LastPass

Promptfree, for everyone, and the only version there is

Copy the prompt for Claude CodeCopy the prompt for CodexCopy the prompt for Cursor

Copy

Do not build a password manager. This entry says why, and what to do instead.

**The failure mode is total and silent.** A mistake in key derivation, nonce handling or the sync protocol exposes every credential you have, and nothing in the interface tells you it happened. There is no other category on this site where a homemade bug costs this much.

It is also unnecessary: excellent free options exist, and one of them is running the same software the paid product sells.

WHAT TO DO INSTEAD
- **Vaultwarden**: a lightweight server that speaks the Bitwarden protocol, runs on a very small machine, and works with the official clients on every platform. This is the direct replacement and it costs a server you probably already have
- **KeePassXC** with the database file synced by whatever you already use. Offline, audited, and the file is yours
- Either way: a long unique passphrase, a hardware key or an authenticator as a second factor, and **a printed emergency copy of the recovery material in a safe place.** Losing a vault is the other total failure and it happens far more often than a breach

IF YOU SELF-HOST, DO THESE THINGS
- Behind TLS, never on a bare port. Behind a firewall or a private network if you can
- Automated backups of the data directory to somewhere else, encrypted, and **a restore you have actually tested.** An untested backup of a password vault is a story you tell yourself
- Keep it updated. A self-hosted vault on an old version is worse than a hosted one
- Two-factor on the vault itself, and admin access disabled unless you are using it

WHAT IS WORTH BUILDING AROUND IT
- **A vault audit, run locally over an export**: reused passwords, weak ones, credentials for domains that no longer resolve, accounts with no second factor, and anything untouched for years. Print the report, act on it, delete the export
- A breach check using the k-anonymity range API, which sends only five characters of a hash and never the password
- For a team: a register of which shared credentials exist, who holds them and when each was last rotated. The metadata is useful and the secrets stay where they belong
- A rotation reminder tied to that register, because 'we will change it when someone leaves' never happens on the day

WHAT MATTERS MOST
Run Vaultwarden or KeePassXC, test the restore, and build the audit. That is the whole honest answer.