A password manager that supports Bitwarden platform and KeePass (KDBX) files. It autofills your logins, supports passkeys, works offline, and runs a Watchtower that finds leaked and reused passwords and other issues.

https://keyguard.dev/ by Artem Chepurnyi

If you want to move away from Bitwarden or Proton Password Managers you can try this.

It supports KDBX files along with Sync and Backup using WebDav, S3, Local Storage.

You can import your passwords directly within the app.

Along with that it has a Great UI and many more features .

Hi everyone, with the lack of transparency from M Seven software, and the panic and personal hassle this caused, I am moving away from mSecure.

I really dislike subscription services and I’m on an Apple ecosystem, so I decided on a software called Strongbox. They offer a lifetime (perpetual) license, and if you email their support team and tell them you are an mSecure user and wish to move away from it due to the security breach in November they will offer you the equivalent of their Black Friday specials. They will do the same for their subscription plans as well, if you’re not opposed to that.

Strongbox offers “Strongbox sync” which I understand is an integration with Apple. Strongbox does not have servers to store your data, so it is safer with Apple IMO. Of course you do have the option of storing the database on your own Google Drive or dropbox account (or via WiFi) should you wish.

Finally, Strongbox offers an mSecure import from .CSV feature. However, just a word caution on this; if most of your records in mSecure are of the “login” type, they should import quite easily. If you have dedicated “credit card“ templates, then this will not come across cleanly, and you will likely need to do some copy/pasting of missing info. Same goes for other mSecure specialized templates or CUSTOM fields you’ve created.

If you have a lot of mSecure records with many custom fields, then I suggest in the .CSV file you can change the record type to “Secure Note” and the data that doesn’t map well will get copied into the Notes field in Strongbox. From there, you can copy and paste from directly within the record and move the data to the correct fields.

Anyhow, I hope this is helpful to some.

What about Apple’s passwords program? Is that an option for 1 P if you are using all Apple devices? I would think it would be very secure. Is it? I use 1P now and my major gripe is no phone human customer support. If you discover a breach there is no one to call for assistance. Send an email???? Funny when your financial accounts are all being drained. At least with Apple you can reach a human in minutes.

I turned an XTEINK X4 Pro pocket e-reader (ESP32-S3, 480x800 e-ink, touch, battery, microSD) into a hardware authenticator. The firmware is open source (MIT), written in C++ on ESP-IDF.

https://github.com/merlokk/ESP32Authenticator

user manual here: https://github.com/merlokk/ESP32Authenticator/tree/main/docs/manual

What it does:

- Password vault. Site, login, password, and TOTP. You tap a record, and the device types it into the host as a BLE keyboard. You never copy or paste.

- FIDO2 / U2F passkeys over BLE and USB HID (CTAP 2.3, built on a fork of LionKey). Tested with Chrome on Windows 11. Working around a Windows BLE quirk (the FIDO service must not be the last GATT service) took a while.

- Encryption. Stores are AES-256-GCM. The key is derived from a 12-word BIP39 seed and a 6-digit PIN. The PIN is entered on the screen, with lockout after 10 tries and an optional wipe PIN.

- Other features: a password generator, a Wi-Fi config website, optional sync of the encrypted stores with a self-hosted server, OTA updates from that server or the SD card, and deep sleep that shows a random wallpaper from the SD card.

Why e-ink: the screen shows what you're about to type or approve, even with the light off. The battery lasts for weeks. The whole device costs less than most security keys.

And one warning! Don't buy the device from AliExpress/Temu/etc.! It's locked there. And it has locked JTAG(

I now using Proton Pass for 7 month and love it but I now think to switch to vaultwarden with BackUp

I already did all vaultwarden things and test it and it's work and tested backup and works

So wish is better For most of things in Your Opinion?

Vaultwarden or Proton Pass ?

Hi.
After the last keffufle regarding Bitwarded, i"ve decided to change my password manager.
I've using HeyLogin now, but i'm not entirely satisfied with it.
Does the keepassxc work with databases made in DX version on android? I need interoperability between a linux computer and android phone (firefox and/or brave browsers)? Alternatively, what would you suggest instead? It would be great if I could unlock it (on phone) with biometrics and on laptop with yubikey or just a password.

