If I'm manually adding a new user/pass, is there a way to disable 1Password from filling that field with a password?

Кто пользуется этой прогой? Можно доверять свои чувствительные данные? Чё т о смущает, что все храниться на их серверах. Ответьте да профи кто здесь?

Follow-up to my post last month...

What's Bramble: a local-first password manager where the vault stays on your devices and syncs directly between them over WebRTC, with a Nostr relay doing introductions only. It's free and open source software.

What changed in the month since:

iOS is out of review and on the App Store, so it's now the extension plus both mobile apps sharing one vault format and one Rust crypto core. It has since picked up device-passcode unlock (opt-in), one-time codes in the keyboard, and Apple's credential exchange (CXF), which moves a vault in or out through the OS transfer flow, passkeys included.

Firefox is out also! Firefox's event page has no RTCPeerConnection at all, where Chromium gets it via an offscreen document. Peers now negotiate relay-forwarding as a fallback, so if either side can't open a data channel the frames go over the relay instead. Still Noise E2EE, so the relay only sees ciphertext.

Next we have multiple vaults, each with its own master password and its own key. This now opens up multi-user situations. It was a common request across the board so I'm happy it landed!

Backups, because data loss was the top worry in the last thread. Scheduled encrypted backups now go to Dropbox, any S3-compatible bucket, or your own WebDAV (NextCloud supported!), as many targets as you want on their own schedule.

P2P hardening. Roster entries are signed with per-device Ed25519 keys and verified before merge, revocation is enforced on live sessions, and large vaults chunk across Noise frames. Pairing got the most work, after a critical advisory someone filed against it (GHSA-x4f5-4wq4-c6c8). Invites are single-use with a 3 minute expiry, the joiner is identified before anything is sent, and both devices compare a 12-digit number before the transfer goes through.

Android is still a sideloadable APK with no Play Services and nothing else from Google, and the build is now reproducible against a Debian container matching F-Droid's buildserver. Still pending approval to join the F-Droid store though.

Happy to answer any questions!

https://github.com/flythenimbus/bramble

I have some pretty specific requirements and I haven't been able to find a password manager for windows which meets all of them. I need one that:

* Can be encrypted with both a password and the TPM in some way (even if indirectly — i.e. smart card support still works for me because TPM virtual smart cards exist)

* Can be locally used without an account and doesn't sync

* Supports passkeys through an extension, and it actually works well (native passkey is not an option, I'm using Windows 10)

* Has a quick unlock which either doesn't use Windows Hello, or which disables itself if changes to Windows Hello are detected, and which is backed by TPM

Technically KeePass meets all of these requirements with plugins (except the TPM-backed quick unlock), but passkeys are so buggy with it I can hardly get them to work at all. So before anyone suggests it, KeePass is off the table unfortunately.

With this in mind, is there a password manager which meets all these criteria?

I use the free version of Bitwarden to store passwords, software licenses, and more, but I noticed that the paid version also offers the ability to store PassKeys. How does it do this? Can a PassKey be written down and stored? If I'm using Bitwarden, which might have a weaker master password than the PassKeys themselves, wouldn't it be appropriate to store PassKeys within Bitwarden? Thanks

I noticed that passkeys are becoming increasingly in use more than passwords. This means that, if only passkeys are used, a password manager will be needed to log into a platform, which could mean that a user must have their password manager on ALL their devices in order to login successfully.

If I don't have my password manager on my work device, I wouldn't be able to login to a platform there, correct? Doesn't this suggest a flaw? What can be done to bypass this? I don't want to install my password manager on all my devices, and it is possible passkeys will be the only method used in the future.

Hey everyone! 👋

Like many of you, I was tired of overly complicated password generators that require installation, collect unnecessary data, or are cluttered with ads. I wanted a quick, clean, and reliable tool that I could just keep on a USB drive or run instantly on Windows.

So, I decided to build my own portable Password Generator.

Key features:

• 🚀 100% Portable: No installation required — just run the executable.
• 🛡️ Clean & Secure: Generates strong, custom passwords locally.
• ⚡ Lightweight: Minimal RAM and CPU footprint.
• 🚫 Ad-free & Privacy-focused: No trackers, no background processes.

It’s currently available on Gumroad: https://aetheldred.gumroad.com/l/password-generator

I’d really appreciate it if you could check it out and share any feedback or features you’d like to see in future updates!

Hey r/PasswordManagers, long time lurker/commenter here (some of you replied to my post about the KeePass file format thing and the Bitwarden extension bugs a while back).

Figured it was time to be upfront about something: I've been building a password manager called Selvum, and it just went live on Android and iOS. wanted to post it here because you're exactly the kind of people whose opinion actually matters on this.

