In the latest episode of “they will always sell you out” - they sold you out! Who would’ve thought.
Hoping for a good alternative client to appear, the writing is on the wall. Vaultwarden can’t exist without “leeching” off of Bitwarden.
I’m going to have to just write my own one of these fucking things aren’t I?
KeePassXC and Vaultwarden exist
And Strongbox for iOS. They communicate with KeepassXC to keep the vaults compatible with both software.
Well fuck this
I guess that explains the transition to AI coding as well
Vaultwarden here I come
No, KeePass. Fully open source, no cloud involved in any way, unless you want something to sync your data (the server only ever sees your encrypted database - all encryption and decryption is done locally). You can also host your own sync server using any of a variety of different protocols.
Yep. Seconding this!
KeePass + Syncthing is the best.
Back up the database(s) regularly. (Syncthing can also retain
xnumber of versions and things like that, but also do your own 3-2-1 backups.)You can use something as simple as a Pi, or an old laptop, or even an old phone if you get creative, as an always-on syncthing server to keep them synchronized. KeePassXC even has a fancy integration with Firefox, so all you gotta do is unlock your database and click autofill on websites.
Yup, been doing this combo for 5-6 years now.
I use KeePassXC on desktop and KeePassDX on Android. No issues whatsoever.
I do have a NAS so that’s my “always on” device for Syncthing. Everything syncs up within like 10-15 seconds when a device connects.
I also use a key file as a pseudo 2FA that I keep on a flash drive, so you’d need my master password and my key file to unlock the database.
I use KeePass + KeeAnywhere. KeeAnywhere will sync with a wide variety of cloud storage providers. Or your own S3 data bucket server (can be self hosted or on Amazon), if you prefer. Does pretty much the same thing though with versioning. Auto filling in Firefox is done with KeePassHttp-connector on the Firefox side and the KeePassHTTP plugin in KeePass. Similar to what you describe.
Ok thanks for the heads up
BW news dropped, so you’re going to move to something that still requires the BW app?
Circular logic, friend. Ditch everything related to BW. Move to a truly open password manager like KeePass (including its various forks).
I hate to break the news but the issue with Bitwarden is that the client sucks total ass, and there are no drop in 3rd party replacements for the browser plugin.
Been running Vaultwarden for a while now and even though the sync implementation is nice and clean, it’s just not worth the end user experience.
This is really dumb when compared to literally every other password manager, open source and enterprise which does a much better job of actually being a password manager and not a glorified encrypted text file.
I’m eventually going to switch back to KeePassXC and just suggest setting a master password with Firefox’s builtin password manager for everyone else who just wants a painless user experience and not have to deal with syncing vaults.
Well, poop.
I think the original title was more helpful because it shows that this is a recent development. Maybe you can add “new CEO”?
Bitwarden scrubs ‘Always free’ and ‘Inclusion’ values from its website as longtime execs step down
In February, longtime CEO Michael Crandell moved to an advisory role, according to LinkedIn, with no announcement from the company. His replacement, Michael Sullivan, former CEO of both Acquia and Insightsoftware, touts his experience with “all facets of mergers and acquisitions” on his own LinkedIn page, including experience working with leading private equity firms.
CFO Stephen Morrison also left Bitwarden in April, replaced by former InVision CEO Michael Shenkman. Both Crandell and Morrison joined the company in 2019. Kyle Spearrin, who started Bitwarden as a fun hobby project in 2015, remains the company’s CTO.
You’re right, changed
That’s troubling, I don’t like what this portends.
The new CEOs background especially suggests they’re spiffing up the company for a later sellout, why else would they pick a merger specialist for the role?
https://bitwarden.com/pricing/
I kind of find the headline a bit disingenuous. However, if they do move to a non-free model, I’d still pay for it. I mean $1.65/Month USD. Sure, I don’t even have to think about it.
Funny thing is I clicked the link and “Always free.” was gone. Refreshed the page and it was back. Definitely something going on.
<shrug> It was there when I went and took a screen shot without refreshing.
yeah fuck that… fuck subscriptions ALL OF THEM. fucn these companies, ALL OF THEM.
stop giving any of these pricks any slack. none of them deserve it, nor money.
today it’s 1.65… tomorrow it’s 4.99… next week it’s 12.99… stop being a mindless sheep giving them any sort of leeway. you’re enabling the scammers to literally scam you more, and more and more.
I’m relocating all my shit right now because we’ll… fuck em. I am loyal to NO COMPANY. none of them deserve anything but bankruptcy at a minimum.