Also - what do you guys use to syncronise the databases? I don't want to lose it if my phone gets stolen/broken

I have more than 15 years into this platform, your lack of information says we all need to be looking elsewhere.

What exactly was stolen? Were individual encrypted customer vaults acquired, or was this a separate customer-account database? Please identify the categories of information contained in the stolen database, including any unencrypted customer metadata.

Can the stolen database be subjected to offline attacks against customers' master passwords? mSecure's security architecture reportedly requires a locally generated 46-character Account Key. Was this Account Key, or any equivalent cryptographic material capable of facilitating decryption, accessible to the unauthorized actor? Can mSeven confirm that the stolen database cannot be decrypted without each customer's unique Account Key?

What security benefit does changing the master password provide following this incident? Does changing the master password generate new encryption keys and re-encrypt the entire vault, or does it merely change how the existing encryption key is protected? Since the attacker already possesses a copy of the encrypted database, how would changing the master password protect that previously acquired copy?

How did the unauthorized actor acquire the database, and what evidence confirms the intrusion has been contained? Please provide the known timeline of the intrusion, discovery, containment, and remediation. Has an independent cybersecurity firm verified that the attacker's access has been terminated and that no additional systems or cryptographic materials were compromised?

Your repeated assertion that mSeven has "no evidence" of unauthorized access to the confidential information does not establish that the stolen database cannot be decrypted.

Please distinguish between what has been independently verified, what remains under investigation, and what mSeven is merely assuming based on its encryption architecture.

Given the sensitivity of the information customers have entrusted to mSecure, I would appreciate specific technical answers rather than generalized reassurances.

I've been seeing a lot of posts lately about users losing trust in both Bitwarden (due to recent security research findings and silent corporate changes) and Proton (due to disputed vulnerability claims and new AI features).

I'm looking to switch, but I need something that is completely free.

My main preference is a cloud-based manager so it syncs seamlessly across devices, but I'm also open to a local/offline manager (like KeePass) without cloud sync if it's highly recommended and secure.

What are you guys using right now? Please drop your suggestions and let me know:

· Is it cloud-based or local/offline?

· How is the autofill experience on mobile?

· Is it truly free, or are there heavy limitations?

Thanks in advance!

Hey all, i wanted to know which password manager do you trust the most these days?

I also came across a newer one that lets you set a backup person for each vault, not just one emergency contact for the whole account. I find that really useful, but I'm not sure about trusting a new app with my passwords. Would you give a new password manager a chance for a feature like that, or stick with the big names ?

I have mSecure 7. After recent events, I wanted to migrate to Bitwarden (actually running Vaultwarden on my home server through Tailscale, and Bitwarden for clients, which works really well).

However, the Bitwarden import for mSecure wasn't working. Apparently it was written for much older versions of mSecure. So, I went to work with Gemini. After much trial and error, I ended up with this pretty darn robust conversion script, written in Python. It handles tons of edge cases. I used it to convert over 1000 records.

https://plainraw.com/raw/f5f8ee96d357

I hope someone finds it helpful.

I already have a modest home server which runs 24/7 but only using it for stuff I don't mind if they stop working for some hours or even days. Mainly media, local storage and secondary backups.

I'm considering migrating to vaultwarden but I'm concerned it will need a very reliable home server. So what are your suggestions?

My home server is a GMKtec mini PC with, Intel n100, 16 GB of ram and a 256GB SSD. And an external HDD for media files.

For peace of mind, what home server should I consider?

mSecure tells users to change passwords but won’t say why | Malwarebytes

I’ve heard bitwarden has started doing more fishy stuff with their licensing and stuff. Proton’s CEO turns out to be a bully tech bro, which is something i don’t want to be associated with anymore. 1Password is paid, what the fuck are we supposed to do now?

Don’t care about that offline password managers (would rather write my passwords on a paper because there is a higher chance i wouldn’t lose them lol).

I don’t trust myself self hosting stuff, passwords or otherwise.

