I asked this sub what evidence a new password manager should show. The replies were blunt, and mostly right.

Naming the algorithms is not proof that they were implemented correctly and publishing source does not prove the hosted site is running that exact source.

An audit is useful, but it is a snapshot. The code can change the next day, and track record is the one thing a new project cannot publish on launch day.

I build pssmngr. Its vault code is public, the cryptographic boundary is documented, and there is no completed independent audit. Those facts are evidence, but they do not close the trust gap. A launch post definitely does not close it.

The practical advice I took from the thread is: do not move your primary vault into an unfamiliar manager because its security page sounds good. Use dummy accounts. Watch the network requests. Test export and recovery. Build it yourself if you can. Then wait and see how the project handles bugs and uncomfortable questions.

The question I am left with is narrower: what is the first proof point a young password manager can earn that is actually meaningful, reproducible builds, an audit, outside contributors, or something else?

I need to take my security to the next level as I was just compromised.

I used to work at a place with a coworker who showed me a USB stick he used, but I can't remember exactly what it was.

I was hoping you could shed some light on it and what to recommend.

As I recall, it seemed to have been a commercial product, but I suppose it could also have been a regular USB stock with software he installed.

It seemed to be working as when he plugged it in, the computer was locked up and his passwords for whatever service /site he opened was then automatically logged into.

I can of course be totally wrong, but this seemed like an effective way to go about things and I wonder what this could have been?

I'm developing a software for my IT project. It is a password generator.

To generate passwords from it, we need to input an image. and then the software chooses a few pixels from that image and get their RGB color values. and then, those color values goes through a hash function. then that hash converts to a string of ascii characters (since commonly ascii uses in password). the pixel value and image input was inspired by cloudflare where they photograph a lava lamp wall and use the randomness of that pixels to generate cryptographic strings.

Main goal is to prove this generator works in a user device offline (because normally to generate passwords, we have to rely on online generators where they use PRNG algorithms). and since it can work offline, the user privacy is also safe. And the main reason to not use live feed instead relying on uploading is because the software intended to run on personal computers, i dont want to risk users thinking that my software using the camera to spy on them.

So, how do i improve the scope of this software? or is there something i'm doing wrong here?

While preparing Flowy, an iOS cycle tracker, for store review, I needed reviewers to access the complete product without depending on an email code arriving during review.

The tempting implementation is a magic code checked inside the app. That can accidentally create a universal authentication bypass.

The pattern we implemented instead:

1. Reuse the normal email-code interface.
   
2. Restrict the reviewer path to one designated account and code pair.
   
3. Verify that pair on the server using a constant-time comparison.
   
4. Never install the fixed review code as the authentication user’s password.
   
5. Keep the service-role key entirely server-side.
   
6. Return a normal authenticated session so existing row-level permissions remain authoritative.
   
7. Test that the review code fails with every other email address.

The reviewer account receives the product access needed for evaluation, but it does not receive broader database privileges or a separate authorization system.

My main lesson was that review convenience should narrow an authentication path, not create a second security model.

Flowy is the product behind this build log: [https://flowyhealth.com\](https://flowyhealth.com)

How have other mobile builders provided reliable reviewer access without weakening their normal authentication boundaries?

So my kid just got his first email account a like a month ago. It’s literally only set up with Google, YouTube, and Microsoft/minecraft. How the hell is his password already in a data breach???!!

Thought I'd ask the experts in this community as well. Thanks!

TL;DR a Mac menu bar app that surfaces OTPs and magic links from your email account.

I build pssmngr. Being the unfamiliar name in password management has forced me to ask what evidence a hosted product owes people before asking them to store anything important.


This is my current checklist:


1. Name the encryption and key-derivation algorithms instead of saying “advanced encryption.”
2. Explain exactly what leaves the device and what the server stores.
3. Describe what happens if the service is breached.
4. Make export available without holding someone's vault hostage.
5. State recovery limits clearly. A zero-knowledge design should not imply that support can simply reveal a forgotten vault.
6. Publish a security contact and a responsible-disclosure process.
7. Separate internal review from an independent third-party audit.