I’ve cut down my subscriptions by a lot over the past few years, and I’ve gotten very close to what I consider a minimum. Whenever possible, I like to buy outright.
However, surely you can understand how not every product can function as a one time purchase. For something like a password manager, they are providing an ongoing service. They are storing and serving your data.
You can self host, sure, and I’m doing a lot of that lately. But not everyone has the capacity or desire to.
All that said, this leadership shakeup is concerning and I think I’ll be migrating to Proton, since I already have a Duo plan.
You don’t need to self-host at all! Daisy-chain your needed files via Syncthing and Syncthing-Fork. That’s literally what I do with KeePassXC and KeePassDX, keeping everything offline.
I am totally in line with not agreeing with everything being a subscription. And I absolutely dont agree with subscription creep.
So I minimize what I pay for. And let me say, in no means am I defending the change in Bitwarden here. I would never.
It isn’t a realistic expectation to expect any hosted service to be free. Especially in capitalism. Someone will come along and fuck with pricing.
Not everyone has the time, knowledge, or finances to fund self hosting everything.
But to automatically assume everyone is a sheep for using a service that benefits them is a bit of a jump.
Yes, I myself value privacy, security, and the merits of self hosting as much as I can with my resources. And I have had conversations with people on these topics, and there are the folk that lack the understanding of the importance of the hill many of the folk like me stand on. So I have seen the wide spectrum of people who pay for services.
Wild take dude.
yAlL aRe ShEeP blah blah blah…
today it’s 1.65… tomorrow it’s 4.99… next week it’s 12.99… stop being a mindless sheep giving them any sort of leeway. you’re enabling the scammers to literally scam you more, and more and more.
‘Mindless sheep’. That’s hilarious. But I get it. Nobody likes to pay for shit.
I mean, when we see the same pattern of endless subscription creep and price hikes on virtually every service… saying “but it’s only [insert dollars here]” does sound pretty out of touch.
It’s not ‘out of touch’. It’s paying for (if it comes to that) a service that houses all of my business accounts, investment accounts, personal accounts, etc, and all with a pretty damn good track record. As with any technology, you must constantly evaluate it to see if what you are spending is justified for the service you are receiving. If at such time I feel the service isn’t worth the price, then sure. As of now, it’s not really an issue to me.
Sure. I think a lot of people just see that constant evaluation as postponing the inevitable, though (again, because the same pattern is everywhere). It’s not acknowledging that part which seems out of touch.
It’s not acknowledging that part which seems out of touch.
I assure you, I am fully cognizant of what for-profit corporations do. It’s one of the reasons I turned off the TV over two decades ago. There just wasn’t any ROI for me.
Hmm nice profile pic
Baaaaaaa.
Man, I tell you, I wish I could live in a fantasy world where everything is free.
Not sure about “everything”, but plenty of password managers are.
There are a handful of things I do not self host.
- arr stack
- password managers
- anything financial
Yeah it’s not about not paying for me, it’s about being able to host my own with my protections and controls
That is totally awesome and cool bro. You’ll never hear me throw shade on someone for charting their own course in life or choosing a different path. In fact, to drop a little relevant Hendrix up in here:
“I’m the one who has to die when it’s time for me to die. So, let me live my life the way I want.”
As long as my life doesn’t interfere with your life, we’ll be just jippity jippity. Rock on! Git sum! It’s a big world. We can all coexist.
Once again, enshittification by the fucking suits.
Early on I decided to use only KeePass for full personal control instead of an online service. Didn’t regret making that decision.
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:
Fewer Letters More Letters IoT Internet of Things for device controllers SSH Secure Shell for remote terminal access VPN Virtual Private Network
3 acronyms in this thread; the most compressed thread commented on today has 20 acronyms.
[Thread #295 for this comm, first seen 16th May 2026, 03:30] [FAQ] [Full list] [Contact] [Source code]
I am confused. Aren’t their clients open source? How many milliseconds will take till 100s folks will fork it?
Their server is useless and Vaultwarden is already a superior option
While I agree that they are a “at risk” company, I don’t think the software itself is at risk
Jesus, I’m tired of switching password managers.
Took me like 5 minutes to move back to KeepassXC.
i want to switch back to KeepassXC, but I very heavily use aliases in Proton Pass and can’t figure out a good way to still create those on the fly AND use Keepass as my default pass provider
Keepassdx supports creating aliases via addy.io I think
Password Store is the answer, if you don’t need passkey support. You can be sure it can’t be sold. It’s the golden middle: not self hosted, but not owned by anyone.
