How do you keep track of all your passwords?

Question

How do you keep track of all your passwords?

Personally I host a personal copy of clipperz, I used keepass and passpack in the past.

What password manager would you recommend, what features does it have that make it awesome?

Now at 70+ "answers" it's a pretty good bet that your favourite program is already mentioned. Upvote that if that's the case.
If you can't yet upvote, come back when you've gained enough reputation instead of posting a duplicate answer.

Answer 1

I use KeePass. Features I like:

• Strong encryption
• Cross platform - I use it on Windows, Linux and Mac OSX daily
• Password quality meter
• Excellent random password generator, with customizable "character type" selection.
• Open Source Software. This is very important for an encryption program!
• Extensible with Plugins.
• Export/import between databases.

The big win for me was the cross-platform capability and the ability to export and import databases.

There's also an iPhone app in the works (independent project, yay open source software!).

Those who want to store in the cloud can look into dropbox.

There's not a lot of Firefox plugins, but LastPass will import from KeePass into Firefox.

Answer 2

Joel has a good post on password management. You should check it out. Basically it's a combination of Password Safe and DropBox.

Answer 3

LastPass is a very nice solution.

It is an online password manager and form filler that makes web browsing easier and more secure.
That way, I always have all my passwords at hand.

Its security has been discussed at length: it seems pretty solid on that front.

Answer 4

• 1Password for Mac OS X
• 1Password Touch for iPhone
• RoboForm for Windows

They all come with a free (limited) version and a full commercial version. I suggest you to try the full version for the trial period and check if they fit your need.

I have at least one full license of each. They are really worth the money you pay and the license is quite cheap.

I heard good words about KeePass as well, but I never used it.

Answer 5

My password manager is my memory. I have a set of maybe half a dozen passwords I use for accounts on various websites. However, I won't use my online banking password on any other website.

Answer 6

Password Safe / Password Gorilla

I use Password Safe in Windows and Password Gorilla in Ubuntu Linux. (I choose an OS whenever I boot up.) I like this solution because:

• All logins are stored in an encrypted file with a master password
• I can organize them in whatever categories I create - Shopping, Forums, whatever.
• I can copy and paste passwords without actually displaying them on screen, in case someone is watching
• I can store URLs and other notes in the file
• The file format is the same for Password Safe and Password Gorilla. I keep it on my Windows hard drive partition, which Ubuntu can access, so bingo! - my passwords are available under both operating systems.
• The file is encrypted and safe - I can email it to myself or back it up as necessary
• I could use multiple files if I wanted; i.e. passwords for work and personal ones, and share the master password for the work file with my boss

Note: I did get this suggestion from Joel Spolsky, although I'm not using the DropBox part.

Answer 7

I remember them. Wherever possible, I use OpenID.

If I forget, I use the "Forgot Password" option.

Answer 8

On my macbook, I use Apple's default Keychain application mostly. Other than that, my memory memory usually serves me just fine :)

Answer 9

Doesn't keep track, but supergenpass algorithmically generates passwords based on the site domain you need a password for and a single master password.

Answer 10

KeePassX is a cross-platform clone of KeePass. Nothing beats having your passwords everywhere you go.

Ehtyar.

Answer 11

Firefox

If you're mainly looking to store web passwords, Firefox does fine by itself.

• Click Tools, then Options, then the Security tab
• Check "Remember passwords for sites"
• Check "Use a master password"

Now Firefox will remember and fill in site passwords for you, but only when you provide your master password.

Answer 12

I use PasswordMaker It's not really a management system but rather a generator based on a hash of a master password and a domain name or some other identifying value. I like it because it's deterministic and doesn't rely on a store of passwords that could be lost, corrupted, or inaccessible. I have the browser plugin for FF and the php version running on a secure server so I can pretty much generate a password at any time and from any computer.

Answer 13

I use 1Password for the mac. It has two really nice features:

• Good random password generator
• Plugins for all browsers to fill in login screens

Combined, these make it a breeze to ensure I've different, strong, passwords for every service.

Answer 14

The Forgot your password? link.

I have a bad memory.

Answer 15

A USB stick, TrueCrypt and an Excel spreadsheet ... simple and safe.

EDIT: For machines without Excel, I use OpenOffice & PortableApps.

Answer 16

I use a system whereby I make a pattern with the last letter of the domain name I'm entering my password into. This allows all my passwords to be unique and essentially the same thing repeated. For example on superuser.com I would start from the letter "r" and then go 3 letters left two down, ect.

Answer 17

I use Revelation on Fedora. For Linux it works very well - integrated with the bottom bar so you can search for a password without starting up the application.

http://oss.codepoet.no/revelation/wiki/Home

Answer 18

I'd love to proudly say "I use OpenID everywhere" but it's not really up to me, is it? What I don't do is log in with Facebook, Twitter, Gmail, etc. I treat OpenID as my separate identity management. Those are apps that don't need to be involved with my identity.

