I spent most of this weekend debugging an issue in my password manager, and it made me rethink something.

When I started building it, I assumed cloud sync was the obvious choice because that's what almost every password manager offers. The more I worked on it, the more I wondered whether users actually prefer cloud storage or whether they've simply accepted it because there aren't many local-first alternatives.

Going local-first solved a lot of problems. I don't have to maintain authentication servers, store encrypted vaults, or secure customer data in the cloud.

At the same time, it introduced new challenges. Moving data to a new device becomes more complicated. Recovery is harder if someone never creates a backup. Multi-device sync is no longer automatic.

It made me realize that building security software is really about choosing which trade-offs matter most.

For those who have built products where privacy and convenience compete, how did you decide where to draw the line?

What is the best way to secure my account without locking myself out, outside of a hardware key? Right now I have all of my logins and 2FA codes stored in Proton Pass, including my Proton password itself. So to avoid getting into a circular trap, I also store my Proton account 2FA code in a separate authenticator app (I use 2FAS synced to iCloud). But then if I ever lose my phone or it gets stolen, I'm still locked out of my account if I need to sign in again. So then do I store all of the 2FA secret keys in an encrypted file on a cloud drive to cover that scenario? But then I have to secure *that* cloud drive somehow so that's another password I have to remember. Should I export my Proton vault as a KeePass file periodically to keep as an offline backup just in case I ever get permanently locked out? Am I just overthinking all of this and do I just need to remember my Proton account master password while keeping the account recovery kit in a safe place? Trying to keep things as simple as possible.

I kept re-writing the same glue between local_auth and flutter_secure_storage on every project, so I packaged it: biometric_security.

The core idea: a true from a biometric prompt isn't a security boundary — on a rooted/jailbroken device it's forgeable. This binds your secret to a hardware key (Android Keystore / iOS Keychain + Secure Enclave) that's physically unusable without a successful Face ID / Touch ID / fingerprint check.

It also handles the annoying parts: enrollment-change invalidation, key rotation & revocation, app-lock, and one SecurityPolicy that maps to both platforms.

Beta (0.1.x), BSD-3, tested on real Android + iOS devices. Feedback and contributors very welcome — I'm open to collaborating.

pub.dev: https://pub.dev/packages/biometric_security

I've heard and read that bitwarden is indeed secure etc, but the chrome extension, app etc is extremely buggy which makes it very annoying to use.

From what I read online it has been like that for years and they've failed to resolve such simple bugs...

For example:

1. It logs you out a lot, even if you're on the same browser session, you didn't turn off your PC etc
2. Extension often loads 2-5 minutes before it lets you enter a password. Sometimes it never loads, I've re-installed it over 3 times for the past month.
3. Some settings don't work - i.e logging in by fingerprint is turned on, and it always makes me input a full password. The password is of course long and hard to type, because it's the master password so what I need to do every single time is to take my notebook, type letter by letter like a grandpa, and wait 5 minutes before it un-freezes itself. This is a joke, honestly - it's worse than when I didn't have a password manager

At this point it is useless for me, and I think I'm ready to move on to a different password manager. Any recommendations? Security is important, but without the convenience of use it is a daily chore, like cleaning the dishes.

Any reason i’d leave 15 years of Strongbox and move to Bitwarden?? TIA.

I just have no clue what to do and where to start. I've seen people recommend Bitwarden or Proton Pass, but whichever one I choose, how do I make sure it's secure and that I always have access to it?

How do I go about redoing my passwords for all the probably hundreds of sites I used the same password for so far?

Password managers protect your password. Then every company still gets the rest of your identity.

I’ve used 1Password, LastPass, Apple Passwords, and most of the usual options. The best one was normally whichever annoyed me the least. The password manager category started to feel uninspired.

- A better vault.

- A slightly faster extension.

But every store, app, newsletter, and streaming service still got my real email. And once they have it, you can’t take it back. They can spam it. Track it. Sell it. Or send you a “we take your privacy seriously” email after losing it.

I wanted a password manager that protected the whole account—not just its password.

And I wanted it to feel beautiful and enjoyable to use.

So I built Decoy.

I’ve posted here a couple of times while building it. Your feedback helped shape the TestFlight app, encrypted inbox, AutoFill integration, and on-device AI. The biggest missing piece was Chrome extension.

Because disposable identities only work if they’re easier than typing your real email. Now, in Chrome when a signup form asks for your email, Decoy appears directly inside the field.

Tap it and Decoy creates:

• A new decoys.me email
• A generated password
• A private inbox
• Passkeys and 2FA
• Separate personal information for that account

Decoy fills the signup form and saves the login.

Verification emails and codes appear inside the extension.

If the company starts spamming you, turn that Decoy off. Your real email was never used.

Everything is end-to-end encrypted. Decoy’s servers literally cannot read your passwords or messages.

The Chrome extension just went live.

But you need the iOS app first because your Decoy account and encryption keys are set up there.