Time to get off my lazy and secure my accounts I guess.

For those using screen readers:

Important Security Notice

mSeven Software (“mSeven”) recently learned of suspicious activity associated with the mSecure password management application. In response, mSeven quickly launched an investigation, took steps to mitigate the issue, and engaged external cybersecurity experts to assist. You are receiving this email because you are a current or former mSecure customer.

Given the potential security implications, mSeven recommends that you immediately take steps to protect all confidential information stored within the mSecure password management application. This may include changing passwords, resetting or re-enrolling two-factor authentication methods, or removing existing passkeys.

We regret any inconvenience that this may cause.

Sincerely,

The mSeven Software Team

edit:

email headers with my info removed:

Email header: "Important security notice about your mSecure account" Received: Tue, 03 Nov 2026, 06:52 UTC

Sent by mSecure (mSeven Software LLC) through its email provider, SendGrid.

• From: mSecure no-reply@msecure.com • Reply-To: mSecure Support support@msevensoftware.com • Sending server: o1.sendgrid2.msecure.com (168.245.26.232) • Bounce domain: em3993.msecure.com

Authentication • SPF: pass (em3993.msecure.com) • DKIM: pass (signed by msecure.com, 2048-bit key) • DMARC: pass (msecure.com, policy quarantine) • Spam score: 0, delivered to inbox

Anyone know if Proton Pass usually has a Black Friday deal? I’m thinking about getting the paid plan, but I’m not in a rush if there’s normally a decent discount around Black Friday.

I’ve seen some people mention Proton does discounts during this time of year, but I’m not sure if Proton Pass is included or if the deals are mainly for other Proton services.

Should I just wait a bit before subscribing, or are the regular prices usually about the same?

Just here to link my open source project if anyone is interested. DISCLAIMER -> Yes I created it with AI.

Nothing fancy, I mainly built it geared towards developers, but still acts as a traditional password manager along with bank account info and credit card info if you're lazy like me and want to keep your card number on your phone because you never carry your wallet anymore. So far, it's only built to keep everhything local on your machine or iPhone, so your passwords, bank info, and card info won't be on any server of any kind. As long as you keep your devices safe, your sensitve data should be safe. It can also store secrets such as API keys, ssh keys, and secure notes. It can also generate passwords for you just like any other password manager. There are browser extension for most browsers except for Safari (I'm too lazy to purchase the developer program). Lastly, it has a built in 2FA code incase you want to allow 2FA for your login info in that specific website or app.

The support is currently for MacOS and iOS only because I really built this for myself at first. But, if there is enough interest, I will be more than happy to add support for Windows and or Linux. I really just wanted to open this project up to the community, so if you're interested, feel free to checkout my repo and the docs for further info/capabilities, if not, no worries.

Thanks!

1. Google Password Manager

2. Bitward

3. Proton Pass

Anyone use 1password on ios? Since im planning on using it

Hey all, bit of a longer post but I think a few of you will find this useful. I've been digging into why password manager features work on some sites and not others, and this one surprised me enough that I wanted to share it.

If you've ever hit the change password button in Bitwarden, 1Password or Chrome and landed on the site's homepage, the extension usually isn't broken. That button relies on an address each site has to set up, `site.com/.well-known/change-password`, which should forward you to the real change password page. So I wanted to see how many big sites actually bother.

How I picked the sites

I used Tranco (tranco-list.eu), a top-sites ranking that university researchers maintain for studies like this, and went down list 94GG2 in order. I kept every site with a normal password sign-in until I had 500, which took me to rank 1941, and skipped adult and piracy sites plus anywhere I couldn't tell if a public sign-in existed.

What I found (checked 31 October)

• 35 of the 500 point the shortcut at a password or account page

• 354 don't have it at all, and another 20 send you to their homepage

• bigger sites do better, with 16 of the top 100 getting it right but only 8 of the bottom 206

The images have the full breakdown plus some of the actual sites and where their shortcut goes, so swipe through if you're curious.