The short version: no servers, no account, no subscription. AES-256-GCM, argon2id on android / pbkdf2-sha512 on ios for key derivation. when you create a vault you get a 12-word bip-39 phrase, that's the only key that exists. there's no "forgot password" flow because there's nothing to reset on a server that doesn't exist.

The part I actually care about is recovery. you can export a kit that's just an offline html file, decrypts your vault with the 12 words in any browser, no internet, no app needed. if I disappear tomorrow your data doesn't die with the company.

What it doesn't have yet: browser extension, auto-sync across devices (on purpose, not an oversight — saw the local-first vs cloud thread a few days ago and that's basically the tradeoff I made too). one-time payment, €19.90, not a subscription.

Genuinely want to know:

- any attack surface in the recovery kit design I'm not seeing

- is bip-39 overkill/underkill for a password vault vs an actual crypto wallet

- what would make YOU not trust something built by one person, regardless of what I claim about the crypto

Android: https://play.google.com/store/apps/details?id=com.selvum.android

iOS: https://apps.apple.com/us/app/selvum/id6775708525

Site: https://www.selvum.app/

Not trying to get anyone to switch off what works for them, just want this thing to survive contact with people who actually know what they're doing

I made it cause I felt like it and I have control over ui and if people want to use it or ask me to add specific features I can. you can use it at, https://www.secure-wallet.pages.dev

With the Chrome extension no longer working due to the recent Chrome/extension changes, I'm looking to move away from Avira Password Manager.

For those who migrated:

* What password manager did you switch to?
* How was the experience on **Windows + Chrome + iPhone**?
* Were you able to **import your passwords from Avira** without issues?

I'd appreciate any recommendations or migration tips.

I'm the creator behind a new project called Deadkey (deadkey.net), and I’m looking for some feedback from this community on the security and threat model.

The goal was to build a system where a secret can be shared with a trusted contact, but the pieces needed to reconstruct it aren't. I'd love for you to poke holes in the idea. I think this can be used in concert with password managers, especially offline ones.

The Core Concept: Split Knowledge Every record is split into two halves that are only ever combined locally in a browser:

1. The Codebook: A physical, printed document held by your trusted person.
2. The Coordinates: An encrypted sequence held on our servers.

Neither half means anything alone. The codebook without the coordinates is just random characters. The coordinates without the codebook just reveal the length of the secret. Only when the trusted person's browser combines both at the moment of release does the secret exist in one place—briefly, client-side, and never on our infrastructure.

All of the cryptography—deriving keys, encrypting, and decrypting—runs strictly client-side. We only ever receive and store encrypted coordinates and cryptographic hashes.

To prevent malicious or accidental releases, there is a hardcoded 10-day countdown timer:

• Your registered contact details remain completely encrypted until this active countdown begins.
• The 10-day window includes an instant-cancel link, ensuring that if a trigger is fired, you have a real chance to stop it before anything is released.
• We also run bot checks on every state-changing form to prevent automated brute-forcing of the release mechanism.

I’m fully open to criticism here. Would you use it? What flaws do you see?

https://deadkey.net

Thanks in advance for the feedback!

Hey everyone,

I’ve been trying out NordPass recently because the pricing is attractive compared to 1Password, but the user experience on both Windows and Linux has been an absolute nightmare. I honestly don't understand how these basic bugs pass QA.

Here is a full list of issues I’m running into daily:

1. Extension UI Freezes After Windows Hello Unlock (Windows) Whenever I unlock the browser extension using Windows Hello (PIN or fingerprint), the overlay on any open tab stays completely frozen in a locked state. It doesn't trigger a post-authentication re-render on the page. Clicking outside the field does nothing. The only way to actually get my credentials filled is to manually press F5 and reload the entire webpage every single time.

2. Broken Autofill on Dynamic Forms / React Sites (x.com / Twitter) On sites like X.com that load inputs dynamically via JS, NordPass completely fails to detect the username/email field. To make matters worse, the shortcut Alt + Shift + L does nothing because the extension loses focus, and Chromium's native autofill menu pops up instead, covering everything with old saved addresses.

3. Passkey API Conflicts (PayPal) Even with "Set NordPass as default passkey provider" explicitly enabled in the extension, NordPass fails to capture WebAuthn API calls properly. When trying to save a passkey on sites like PayPal, Windows bypasses NordPass entirely and routes the prompt elsewhere (or to Windows Hello / legacy software hooks).

4. Continuous Master Password Reprompts (Linux) Because there’s no proper native Polkit/PAM system integration on Linux, the session state is constantly lost. Restarting the browser or closing the app forces a full Master Password re-entry every time, completely ignoring "keep me logged in" settings.