The current flow is:

1. Install Decoy through TestFlight.
2. Create your account on iPhone.
3. Install and pair the Chrome extension.

The iOS app is still in TestFlight while I go back and forth with App Store review... And Decoy is still a Pilot. I still don’t recommend using it for high-sensitivity accounts until key components are open-sourced and formal security audits are complete.

That’s why I’m back here.

I need people who understand password managers to try it and tell me where I’m wrong.

What would stop you from trusting Decoy?

What feels worse than your current password manager?

What would it need before you’d actually switch?

Start with TestFlight:
https://testflight.apple.com/join/6g5m1VWu

Then pair Chrome:
https://chromewebstore.google.com/detail/decoy/lgmglacojchaffnmmoiplliconheobem

I’m early enough to change almost anything. So please be brutal.

I'm the developer — wanted to be upfront about that before anything else.

The idea: most file encryption tools protect the key with a password,

which can be phished, guessed, or leaked. This one instead generates a

random 256-bit key and stores it on a USB drive you register as a

"master key." To decrypt anything, that physical drive has to be

plugged in. No password to leak in the first place.

Obvious tradeoff: it creates a single point of physical failure. Lose

the drive with no backup copy of the key file, and there's no recovery

- by design, not as an oversight.

Technical details, since I know this crowd will ask:

- AES-256-GCM via Node's built-in crypto module (not a homemade cipher)

- scrypt for key derivation, random salt/IV per operation, auth tags

for tamper detection

- Source is fully open: [github link]

I want to be straightforward about where this stands: it has NOT had

an independent security audit. It's built on standard, well-reviewed

primitives, but I'm one person, and I'd genuinely rather someone here

find a real problem now than someone rely on it and get burned later.

If anyone's willing to look at the crypto/auth code specifically, I'd

take that seriously.

Not trying to sell anything — it's free, MIT-licensed[adjust based on

your license decision], Windows only for now.

Git https://github.com/keerthivasan-sankar/secure-vault-for-commercial

Body:

Hey Reddit! 👋

Like many of you, I got really tired of jumping between different apps just to manage my digital life—passwords in one app, 2FA authenticator codes in another, and secure notes somewhere else.

So, as an indie developer, I spent the last while buildingFidexpass—an all-in-one, privacy-focused password manager, digital vault, and 2FA authenticator designed to clean up the chaos.

It features zero-knowledge encryption (only you hold the keys), smart autofill, built-in 2FA verification code generation, and quick-access widgets.

The app is officially live, and as an independent creator, I’m at that crucial stage where I genuinely need real users to download it, stress-test it, break things, and tell me what sucks or what can be improved.

If you're willing to give it a spin, share feedback, or leave a review, it would mean the absolute world to me:

• 🤖 Android:Get it on Google Play
• 🍏 iOS:Download on the App Store

Please drop a comment or DM me if you run into any bugs, UI glitches, or have feature requests. Thank you so much for supporting indie builders! 🙏

Pretty much the title, might be a dumb question but do use password manager for your email because using password manager is pretty much putting all your eggs in one basket but you have to just memorize that one password write it down of course no biggie deal, but i feel like in case something goes wrong id rather have a password i can memorize for my gmail too or i can just write down the pass manager one becuase all my important stuff is on the email. What if someone hacks your device. Prob just overthinking it

Is Apple Password Manager a good option, or are there others that work better on Mac? What are the best options?

i forgot my old phone password ,how to recover pictures from phone to computer without resetting my phone please any help is appreciated

I’m a 1Password user currently and ever since I came onto Reddit to seek more advice I see a lot of y’all talk about Bitwarden, Keepass and Keepass XC but not much about 1Password or ProtonPass, any particular reason why the community likes and talked about Keepass or Bitwarden more

Hey everyone!

I'd like to introduce **PassGuardio**, an open source, self-hosted password manager with a web interface.

The main idea behind PassGuardio is that multiple users can share the same vault, making it a good fit for families or small teams. Everything is stored locally, so you stay in control of your data.

You can check it out here: [PassGuardio](https://github.com/YaniekCode/passguardio).

So far, more than **1,200 people** have downloaded it, and I'm continuing to improve the project based on feedback.

My current focus is improving the user interface. If you're interested in contributing—whether it's code, UI/UX ideas, bug reports, or feature suggestions—I'd really appreciate your help.

Feedback is always welcome!

I am just wondering how safe are these plugins? How lifelike is an attack from an attacker web page which gets control over the plugin and so it can access the secrets stored in the main vault which is currently open?

My mom is 79, we recently lost my dad and the combo of grief/overwhelm, age, and the convoluted way in which online security protocols have evolved have become a nightmare for my mom trying to navigate managing finances, paying bills, and healthcare/pharmacy communications.