Maybe pay for one then?
I pay for bitwarden for the yubi key support and I’m also tired of switching.
KeePass isn’t going anywhere. They’re also dragging their feet on passkey support, so you might go with KeepassXC.
Two articles behind a paywall, one that won’t load, and another article that says the big problem with passkeys is…people are unfamiliar with them.
If anyone tells you that Passkeys are bad, they’re a liar. Way more safe than passwords, full stop.
Just don’t let Microsoft or Apple tie them to your device. You don’t have to do that.
Are you calling me a liar? That’s pretty weird; it’s not like I’m telling you to stick to passwords while I move to passkeys. With that said, though, get Bypass Paywalls Clean (Mozilla-only, as far as I know) and you’ll never see another paywall again. I forgot about having that.
Just don’t let Microsoft or Apple tie them to your device. You don’t have to do that.
The problem is that this is where it’s eventually going to lead to.
At the very least you’re misguided or don’t know what you’re talking about. Passkeys are not vendor locked in and of themselves.
You can make the same argument against password managers because most iPhone users that use them, use Apple’s one.
They will almost certainly lead to vendor lock in. Why do you think they won’t? Apple’s password manager is definitely an example of vendor lock in. Many others have a simple to use export feature to CSV or something that others can understand
Edit: it could be that you don’t know what the WebAuthn/FIDO2 specification says or we understand it differently? Do you know how the attestation mechanism works? That ties the key to a device of software authenticator (the software authenticator is likely going to tie it to the device somehow, possibly even via a TEE).
Not really, Vaultwarden/bitwa4den offer passkey support. When I log into a service a popup shows on my extension, I click it and I’m in. It’s not gonna lead to device locking if you don’t want to…
except when the wide populace starts accepting it being device locked, and your opinion does not matter anymore to those making the decisions
No one of the people I know that use passkeys use it from the phone, either they use a password manager, they have passwords on a physical note, on an excel file in the desktop, a physical yubikey, or bitwarden like me. That’s everyone I physically know including every family member, friends and work people.
I know it’s anecdotal, but you present your “wide populace” fact without giving sources too, and since I know no one that uses phone based passkeys, even if my experience is anecdotal, I say sus. Check your bias.
There is no full stop there… A password that is sufficiently long will never be cracked no matter the hashing algorithm in use. Passwords are easily transferrable and can be communicated to a third party in the event of an emergency. They also provide tunable security, where you can trade off security for convenience if you want.
Some (not all, I know) passkeys are tied to a device. Stolen device means stolen passkey, and it’s potentially very difficult to recover from that. Passkeys are also locked to a certain standard, passwords have no such restrictions.
Tbh I don’t understand the move for passkeys replacing passwords. They should become the second factor when a user wants additional security. They’re perfect for that niche.
Password can also very easily be stolen during phishing, while passkeys are phishing resistant.
And while a hardware passkeys can be stole and used, those who steal them will still need the pin to use them, and the two major hardware passkeys options now (Yubico and Token2) both have some pin brute force protection in their firmware to slow someone down long enough for an account to be secured another way.
As for passkeys on phones, they require the pin or biometric used to unlock the phones to be used.
Passkeys provide a secure way to authenticate while also being convenient. With the tradeoffs you mentioned.
I don’t like the push for only allowing some vendors to issue keys and to not allowing exporting and backups. And password should still be an option.
They also don’t effectively allow collaboration though, which is my cheif reason for using a cloud hosted password manager.
Sure they do. Multiple people can have a file open at the same time. I use it for exactly this every day at work.
With KeePassXC, that is. I don’t know if other flavors have different support. I use XC primarily for the browser extension.
And you can both modify the same things without causing horrible conflict issues? And you can share only parts of your vault with someone rather than having entirely different vaults you have to switch between? I’m assuming you mean putting the file somewhere like Google Drive, and you can access it offline even if you can’t edit it offline? For feature parity with Bitwarden, obviously ideally one could edit any time and it would resolve problems when it came back online if there were any but Bitwarden doesn’t allow this.
Yes, no conflicts. I don’t know if you can only share part of vault; I just created a separate one for a separate team.
I wouldn’t put it in Google Drive or anything like that. The separate sync logic will definitely cause conflicts.
I’m not worried about having access if I’m offline, because if I’m offline I’m not going to be able to log into anything anyway.