For web apps I like to use a password generator. Here's one that creates a SHA-1 hash based on your master password and the domain name. There's even a link to access it from the iPhone. His older version uses MD5. Great thing is it's all javascript.

As mentioned by another poster SuperGenPass is a similar "password generator" tool. I believe SGP creates a MD5 hash which would not be preferable to SHA-1.

What this has done for me is greatly reduce the unique passwords I need to know, e.g.

• email
• work pwd
• banking pwd
• openID
• DNA
• master password for generator
• secret offshore gold bullion storage facility pass code

Answer 19

passwords.txt

Answer 20

Original question here.

Password Storage Tools

• KeePass - Windows/Linux/OSX - flash drive version
• Clipperz - Online (Source available for download)
• PasswordMaker - Windows/Linux/OSX - built in to browser or desktop widget
• PasswordSafe
• Keychain Access - built into OSX
• Steganos Locknote
• Passpack - online vault
• CryptoCard Explorer - Windows/Windows Mobile
• Your brain - the only truly secure place to store passwords (unless you're gullible or easily tortured)

Answer 21

I remember them. To avoid using the same one everywhere, I mix certain parts of the name of the place where I use the password with a small and secure password that I remember very well. For example:

I want to remember the password for Super User. Suppose that my "mini-password" is "Irock123". I could take the first and last letters of the name of the site and put them before the password, resulting in the password "srIrock123" for Super User. Personally, I use a much more secure password (this was just an example), but I think this is a good way to remember passwords. A password is supposed to be something that will tell the computer that it's indeed me who wants access somewhere. Storing them in the computer, even if they're encrypted, kind of defeats the purpose.

Of course, this is an opinion. Maybe password managers are excellent tools and very secure. But I think that nothing's more secure than my head.

Answer 22

KWallet on KDE.

Windows - scattered between various build-in password managers in Firefox, Thunderbird and other apps.

Answer 23

Don't crucify me for this, but I keep all my passwords in a file stored in a remote Linux computer.

Pros:

• Access is easy - I have a shortcut which sshs the remote machine. All I have to do is enter my password, and cat pass | grep site (e.g. for gmail, cat pass | grep gmail).
• The passwords are never kept in a local file
• Adding a password is easy - adding a line to the file

Cons

• Internet connection is needed for password retrieval
• Works for Linux fans only
• Remote, trusted server needed

Answer 24

I wrote my own web app to store my passwords.

To protect myself, I...

1. Host the site from my home computer.
2. SSL only connections.
3. All data is encrypted in the database.
4. Master password is generated by several random, dynamic factors that change hourly, plus a salt.
5. Only I know the factors that build the password and how it's done.
6. Master password generation code is obfuscated.

It works really well for me.

Answer 25

The amazing power of The Mind.

Answer 26

I use command-line OpenSSL, e.g.

openssl bf -a > somepass
openssl bf -d -a < somepass

No fancy features, but I'm fairly confident that it's secure and it has the bonus of being cross-platform and simple.

Answer 27

Post-it notes. Under my keyboard.

Answer 28

I try to remember them. As backup I use a piece of paper for the passwords and a safe for that piece of paper.

Answer 29

Memory. For bill paying accounts, I leave myself little clues in my tracking spreadsheet. I never allow passwords for anything financial to be stored or memorized by anything -- including third party tools.

Answer 30

I follow a memorized formula. Since inventing this, I have never needed to use the "forgot your password?" links, and rarely write down a password.

My password for any site/machine/whatever is

(who)(1+)(2)(3-)8xy!R2(what)

where

(who) = who am i? 'd' for me (Daren) or 'r' for 'Root'. For a web CMS that I manage, I may have an account as a regular nonpriveleged user, for which (who) would be 'u' for User.

(1+) = is the letter alphabetically following the first letter in the name of the site, company, machine or whatever. Always capital.

(2) = is the second letter of the name.

(3-) = is the letter alphabetically preceding the third letter in the name.

8xy!R2 is a fixed part. Many sites require a punctuation mark, digits, and a mix of capital and lowercase. I just memorize this.

(what) is 'm' for money-related sites like banks, 'f' for forums, 'b' for email (mailBox) accounts, etc.

Example: To log in the usual way at the Intergalactic Bozo Research Council (IBRC) user forum, the password is

dJBQ8xy!R2f

Password strength indicators are routinely impressed with the passwords created by this formula.

Once every year or so, I change the fixed part, and maybe switch from using (1+)(2)(3-) to (2)(3-)(4-), or put the (what) in front instead of the end. It's a lot of fun to go to every website I have an account with and change the password, for certain definitions of "fun".

A few oddball sites require peculiar passwords. Some from way back don't have a "change password" feature. Some don't allow punctuation marks, or make demands on the length. When I must write down a password, I obfuscate it: The first character is bogus, the first 'N' that appears isn't really there, every digit is one more than what is should be, and so on.

Of course, everything I say here is a lie. I'm not telling anyone the real rules. Make up your own!