Asklemmy

My personal choice right now is KeePassXC (PC) / KeePassDX (Android) + Syncthing And Aegis (Android) for 2FA codes, with a yubikey for services that support FIDO keys.

Overall I like this setup because it's decentralized and does not rely on a third party server structure. The only "weak" point would be the Syncthing relay servers or the Tailscale VPN that I use, but this goes back to ensuring encryption of the database is adequate with a long password, and using an open source synchronization protocol that ideally has been vetted by a trusted third party (or yourself if you're capable)

I used to use Bitwarden, and I highly recommend it. I really appreciated it's ability to integrate with email aliasing solutions to generate new aliases from within the bitwarden UI itself. However, my main reasons for switching were the following

• I don't have the money to pay for it (uni student)
• I prefer a more self-hosted approach (I will consider using vaultwarden in the future when I have more money)
• I wanted to move away from using a browser extension for password management on desktop. KeePass' auto type feature is really good, and a more secure input method than a browser extension autofill.

The only additional advice I have for both recommendations is that I do not think it advisable to add Totp 2fa information to your password manager even if it supports it. I feel like this should be separate, on a single device, and backed up in ~2 locations (one preferably off site). This is really to avoid problems if a device is compromised and if your password manager is compromised, but this is definitely in the more unlikely category I feel.

My only major issues with keepass are the potential for sync conflicts and the some feature differences between platforms. A centralized server config like vault/bitwarden prevents the sync conflict issues, at the cost of having one point of failure. The feature differences problem isn't too great, but autotype doesn't work on Linux if you install with flatpak, and you can't prevent screen capture of the app on Linux (only on Android and Windows from my understanding)

Edit: I also tried gopass, it's really fun to have an entire CLI based password manager, but frankly the state of mobile companion apps are appalling. The Android option only is good if you use a dev version, and the iOS one I thought was just ok. I also dislike the metadata leaking that is inherent to the format, and that PGP is the main form of encryption for the time being (some clients were looking at using AGE at some point). Overall it's a cool but flawed concept, and I feel my other two recommendations are superior.