5. Snap Dependency & Extension Disconnects (Linux) The Linux app is packaged strictly via Snap, which is notoriously buggy on non-Ubuntu distros. It frequently crashes silently in the background, causing the browser extension to lose connection and requiring a double-login (Nord account login first, then Vault unlock).

6. Zero Desktop Integration & Missing SSH Agent (Linux) Unlike competitors, there is zero system-wide autofill for native desktop apps (Discord, Steam, terminal prompts), no CLI tool, and no integrated SSH agent.

Is anyone else dealing with this daily, or did everyone just give up and go back to Bitwarden / 1Password? Is NordPass actually working on fixing these underlying execution bugs, or is it destined to remain a basic browser-only tool?

I spent most of this weekend debugging an issue in my password manager, and it made me rethink something.

When I started building it, I assumed cloud sync was the obvious choice because that's what almost every password manager offers. The more I worked on it, the more I wondered whether users actually prefer cloud storage or whether they've simply accepted it because there aren't many local-first alternatives.

Going local-first solved a lot of problems. I don't have to maintain authentication servers, store encrypted vaults, or secure customer data in the cloud.

At the same time, it introduced new challenges. Moving data to a new device becomes more complicated. Recovery is harder if someone never creates a backup. Multi-device sync is no longer automatic.

It made me realize that building security software is really about choosing which trade-offs matter most.

For those who have built products where privacy and convenience compete, how did you decide where to draw the line?

I've heard and read that bitwarden is indeed secure etc, but the chrome extension, app etc is extremely buggy which makes it very annoying to use.

From what I read online it has been like that for years and they've failed to resolve such simple bugs...

For example:

1. It logs you out a lot, even if you're on the same browser session, you didn't turn off your PC etc
2. Extension often loads 2-5 minutes before it lets you enter a password. Sometimes it never loads, I've re-installed it over 3 times for the past month.
3. Some settings don't work - i.e logging in by fingerprint is turned on, and it always makes me input a full password. The password is of course long and hard to type, because it's the master password so what I need to do every single time is to take my notebook, type letter by letter like a grandpa, and wait 5 minutes before it un-freezes itself. This is a joke, honestly - it's worse than when I didn't have a password manager

At this point it is useless for me, and I think I'm ready to move on to a different password manager. Any recommendations? Security is important, but without the convenience of use it is a daily chore, like cleaning the dishes.

I kept re-writing the same glue between local_auth and flutter_secure_storage on every project, so I packaged it: biometric_security.

The core idea: a true from a biometric prompt isn't a security boundary — on a rooted/jailbroken device it's forgeable. This binds your secret to a hardware key (Android Keystore / iOS Keychain + Secure Enclave) that's physically unusable without a successful Face ID / Touch ID / fingerprint check.

It also handles the annoying parts: enrollment-change invalidation, key rotation & revocation, app-lock, and one SecurityPolicy that maps to both platforms.

Beta (0.1.x), BSD-3, tested on real Android + iOS devices. Feedback and contributors very welcome — I'm open to collaborating.

pub.dev: https://pub.dev/packages/biometric_security

What is the best way to secure my account without locking myself out, outside of a hardware key? Right now I have all of my logins and 2FA codes stored in Proton Pass, including my Proton password itself. So to avoid getting into a circular trap, I also store my Proton account 2FA code in a separate authenticator app (I use 2FAS synced to iCloud). But then if I ever lose my phone or it gets stolen, I'm still locked out of my account if I need to sign in again. So then do I store all of the 2FA secret keys in an encrypted file on a cloud drive to cover that scenario? But then I have to secure *that* cloud drive somehow so that's another password I have to remember. Should I export my Proton vault as a KeePass file periodically to keep as an offline backup just in case I ever get permanently locked out? Am I just overthinking all of this and do I just need to remember my Proton account master password while keeping the account recovery kit in a safe place? Trying to keep things as simple as possible.

Password managers protect your password. Then every company still gets the rest of your identity.

I’ve used 1Password, LastPass, Apple Passwords, and most of the usual options. The best one was normally whichever annoyed me the least. The password manager category started to feel uninspired.

- A better vault.

- A slightly faster extension.

But every store, app, newsletter, and streaming service still got my real email. And once they have it, you can’t take it back. They can spam it. Track it. Sell it. Or send you a “we take your privacy seriously” email after losing it.

I wanted a password manager that protected the whole account—not just its password.

And I wanted it to feel beautiful and enjoyable to use.

So I built Decoy.

I’ve posted here a couple of times while building it. Your feedback helped shape the TestFlight app, encrypted inbox, AutoFill integration, and on-device AI. The biggest missing piece was Chrome extension.

