It's not really a password manager, since it calculates the passwords for you, but I love SuperGenPass:

[supergenpass.com]

Now I only have to remember a single password. Brilliant!

jmontana

@iMike

Second to LastPass. I have been finding it helpful not only in Firefox, but IE as well. It is a little rough to use with LinkedIn for example, but has been for the most part really clean.

Did try Passpack, but is a little convoluted to use. I did not like the Management of the entries - for example you cannot do a mass-delete.

I have also used KeePass and Password Safe.

Also, I like what RoyalTs has offered where you can save credentials to go in to RDP Sessions when working on servers too.

Thanks,

Kent

kdyer

Wrong, the most easy way is to use KeePass for syncronize between Mac/UNIX/Linux and Windows and Definately MOST secure since you save your passwords locally.

With using an online service for passwords you are giving away every password to unknown strangers at a company or individuals somewhere else and you dont know what will happen with your passwords even if they are encrypted so their staff won't see them. I would never use an online service for passwords like LastPass or Sxipper.

Also, KeePass have several plugins that support export of the database content to XML files as an example which you easy can import to MySQL database and then you would only need simple listing scripts with some kind of login.

But I would anyway recommend to use USB portable version of KeePass or cellphone edition of KeePass if you want to bring it with you when you are not near your own computer, it works good and way much safer than any online service.

roxpace

@zoomZAP: I just found this: WebKeePass - a web based version of Keepass! I'll have to check it out as I've been looking for that feature as well.

ddrager

I love Keepass(x), I use it all the time and cannot think of one feature that I need, that it doesn't have. I did have a hard time keeping it synced across multiple computers. But, I recently put the .kdb database in my DropBox folder (and spideroak when Ubuntu installed) across all my machines and now everything is always perfectly in sync. Works great!

allinthefamily

i really think that someone should consider looking at the autofill forms add-on for firefox.

it really beefs up "autofill" for passwords and other things where firefox's password manager doesnt work.

curlymeatball38

I've been in love with KeePass. It's open source, cross platform, and secure. I keep a copy on my Key Drive that I carry with me at all times.

ddrager

I just started using the web-based LastPass. Still a little rough but it's the best way I've found to sync cross-platform (Mac/PC).

iMike

Roboform is the nicest in the user interface, but KeePass is wonderful, it works in the most operatingsystems, it works on cell phones, and I have always my passwords on the portable edition of KeePass on my encrypted USB memory.

So if you voted for anything else than KeePass, think again and try KeePass more intensive and most explor the cellphone and portable features/editions.

roxpace

@zoomZAP: Hey you stole my question ;)

Chaluapman

KeePass(X) is what I use, and it works very well. But ideally I'd like to find a PHP/MySQL system that I can install on a server and access via SSL. Anyone know of a decent web-based password management system?

Some people also mentioned Mind in the voting. I was curious but I couldn't find it by Googling. Anyone wanna provide a link to it?

zoomZAP

I like roboform. Browser integration that it provides is really neat. Havent tried Keypass though. Will give it a shot next time i rebuild my system.

foraccounts

1password is the best.

ironchef

So I should I be avoiding the web-based password managers at all cost?

I have everything written down and I'm looking to put it all into a program. Good timing for this article.

decrescendo

Stupidity really rules the world, give away your passwords to other people, please do that and see what will happen in the future when you complain that you has been hacked ;)

roxpace

@iMike: LastPass looks pretty decent. I think I'd still prefer something that runs on my own web server, however. The encryption methodology is about the same as what Jungle Disk uses if you choose your own key, and that's a pretty good system imho.

@ddrager: Too bad this requires the bundled Tomcat web server and Java.

zoomZAP

I use SplashID, since it was one of the few that synch'd smoothly onto my Blackberry at the time. There may be more such tools now, but these guys were there early, and it has always worked perfectly.

I've been very happy, and its been worth the paltry $29.99 I shelled out.

MikeHerbst

What is the application pictured at the top of the post?

GHETTO.CHiLD

I can't imagine using all those account-based websites without RoboForm.

Downside is that I've forgotten most of my passwords and I have trouble typing them in on other computers.

Vroobelek

Second shout for SuperGenPass as a quick login solution.
Simple and effective - the way I like it.

For a real web-based password manager, try Clipperz.
Seems safe enough.

zormal

I've started just storing these kinds of things in Gmail. Works for everything, even the combination for that old combination lock lying in the desk drawer. Just search your mail for the name of the service that you need the password for and there it is.

Plus, if no one knows that you keep your passwords there, your passwords are obscured in a pile of thousands of old e-mail messages.

djnrempel

@GHETTO.CHiLD: Keypass. Does anyone know how to synch multiple keypass databases with WIndows? I keep a copy on my laptop, one on my personal webspace (named a jpeg file), on a couple USB drives, and an archived copy in all my web based email accounts.

got no clutch? You ain't much.