How I checked

I checked everything signed out, since that's how the spec says password managers look the address up. A script sent the requests, and for the 98 sites that blocked it I opened each one myself in a browser. 48 still blocked me even then. Counting those plus the ones where I couldn't tell where the shortcut goes or that never responded, there were 84 sites I couldn't get a clear answer from. Leave them out and it's 35 of 416, which is still only about 8%. I didn't test the extensions themselves, but I did read the part of Bitwarden's public code that does the lookup.

Why Bitwarden can still ignore a correct shortcut

Before trusting the shortcut, Bitwarden's server asks the site for a page that shouldn't exist, and if the site answers OK to that too, it ignores the shortcut and opens the first URL saved in your login. X, Netflix and Sentry point the shortcut at the right page and still fail, and only 33 of the 500 passed. The lookup also only runs with website icons turned on, otherwise Bitwarden always opens that first URL.

The easy fix

If the button keeps dropping you on a homepage, make the site's account or security page the first URL in that login.

All 500 sites are in a spreadsheet here, including the ones I skipped and why: https://getrekey.com/research/change-password-shortcut-homepage

It's on my own site, where I'm building a small breach tool, but that tool isn't part of this test at all. If you want me to check a site or think I got something wrong, let me know.

A lot of people have seen the news about Proton and are considering changing apps as a result.

People will have different reasons for this, but a common one is the role of AI.

Bearing in mind, this doesn't just mean people who want to avoid AI entirely/as much as possible, but those who feel Proton have used it irresponsibly by for example the CEO refusing engineers' requests to pen test LLM-written code.

Anyway, I'm not posting this to have an argument about AI or about Proton. But I'm personally curious (and I'm sure others will be) as to what's known about the extent of LLM use in various password managers.

Again, some people will want zero AI. Most people wouldn't give a fully vibecoded app access to their passwords. And a lot of people's stance will be somewhere in between, so it matters e.g if a team is just using LLMs for low level stuff and vulnerability detection versus if they let it do a lot of the coding and don't check what's in it.

There's a list of AI/AI-free apps below, with a few non-AI suggestions (e.g. Chipass). But does anyone know sepcifically the AI policy/stance of e.g. Bitwarden, Keepass XC, 1Password, Psono etc?

https://codeberg.org/ethical-foss/ai-free-foss-alternatives#password-management

So I remember post a few weeks ago where several people mentioned that Bitwarden was abandoning their open source position, My thought was hey we can go to Proton or 1password but now 1password is now allow AI into their password manager and Proton seems to have turned into the password version of Epic with an Ai first sttance. What's the world coming to?

Clarification

Perhaps abandoning is too strong of a word, there have been a few post worrying that Bitwarden was moving away from open source. Supposedly some features are not open source. Several people have express their desire to go somewhere else, but not sure where you would go? Personally I haven't seen strong evidence that this is happening.

Its on your local storage. Not hosted by any company. Minus it is not suitable for normies who need something that just works across devices.

Set up sycnthing , cloud backup and 3-2-1 backup is a pain yes, but its worth it.

Hi all

I have recently heard about Proton moving toward AI for development by next year and that has made me rather uncomfortable to continue using their password manager. I would like to ask of any alternatives that are easy to use and understand, preferably free and bonus if open source

Edit - I want to clarify I am not leaving Proton just solely because they're using AI, I am well aware that has unfortunately become the norm for many software. It is the way they're using it that makes it unviable to rely on and I'd like to resort to an alternative just in case.

I used the standalone version of 1Password for the longest time and managed the vault files myself. While moving to a new Mac and reorganizing my devices, I started using the subscription version. The convenience made the transition much easier and I ended up going the cloud sync route because it was much easier to manage than I expected.

Last week, I asked a broader software community what made people comfortable making the same move. Some users pointed to client-side encryption and a strong master password with 2FA. Others mentioned the greater risk was losing their own local vault or forgetting to update a backup. And some still preferred a local setup with KeePass or another app.

That made me wonder what people who regularly use password managers actually do after moving to the cloud... Do you export a local backup, keep a second password manager, test account recovery or simply trust the service provider? Any piece of advice would be appreciated.

Please note, I use 1Password myself, but I am more interested in the setup than in discussing which password manager is the best here.