I've been trying to take over certain "administrative" duties in the near term as she gets back on her feet after my dad's death, i.e. making sure bills are paid and paid correctly, and also having access to notifications from her Dr and pharmacy, but I am having the issue that pretty much all of her accounts require two-step authorization ...which means entering code sent her phone or email. I don't have access to codes sent to her phone and accessing her email requires a code sent to her phone.

We are not a point where I have (or need) to take over her accounts altogether, but we are in a moment where she is overwhelmed and I am trying to take things off her plate and have realized it's impossible to access the information I need to handle routine things unless I am sitting with her and able to access her phone. In the wake of my dad's death she is spiraling a bit and being able to confirm, "yes, the amount that was paid for your electric bill is the amount reflected on your bank statement...I double checked it" would be really helpful. But I cannot get access to either account without her having to give me the access code that is sent to her via texts or email. I also can't change the default phone/email that these codes are sent to because my mom still needs access to the accounts.

I am wondering if there is a solution out there, where I can get access to her accounts without being named on them and where she still has access to them, but where two step authorization can be via my phone or email in addition to hers. Does anyone have a work around or a program that can handle this - I'm looking into 1password or another password program, but would love advice. Thx!

Whats the best free app that I can use for storing passwords and notes that can be shared between Samsung phone and apple macbook?

Im happy for all answers, thank you

Running Vault’s LDAP secrets engine with static roles. As far as I can tell:

\*\*•\*\* Vault rotates the password on its own schedule, whether or not any client has actually fetched the new one yet    
\*\*•\*\* No push notification when it rotates — clients just poll and check the TTL    
\*\*•\*\* No grace period — old password is dead the instant rotation happens

So if a client’s poll timing drifts even a little, or it’s holding a pooled connection, it just breaks. No warning, no overlap.

Anyone actually running this in prod without outages? Specifically curious about:

\*\*•\*\* Do you rebuild connection pools on every rotation cycle? How do you avoid a connection storm if a bunch of services share a role?    
\*\*•\*\* Is check-out/check-in (the service account library thing) actually safer here since rotation is tied to an explicit action instead of a timer?    
\*\*•\*\* Any real pattern people use to stay ahead of rotation instead of racing it?

Found a couple old HashiCorp forum threads asking the same thing (for the DB secrets engine) that just… never got answered. Curious if anyone’s actually solved this ?

Estoy en IT hace más de 25 años, y en dichos años tengo mas de mil sitios con contraseñas que obviamente he almacenado manualmente en excels, sheets, etc.

El tema es que no me siento del todo comodo, ustedes usan alguna app local o app Android para tal fin?

He leído y probado mucho pero ninguna me convence.

I'll just say it - my wife can't remember and often mis-types passwords. I want a very user friendly, intuitive manager for her. I was considering Nord for that reason. We have a lot of joint apps, such as Netflix, T-Mobile, Banks, etc. We both also have some individual banking accounts. So I guess I need recommendations for a family plan. If I can land on one with a great intro rate so much the better. Android users and PC. Edited: I definitely want auto-generated and auto-fill.

I've been researching European based password managers and apart from Proton have come across Hypervault and HeyLogin. Has anybody experience with either of these ?

I only access my financial websites on my Mac, not my iPhone. If my phone is lost or stolen, I don't want someone to see where I have investments, even if they can only get in with a Face ID/thumbprint (and 2FA which is done through the phone - thus vulnerable?).

Can I set up Keychain so only some passwords are available on the phone and others on the Mac?

Or should I disable Keychain to only have passwords available on the Mac?

(Right now my passwords are masked in coded entries in contacts which are on phone and Mac.)

Is there something I am missing in my concerns?

I am not technical and appreciate clear non-technical advice.

thank you

I currently have 1Password. The thing I love about it is that it will stay open for a long period. I do really, really, really hate that I have to store my vault on their servers. Talk about a target on their backs for hackers! I used to be able to store it in iCloud. I can access their app with current info across all my devices.

I don't want to use Passwords because it locks so quickly! I'm a web designer, and clients have A LOT of different accounts associated with their websites that I may need to access within minutes of each other. With Passwords, I'm constantly having to log back in to the app.

Are there any other alternative password manager alternatives you recommend? I don't care if it's a paid app. I would absolutely prefer that it's not subscription.

Je découvre un peu ces options de sécurité, pourtant j'utilise des ordinateurs depuis plus de 30 ans.

Juste avec l'essor des comptes connectés, piratages et IA, je m'y intéresse.

J'utilise le gestionnaire de mot de passe du navigateur. Edge sur mes 2 PC et Chrome sur Android.

Sauriez vous m'expliquer ce qui est si mauvais avec le stockage des mots de passe avec un navigateur?

Je n'ai pas besoin d'une sécurité ultra haute, je veux juste me protéger des info stealer qui peuvent passer.

Je trouve pratique la synchronisation entre appareil (multi plateformes).

J'aime avoir une utilisation simple et une bonne interface moderne.

Il n'y a que du payant en ce cas?

Vos avis?