I'm not sure this is a fair fight. KeePass is free while RoboForm isn't since you really can't use it without forking over the $20 bucks so I would expect KeePass to win going away on that basis alone.

And not to take anything away from the venerable KeePass, but RoboForm is just unbelievable. Been using it for years and honestly I can't think of a single thing they could do to improve it.

Beestie

Putting your passwords on someone else's server is like giving your neighbor your credit card and saying well they can't use it because they have to be able to sign my name. - Just plain stupid.

Stephen

Similar but different, I use Devicescape (www.devicescape.com) to login automatically to password-protected hotspots on my PC and iPhone. Works great with AT&T and Google WiFi and it seeks out and automagically connects to lots of open and free networks.

Captain Nimlet

I too use RoboForm and have for years! I have the Windows Mobile app installed on my Sprint Mogul (aka HTC 6800) and I can login to my RoboForm and view my login and passwords for when I'm away from my computer. I also have the RoboForm2Go on my flash drive so as long as I have my flash drive, I can securely use RoboForm on any computer... Internet Explorer or Firefox (or even FireFox Portable stored on my flash drive). RoboForm uses advanced technology to bypass keyloggers, so it's actually safer than storing your passwords in your head and typing them on the keyboard. The price is extremely fair, and it's very easy to use, manage and I appreciate their great support.
I HIGHLY RECOMMEND ROBOFORM!

mobilejray

@decrescendo: There's always the wand feature in Opera.

gregbzh

I like keepass, just wish its firefox integration worked. Lastpass is pretty seamless and much less interfering than Sxipper (which I uninstalled when i went for Lastpass), whose dialogue is forever popping up when it's not needed

mrbenn

Man I wish there was a button I could push somewhere in my Firefox toolbar to get something to autofill a password. I don't think Keypass works like that, does it?

I might have to use something else I supppose.

decrescendo

I agree with MikeHerbst: SplashID for me. Have been using it for years with Palm and Windows, recently added a Mac at home and downloaded the desktop - no extra cash required - and all still working.

Dave61

@zormal: I use Clipperz and I generally like it. But I've been looking for a new password manager (nothing wrong with Clipperz, just wanted to start using something different) and I have to say Keepass looks pretty good. Think I'm going to try it out and see if I like it better.

I must say I did try Sxipper and hated it. Just never clicked with it.

SA

@allinthefamily: I recently started doing the exact same thing. Keeping my KeePass database in my DropBox has made cross-platform password sync dead simple.

kyanos

It has already been said, but Keepass Portable all the way... For the truly paranoid (like me :) put it on an IronKey along with Thunderbird Portable (with Enigmail, of course), ClamWin Portable (to scan untrusted computers) and IronKey's built-in secure web browser, and you've got as safe an online setup as you can reasonably hope for in your pocket at all times.

brownie

So what is the problem with the Firefox password manager? Anything?

If will autofill which is incredibly convenient and you can still pull up a list if you'd like. Is the security the problem?

decrescendo

I've been using TurboPasswords from Chapura for years. Excellent IE AND Firefox integration, password generator, strong encryption, and extremely portable.

[www.chapura.com]

Saludos,
Steve

spcagigas

anypassword.com

mwc5446

I understand it doesn't count as a password manager per se, but TrueCrypt is pretty handy for storing passwords.

I just keep a text file with all my passwords stored in an encrypted TC partition on my thumb drive, so I'll always have my passwords with me.

I set it up using the directions here:

[www.juand.ca]

One thing I'd add is don't forget to keep a backup of your thumbdrive somewhere safe.

sanks

@decrescendo: Check out the secure login addon (like Opera's wand): [addons.mozilla.org]

orlo

@decrescendo: Lastpass works like this.
If you are at a site that you have already saved info for then when you visit it, lastpass asks if you want to autofill the login info and will also ask if you want to autologin to the site. Note that you do need to install the IE and firefox plugins for this to work. It is dead simple.

it also offers to add your login information automatically when it detects you logging into a site that it does not have credentials for. You simply log in, a bar appears on the top asking if you want to save the site. If you agree then the next time you visit it can autofill and/or autologin.

According to their documentation, all the information is encrypted locally before it gets sent to their site.

EracMan

wow - no mention of Password Corral?
[cygnusproductions.com]

robsantos

I would kill for something like del.icio.us, but for passwords. I would like to access my passwords anywhere.... Steve Krzysiak

YuriAthos

Should I assume that people who insist that data stored on their hard drive is necessarily more secure than data stored on a remote server never conect to the internet?

zoomZAP

I've been using SplashID for years, from Windows to Palm to iPod Touch, it has maintained my password database. I especially appreciate the password generator.

Caleb615

1Password is phenomenal. Between the desktop app, the website and iPhone integration, I never have to go without my securest passwords.

