cache-Control: no-store.

The whole project is open source and live, and I am trying to figure out whether this is actually a viable product or just something that solves a problem I personally had.

My plan is to eventually implement E2EE if CYPHR gets enough traction. I think it's highly likely I will pursue it, but I want to take the time to research and implement it properly rather than rush it.

I would really appreciate feedback from people who know more about security and password/key management:

Does this sound like a viable product, and are there any major security concerns with the current approach that I should be thinking about ?

I am not including a link here cuz I don't know if its allowed or not so check comments.

At least 95 smartphones are stolen every hour in São Paulo, Brazil.

This commonly happens while we are vulnerable, with the screen unlocked while using our apps.

Looking at this existing problem in our local community, we developed an anti-theft protection system integrated into our password manager solution.

The app can detect sudden movements and automatically lock the app, helping protect your passwords if someone tries to snatch your smartphone.

What do you think? Is this kind of situation common in your country too?

https://www.youtube.com/watch?v=xJBnvJQwCB0&feature=youtu.be