I guess a laptop, server, IoT device, or WiFi connection when your main device doesn’t have internet is out of scope for you?
Like fixing my laptop and not wanting to type the new password into my phone instead of copy/paste, sync when online?
And how are you sharing a file, to multiple people anywhere in the world realtime ish, without a cloud service you or someone else hosts? Doesn’t that necessitate some syncronization logic?It’s hosted on a local network share, so we don’t need Internet access.
If can’t copy paste, I just type it out.
We use a VPN to the office.
What is “collaboration” in this context?
Sharing passwords between groups of people so everyone always has the up to date version. Not breaking the world if two people try to modify the same entry as some file syncing solutions do.
Hmm, interesting, though isn’t that a fault of the organization not having an account-linking system so that each person could have their own credentials but can still access the unified content? This workaround seems… flimsy, unless I’m not picturing a legit scenario in which no other method is as good, or something.
You know why most cloud based services charge money? For stuff like this, because it’s not free to implement and maintain.
Easy and fault-proof password sharing and syncing needs software and hardware to do. You either set it up and maintain it yourself, or pay for a product that does it - like Bitwarden.
But your argument falls apart against something like Syncthing’s discovery networks combined with send-/receive-only folder types, which use no cloud yet allow the automatic, passive propagation of file updates to different users’ devices… right? No cloud, no self-hosting, yet automatic syncing across multiple devices…
It’s the fault of my family organization or every company we use that my parent’s bank, Google, phone, laptop, etc don’t allow more than one set of credentials to access the same thing?
It’s not just that we need to be able to share credentials the once a blue moon I need to help them by logging into their account?Wait, I don’t understand. Why do you need to do so much account-sharing? I never had half of that… and if connecting is just once in a blue moon, then it shouldn’t need something like group creds anyway, right?
Sometimes it just makes sense to have a single team login.
Licensing for instance where each user costs money and not all users need a dedicated account to look at something of which only 1% is of importance to them.
Parallel creating, reading, updating, deleting password entries by multiple users.
KeePass isn’t meant to be used that way. It’s a personal password manager. Always has been.
Valid. But it’s also valid that it now doesn’t work for me or anyone who also helps manage other people’s lives or works on a team ¯_(ツ)_/¯
Gotta use the right tool for the job. Sorry KeePass doesn’t work for you. It really is a fantastic piece of software.
Yeah, there was. It was forked because of that, actually: https://codeberg.org/ChiPass.
Link gives 404
I edited the comment. It ended with a period before, I assume your client thought it was a part of the link. Does it work now?
404
I edited the comment, see my reply to @wiccan2@thelemmy.club.
Yep works now.
Their AI policy looks very reasonable, and they certainly aren’t vibe coding. Everything is rigorously reviewed and tested by a handful of experienced, competent humans.
I just got Bit warden this year! Gah. Where are we jumping?
KeePass
Full circle to sticky notes on monitor.
Vaultwarden
Vaultwarden relies on Bitwarden existing.
Not really. Convenience relies on the app and browser plugin, but they could be recreated like the server was.
That would be quite nice to see.
KeePassXC + KeePassDX is probably the best option, with the downside of no way to sync easily (syncthing is probably the best option there)
I might switch back at some point, been getting frustrated with the bitwarden extension performance always being so poor.
Rclone with any cloud provider is another great option that’s seldom mentioned. I posted my setup as a comment on another post. You may find it here - https://programming.dev/comment/23849767
My first password manager was KeePassXC.
Hooked it up with Syncthing, and I’ve never had issues aside from the occasion database duplicate.
Right, and it has a neat merge-database feature anyway, so no excuses for those holding back!
Merge conflicts are a concern for KeePass, especially for those that don’t want to resolve them. Sync is difficult. AFAIK this is a very common issue with Syncthing setups.
Also, the portability from Bitwarden to KP leaves a bit to be desired, though that’s probably 90% on BW.
I’m using Keepass2Android (and KeepassXC). It can copy the database from/to an sftp server, so it can easily merge the entries. I don’t have the sftp server exposed to the Internet, because when I’m not home, nobody will change the database at home.
I’ve been using KeePass with Syncthing for 5+ years now and I think I’ve only had a sync issue once in all this time.
Granted I do make sure I only use the database on one device at a time (so not making edits on desktop and my phone at the same time) and I’m using XC and DX clients not the OG KeePass program.
I’m curious what is causing sync issues to make it “common”, I use my db every day.