JustMarci

@decrescendo: There's still a slim chance that some tricky Internet hack would fool the browser's auto-fill to trigger on a website that it thinks is the real Citibank or whatever but is really a hacked site that looks like Citibank. [I'm thinking along the lines of a DNS hack. Of course, in that case, we could all be fooled, whether we use browser auto-fill or not.]

IMHO Firefox's auto-fill works TOO WELL. It remembers my credit card numbers!

Posco Grubb

I still like Opera's built in Wand password manager

cyriene

I keep missing the first round on these High Fives. Argh. Anyway, I currently use Password Safe. But it looks like KeePass and Password Safe have several key (NPI) requirements in common:

* open source
* cross-platform (Password Safe has a Java version that I have not tried yet)
* ABSOLUTELY NO browser integration (passwords copied via Windows Clipboard. If your clipboard is not secure, then you have a lot more to worry about than the security of your password manager.)
* ABSOLUTELY NO use of the network for synchronizing passwords across systems or anything else (I'll just copy the files, thank you very much)

The only thing KeePass doesn't have is that Password Safe was originally written by The Bruce Schneier Himself. All KeePass has is a Bruce-Schneier quote on its web page. ;)

Posco Grubb

1Password is hands down the best password manager for Mac OS X!

stephensilva20

Would be lost without Roboform too - it also allows you to automatically generate random passwords when creating a new account which makes it much more bullet proof.

I personally use the paid for version and for added security, keep a copy of all the keypasses on a TrueCrypt Traveller partition on a usb drive.

The form filling is spot on too and there's safenotes for any reminders you might need for off-line passwords.

jackbp

I really like using KeyPass. There's even a windows mobile version. I use the portable (win32) application on my computer and store my KeyPass database on my WM phone. It's always with me!

Wingmanjd

VOTE: Passwordmaker.org

I admit it has a rather steep learning curve, but once you get the hang of it it's easy as pie.
Been using it for the better part of a year, never failed me.

KyleK

VOTE: KeePass

I used PassReminder (memory stick version) for a few years. It ran on both Linux and Windows without any special magic (other than pointing at the right executable). However it lacks some finer controls over the password generator, and several people I need to share a particular password database with use KeePass. So far KeePass is okay. It gets the job done, certainly.

jtimberman

If you use a Mac...

1Password

Period.

m021478

VOTE: others.

I use pwdhash.

srouquette

@decrescendo: If someone steals my laptop, all they have to do is double click and my username/password comes up.

got no clutch? You ain't much.

@ddrager: I actually don't see how this is connected to the keepass project at all. it uses a different data format and a different UI. Doesn't seem like you can even share your kdb file between this and the standard UI. Pity.

fatbob

Just to clarify, several people have mentioned that RoboForm and KeePass are available for the Palm. That might be technically correct but, as far as I can see, they're not fully functional. In other words, you can't edit your data on the Palm and expect it to sync up with the desktop. Actually, with RoboForm you can only view the data on your Palm. That's a dealbreaker for me.

LeeHunter

Password Safe

Medlir

@SA:

If you are not happy with Clipperz maybe you should give Passpack.com a try. IMHO it's better than Clipperz with several intelligent security features, tagging and offline access to Passpack via Google Gears or Adobe Air.

kamui47

I'll stick with TK8 , nice interface and simplicity.

the_gank

I think the Hive Five should have a subset best for system (Linux, OS X, Windows). As it is, popularity keeps trumping quality.

Slugicide

I wrote a great script for this. Much more simple and lightweight. Much better.

[sites.google.com]

XRTwenty

@YuriAthos: Lastpass, a new password manager just in public beta is accessible anywhere, anytime across multiple browsers and pcs and sports local encryption this may be what you're looking for www.lastpass.com - lots of people seem to really be into it.

pern0808

I prefer SuperGenPass, since it

a) It eliminates the need to actually store the passwords a particular local or remote machine.

b) means that each of the sites where I have accounts has a completely different password with no effort on my part, and

c) Has HTML equivalents that allow me to use my passwords on remote machines by visiting a page I host on my own site.

Worth a look, for folks not satisfied by the other options

anschauung

Firefox Password Manager AND Sxipper (for the forms).

Arithmomaniac

As far as security of web-based password managers is concerned, Clipperz is spot on - it employs an javascript encryption library that it has open-sourced.
What this means is that encryption/decryption for passwords happens on the client-side with community-tested algorithms and that the information they store is already encrypted

I cant speak for other web-based password managers.

As far as storing your passwords in textfile on truecrypt partition -- once you mount that partition, that textfile is visible in PLAINTEXT to anything that is running on that system, including keyloggers, file scanners, etc.
You would have to unmount the whole partition to hide it.
Not a smart idea IMHO

vladgur

My sonicwall detected a trojan when going to the KeePass site to download. Not from the program itself but from the mirror site they forwarded me to. I have used KeePass and it worked great, just not sure what's up with the mirrored sites...

landonmiller

@decrescendo: There's nothing really wrong with the Firefox password mechanism, as long as you use a good passphrase, and you have no keylogging viruses/trojans/worms/whatever on your system.