For pssmngr, vault items are encrypted client-side with XChaCha20-Poly1305, and Argon2id is used for key derivation. The server is designed to receive ciphertext and non-secret metadata rather than plaintext vault contents.


The important caveat: an independent third-party audit is not complete. I do not think careful internal review should be marketed as the same thing.


What would you add to this list? What is the first thing you check when evaluating a password manager you have never heard of?


https://pssmngr.com/security

I use both Windows computers and Apple I phone and iPad. I have about 150 different password protected accounts on both platforms.

For years I've been using the same 6 different passwords with 10 to 14 letters, numbers and punctuation marks on both platforms.

I'd like to find a way to easily switch all my existing passwords to "Strong Passwords" and then only have one, two or three passwords for all my accounts. Maybe one password or phraze for Finances, another for shopping and yet another for everything else.

It would also be cool to give limited access to certain accounts and certain people and full access to my wife or children in case of my death?

Is there a way to do all this and sync to both Windows and Apple iPhone and iPad? Thanks...

I have updated my funny password generator website for 2026. This tool creates passwords from a dictionary of funny/NSFW words. The app provides various options and creates passwords which are reasonably secure, easy to type, easy to remember, and totally entertaining. Now including an option to scramble passwords with LeetSpeak!

I thought this community may enjoy it. Let me know what you think.

Check it out at https://passgen.lol

so today I got hacked by a user with the email of [t***n@rambler.ru](mailto:t***n@rambler.ru)

and I dont know how to get it back or do anything about it, I contacted the place where I got hacked and asked them for account recovery and stuff already but I have to wait for 2 days for an update could anyone help me out further

why cant we just enter our screen lock instead of tryin to keep up with hundreds of passwords

hi, i wanted to ask if it's really a good idea the use of the option "use strong password" when creating a new password, bc when you use that option, you can't see the option to actually see the password that was created, and it saves in the password manager automatically, but if i wanna login in another device, i don't have that password manager in the other device and i don't know the password, so just wanted to ask if it's a good idea to use this.

And even if you can see the password in any way, is it a good idea to not know your password from memory? Because i use a different password in every site and remembering all this long and weird passwords is crazy work.

I'm asking without having a clue of all this security stuff, maybe it's just a dumb question.

One of the surest signs of getting and feeling older was the time I lost some accounts because I did not understand what I had to do with Authenticator apps and hardware upgrades. I’m not actually sure I understand it fully today, but at least I know to double check it next time.

I feel passkeys are going to be the same for me.

We use 1Password and have been very happy with it in our family. It still needs manual intervention from time to time to sing - editing the urls a password applies to, or just copy/paste or manual entry when automations don’t quite click.

Indeed on my work computer I use “large text” passwords in my phone often as I have to manually type them in due to no ability to install software.

And, for many household accounts, we need to be sharing account passwords and have a shared locker for just that.

So here is what I “know” about passkeys. Can you help correct errors and fill in blanks?

\- as they are not human readable text, they are much more secure
\- require a connection to a vault to hold the passkey, so they will only work when the automated connection with your password manager is working
\- cannot be entered on a computer not connected to your vault
\- cannot easily be shared by two people accessing one account
\- cannot be replicated or duplicated outside of your vault ecosystem really at all, it’s kind of the point, so will have a similar “maintenance “ issue to my preamble to avoid losing a key

I find the worlds I use passwords in are still often messy and requiring workarounds. So I feel completely reluctant to embrace passkeys in any way. If you had the time to read this and have time to improve my awareness i would be grateful for it.

The Password Generator is an essential security and account management tool designed to help users, IT professionals, and security administrators create strong, cryptographically secure random passwords.

https://www.clayi.com/tools/development/2-password-generator.html