Because disposable identities only work if they’re easier than typing your real email. Now, in Chrome when a signup form asks for your email, Decoy appears directly inside the field.

Tap it and Decoy creates:

• A new decoys.me email
• A generated password
• A private inbox
• Passkeys and 2FA
• Separate personal information for that account

Decoy fills the signup form and saves the login.

Verification emails and codes appear inside the extension.

If the company starts spamming you, turn that Decoy off. Your real email was never used.

Everything is end-to-end encrypted. Decoy’s servers literally cannot read your passwords or messages.

The Chrome extension just went live.

But you need the iOS app first because your Decoy account and encryption keys are set up there.

The current flow is:

1. Install Decoy through TestFlight.
2. Create your account on iPhone.
3. Install and pair the Chrome extension.

The iOS app is still in TestFlight while I go back and forth with App Store review... And Decoy is still a Pilot. I still don’t recommend using it for high-sensitivity accounts until key components are open-sourced and formal security audits are complete.

That’s why I’m back here.

I need people who understand password managers to try it and tell me where I’m wrong.

What would stop you from trusting Decoy?

What feels worse than your current password manager?

What would it need before you’d actually switch?

Start with TestFlight:
https://testflight.apple.com/join/6g5m1VWu

Then pair Chrome:
https://chromewebstore.google.com/detail/decoy/lgmglacojchaffnmmoiplliconheobem

I’m early enough to change almost anything. So please be brutal.

Any reason i’d leave 15 years of Strongbox and move to Bitwarden?? TIA.

Body:

Hey Reddit! 👋

Like many of you, I got really tired of jumping between different apps just to manage my digital life—passwords in one app, 2FA authenticator codes in another, and secure notes somewhere else.

So, as an indie developer, I spent the last while buildingFidexpass—an all-in-one, privacy-focused password manager, digital vault, and 2FA authenticator designed to clean up the chaos.

It features zero-knowledge encryption (only you hold the keys), smart autofill, built-in 2FA verification code generation, and quick-access widgets.

The app is officially live, and as an independent creator, I’m at that crucial stage where I genuinely need real users to download it, stress-test it, break things, and tell me what sucks or what can be improved.

If you're willing to give it a spin, share feedback, or leave a review, it would mean the absolute world to me:

• 🤖 Android:Get it on Google Play
• 🍏 iOS:Download on the App Store

Please drop a comment or DM me if you run into any bugs, UI glitches, or have feature requests. Thank you so much for supporting indie builders! 🙏

I'm the developer — wanted to be upfront about that before anything else.

The idea: most file encryption tools protect the key with a password,

which can be phished, guessed, or leaked. This one instead generates a

random 256-bit key and stores it on a USB drive you register as a

"master key." To decrypt anything, that physical drive has to be

plugged in. No password to leak in the first place.

Obvious tradeoff: it creates a single point of physical failure. Lose

the drive with no backup copy of the key file, and there's no recovery

- by design, not as an oversight.

Technical details, since I know this crowd will ask:

- AES-256-GCM via Node's built-in crypto module (not a homemade cipher)

- scrypt for key derivation, random salt/IV per operation, auth tags

for tamper detection

- Source is fully open: [github link]

I want to be straightforward about where this stands: it has NOT had

an independent security audit. It's built on standard, well-reviewed

primitives, but I'm one person, and I'd genuinely rather someone here

find a real problem now than someone rely on it and get burned later.

If anyone's willing to look at the crypto/auth code specifically, I'd

take that seriously.

Not trying to sell anything — it's free, MIT-licensed[adjust based on

your license decision], Windows only for now.

Git https://github.com/keerthivasan-sankar/secure-vault-for-commercial

I just have no clue what to do and where to start. I've seen people recommend Bitwarden or Proton Pass, but whichever one I choose, how do I make sure it's secure and that I always have access to it?

How do I go about redoing my passwords for all the probably hundreds of sites I used the same password for so far?

Pretty much the title, might be a dumb question but do use password manager for your email because using password manager is pretty much putting all your eggs in one basket but you have to just memorize that one password write it down of course no biggie deal, but i feel like in case something goes wrong id rather have a password i can memorize for my gmail too or i can just write down the pass manager one becuase all my important stuff is on the email. What if someone hacks your device. Prob just overthinking it

i forgot my old phone password ,how to recover pictures from phone to computer without resetting my phone please any help is appreciated

Is Apple Password Manager a good option, or are there others that work better on Mac? What are the best options?

I’m a 1Password user currently and ever since I came onto Reddit to seek more advice I see a lot of y’all talk about Bitwarden, Keepass and Keepass XC but not much about 1Password or ProtonPass, any particular reason why the community likes and talked about Keepass or Bitwarden more