The issue is with what it doesn't do, and that's work on the iPhone/smartphone. As much as I like them, firefox passwords are useless for me on the iPhone, and so I have to use some other solution.

aj_robins

firefox. why? its simple and you dont have to mess with it that much.

glaeven

All excellent options, though I must admit I am disappointed that myVidoop did not win... :(

kfox

I use a combination of KeePass and Firefox's Password Manager.

Just got to love the fact that KeePass has a portable version! ^__^

Asian Angel

I love KeePass to store a database of all my passwords. But I miss the auto fill-in that occured when I saved all of my passwords in Firefox. I recently cleaned it out for security reasons.

gpzbc

The best password manager for Mac OS X is [www.xheadsoftware.com] Info rocks.

enzomedici

What makes KeePass prefect choice for me is its ability to run on Windows Mobile. I have all my PIN codes saved to it - can use them on the go and update them on my notebook.

Sanja

I made the move over to [www.passpack.com] after it featured in a Lifehacker article some months ago.

Its security is certainly well thought trough, and impressive. Whilst this might be at the cost of some level of convenience, I don't really want my passwords to be stored somewhere where it is simple and convenient to retrieve them, I want to know they are secure.

Once you are logged in, you can use your passwords easily, with one-click login options available through a bookmarklet.

Import, Export, Backup and Restore options prevent you from feeling 'tied-in'. The service is free, and avaialble anywhere you can get online... so I don't get locked out of my sites if I don't have my thumb drive with me or not at my home PC.

neotoxic

For me RoboForm is one of the best Password Manager.

JrCs

i love roboform and the company offers a 50% discount to low income (SSI, And elderly) with a your words good enough for us verification policy. I supported them even more when i saw that. that is true customer friendliness right there lifehackers

PaladinMJ

I use only one password for every non-important site. Never had any trouble. So no need for a password manager.

For medium security (forums, blogs), I use PassPack [www.passpack.com]

For high security (bank accounts, email), I use KeePass.

Asszem

Encrypted html file
[messagevault.org]

Turis

Lastpass, perfect for syncing through multiple PCs with a online backup. I use it exclusively now

Roboform, perfect for single PC use, it's real easy and simple, not so easy for syncing

Ken

Haven't really tried any other, but I've liked Firefox's own enough. Though I have installed Secure Login add-on, which adds the Opera kind of button which you click to fill login forms.

Zhal

Well, it definitely has to be for all platforms and I think the web browser should be good at browsing the web, not managing passwords! (not saying Firefox doesn't do a good job, but if a stand alone application is made to manage passwords, it better work better then an add-on for your browser).

Coldmiser

I use a little-known Java app called JPasswords. It's really simple, runs on minimal footprint. But the best part is I can put it and my encrypted passwords file on a thumb drive and run the .jar file directly without installation off any computer I might need to use it from in a pinch. To me, that advantage is huge.

polyboy

1password without a doubt.

withoutink

I'm using 1Password currently, but only because it came with the MacHeist bundle. I may check out KeePassX at some point.

Myles

@kamui47: Thanks. I'll give that a look as well.

SA

Turbopasswords works great on my PC and my Treo. And it syncs them. I lub it!

NotDone

I tried out LastPass after reading this and generally liked it at first. But then I ran into a problem where I have multiple cPanel logins with the same URL and I just could not figure out how to make it stop logging into one of the accounts automatically. It worked fine for other sites with multiple logins, but for whatever reason it wouldn't cooperate in this case so I ended up uninstalling it.

zoomZAP

I can't imagine my browsing life without RoboForm!

Gerard Sorme

Is sxipper evil?

Try to read it's comments and reviews on mozilla addons site.

And it says sxipper steals password.

silentcon

Still sad that PassPack didn't make it up there.

Sean Killeen

I use Password Gorilla. It is cross-platform, open source, and does the job without complications.

rsnemmen

If you are getting your passwords stolen because you stored it at any online service I would just laugh, so please let me know so I can have a good laugh :)

roxpace

You might want to look at LockCrypt - [www.lockcrypt.com] . There's a review at [www.softpedia.com]

Echilon

what about i23, it's open source..
[[myownapp.com]]

prramesh

PasswordSafe is my weapon of choice ... free, easy to use, encrypted, blah blah ([passwordsafe.sourceforge.net])

JohnnyRobo

@kdyer: Mass delete of entries has just made it to the suggested features list. Was there anything else you'd like to see improved about Passpack's entry handling?

Thanks for the feedback!

Tara-PassPack