Password managers have become almost essential for managing the most widely used authentication method in Internet applications and services. As we wait for the industry to usher in a new “password-free” era, we strongly recommend using specialized software to do this for us.

In one of last year’s cybersecurity roundups, we reported that “The most used passwords in 2023 were perfect… for cybercriminals.” And the passwords These are dangerous methods if not handled properly, as these types of statements confirm. And to that we have to add those that – even if they are secure – are subject to massive breaches of Internet services.

Besides the fact that passwords are inherently insecure, they are hateful in terms of usability, frustrating when it comes to remembering hundreds of them to manage the huge number of websites, services, apps and computers where we have to authenticate. The point is that they remain essential until other methods (such as passcodes or biometric identification) free us from them.

Until then, password managers are a good support automate the generation and management process minimizing human error as generated passwords are highly secure and meet standard standards for size, complexity and variety.

They also help against phishing attacks by instantly identifying characters from other alphabets. They usually work on multiple platforms and can work in both offline and online mode. Of course, it saves authentication time and perhaps most importantly: the user you only need to remember one master password and the manager takes care of everything else.

Free and open source password managers

The best-known option for password managers are commercial apps that, in addition to charging for their services, require you to trust them enough to give them the keys to your digital home. A big advantage of open source administrators is the possibility audit the software and especially keep the credentials under your control, installing and self-hosting the necessary code on your own computer. We remind you of the most interesting ones that you can use, all for free.

KeepPass

It’s the granddaddy of open source password managers and has been around since Windows XP. KeePass stores passwords in an encrypted database that you can access using a password or digital key. You can import and export passwords in many different formats.

Over the years, a growing number of plugins and variations have appeared, such as KeeWeb and KeePassX. Although it is a Windows application, KeePassX is a cross-platform version to provide a more Linux-friendly version and even Enthusiasts can run the app on mobile phones like the Purism Librem 5. As for KeeWebit’s about youWeb application which can be run in any browser.

Bitwarden

Specially designed for LastPass users looking for a more transparent alternative, it works as a web service that you can access from any desktop browser, while it has corresponding mobile apps for Android and iOS. Bitwarden can share passwords and has secure access with multi-factor authentication and audit logs.

It is intended for both users and companies and offers an API so that they can integrate their tools within the organization. So it can be run on servers, browsers, desktops or mobile phones. The source code for all these versions is available under the GNU License (GPL 3.0). Something we will all like is that passwords are stored on the company’s servers.

Passbolt

A self-service password manager designed specifically for work teams. Integrates with online collaboration tools such as browsers, email or chat clients. You can host Passbolt on your own servers to maintain full control over your data, although teams without experience or infrastructure can use the cloud version hosted on company servers.

Psono

Psono is another option for teams looking for open source enterprise password management software. It is a self-hosted solution that offers an attractive web client written in Python with source code available under the Apache 2.0 license.

In addition to sharing passwords, you can also manage files or folders. Browser extensions are available for Mozilla Firefox and Google Chrome. Psono is free for small teams, and larger companies will have to pay based on the number of users.

team pass

A team-oriented manager with an offline core mode that we like, where you export your items to an encrypted file that can be used in places without an internet connection. Teampass isn’t the prettiest app in the world, but the design is amazing and you can quickly define roles, user permissions, and folder access. It is licensed under the GPL 3.0.

What if I don’t want to use a password manager?

In this case, you will have to manage and save them yourself Basic rules for creating and using strong passwordswhich are repeated in every cyber security manual:

• Don’t use typical words or common numbers.
• Combine upper and lower case letters.
• Combine numbers with letters.
• Add special characters.
• Extend the term with the largest number of digits.
• Do not use the same password on all sites.
• In particular, use specific passwords for banking and online shopping sites.
• And if possible change the username too.
• Protect your password from any third party.
• Never give out your password in what appear to be official requests from emails or messages from messaging services (these are usually phishing attacks).
• Reinforce the use of passwords with other supported systems, especially two-factor authentication (2FA) or biometric systems, fingerprint sensors or facial recognition.

Finally, we’d like to highlight another good alternative, the password managers included in all web browsers that have the same goal as native apps: to store your passwords securely and help you start sessions faster without having to remember or reuse them.