Yeah, it’s not an uncommon use case to accidentally or even intentionally edit the database on two online devices - I do it all the time when I want a new login to be used on my laptop right after I signed up for some new website on my PC, and the laptop just happens to have an “unpushed” change from last evening, or I edit the new login’s metadata, or whatever.
With this, I’d have to keep a mental model of the versioning of each database and avoid even touching my phone like the plague if KeePass is open on my computer.
It’s not that big of a deal, it’ll probably be a problem once every few months, but it’s annoying to keep track of and worth talking about.
Merge conflicts are a concern for KeePass
It’s really not that much of an issue. I sync my database between several devices, some of which are only used occasionally. Rarely do I ever have a merge conflict.
If you’re editing the database on multiple devices before they have a chance to sync with each other, maybe stop doing that. That’s what causes merge issues.
I’m using KeeWeb on Mac and Windows and Keepass2Android on my Android device and I don’t have any issues at all. I’m storing in OneDrive though, this is the one thing I’m using it for still.
I switched over to keepass yesterday, and surprisingly the import from BW was perfect (as far as I can tell), even passkeys came over just fine.
XC is really nice, but the devs are kinda dicks about not integrating some sort of syncing option, instead telling everyone who asks to “just point it to a local folder and use <insert sync tool of your choice> to keep that folder updated.” Which isn’t terrible advice, but some of us don’t have that option on managed devices.
I ended up using Keepass2Android and just pointing it at my webdav server, it seems to work pretty well!
On desktop it’s already taken care of since I put the DB in my folders that already sync via Syncthing.
I love K2A, been using it for well over a decade now. I really should toss the dev some cash… They’ve kept the UI consistent for years.
I use KeePass with KeeAnywhere. KeePass can natively sync over network share, FTP, or WebDav. With plugins, it can sync over SSH, FTPS, Amazon S3 compatible buckets (including open source compatible versions you host yourself), Azure, Box, Dropbox, Google Drive, OneDrive, and more.
KeeAnywhere
That’s a neat one, although it doesn’t look like KeePass supports passkeys yet, at least I don’t see it in the feature list.
Are you trying to use a passkey to unlock the database or for authenticating with other websites? KeePass can natively do TOTP. There’s also plugins to do that. Including one that allows KeePass to be a native Windows 11 PassKey Provider.
For other websites, if I search for ‘passkey’ on the KeePass website feature list nothing comes up. Plugins in a password manager sketch me out a bit tbh lol
See here: https://keepass.info/help/base/placeholders.html#otp Also worth pointing out that most plugins are open source. You can read the source and compile them yourself, if you’d like.
This is for OTP not Passkeys it seems?
How do you go about loading plugins on the Android version for sync with your setup?
Sync however you want. Syncthing, Nextcloud, Dropbox, Gdrive etc.
Syncthing is the way to leave Google Drive, etc.
I use Nextcloud myself, but if people don’t want to host a server or fuck with syncthing, they can sync it however they want as long as they use a strong enough master password/phrase (which they should be anyway.).
Oh, well, I’m talking about not having to password-lock and unlock your stuff constantly. For long-term storage, sure, that’s fine; anything else would be way too tedious, though, no? I guess it depends on your use case and if you could locally automate the locking and unlocking or something.
I’m not sure what you mean. On my computer, I have to unlock the database every so often (you can set how long) with my master password. On my phone I unlock it with my fingerprint. The method of syncing the database is irrelevant.
Oops, I thought you were talking about long-term storage of files in general, like videos and docs or something, not a password database! Never mind.
Is there a proper syncthing android client now, after the official android client was discontinued?
Syncthing Fork works well for Android
Solid question; there are only third-party apps. A recent discussion in !syncthing@lemmy.ml led me to most recently adopt BasicSync, which is incredibly low-profile and is probably the closest thing we can get to it.
However… if you want to get as pure as possible, you can apparently run Syncthing’s Linux version directly in Termux on Android without the need for a dedicated Android app. There are also entire alternatives to Syncthing like syncspirit (which can also be run through Termux and which I’m considering trying as well).
Sad. Replaced everything with keepassxc + syncthing
- The year of keepass and syncthing!.
Glad I started using Vaultwarden a while back. Just need to find better apps for android and Firefox I guess because I’m guessing they’re going to try to break compatibility.
vauktwarden needs bitwarden though
I mean at this point in its evolution, what parts does vaultwarden rely on from bitwarden? The clients, but there are alternatives like keyguard for Android devices. What other layers does it rely on, I actually have been trying to figure this out myself.
