Selfhosted

I'm currently using KeePassXC. The setup that I created below gives me 3-backups of my passwords, but it's a bit to manage.

Computer

On my computer, I have my keepassxc database and key file stored in a veracrypt container. Next to my computer, I have a piece of paper that has the password for my keepassxc database and the password for my veracrypt container.

computer -> veracrypt container -> keepassxc database AND keepassxc key file

paper -> keepassxc database pw AND veracrypt pw

KeePassXC Export File (text file that contains all of my login information)

I store this file inside of a veracrypt container, on my USB LUKS. Next to my USB LUKS, I have a piece of paper that has the associated veracrypt password.

usb luks -> veracrypt container -> keepassxc export file

paper -> veracrypt pw

Cloud

I store my database in cloud service a.

I store my key file in a veracrypt container, in cloud service b.

On a piece of paper, I have the login information to both of these cloud accounts and the password for the veracrypt container.

Having gone through all of these options I have thoughts.

Option 1 sounds awesome but will almost always leave you in a situation where you can’t get your logins when you need them in an emergency. You’re always depending on a chain of things. Depending on your situation it may not be a big deal. But this option sucks, imho.

Option 3 sounds amazing because it gives you the control of option 1 with the ease of option 2. But… unless you’re the kind of person that enjoys hosting their own email server you really don’t want this option. Fun in theory but not so much when you realize you now have a 3rd job.

So that leaves option 2. It’s great but you’re depending on someone else. This is the option that most people should choose too, imo. However it lacks some of control and trust that option 1 and 3 have.

Sooooo, that leaves us with option 4, the onion option. Breaking up your data into layers and using different tools for them.

So first and foremost I want my password storage to always be available. For me that means Bitwarden, (though I’m evaluating protonpass currently.) this is the outer layer. Things that can and should be stored here are stored here. I use it to manage web logins and 2FA tokens for those sites. I also use it for storing autofill data eg credit cards. I don’t use it to hold things like my gpg keys.

Next layer is pass. This layer is mostly things that I need to have logins or other information on headless/remote servers. Think self hosted lab services like a mariadb/postgres or backups. This is easily kept in sync with git. This is the layer where I’ll store things like gpg keys and other VERY sensitive data that I need to sync around.

For other things on this layer I use ansible vault. This is mostly used for anything where I need automation and/or I don’t want too or can’t easily use my yubikey for gpg. This is kept in sync with git as well.

Lastly the inner layer I use AGE or PGP. This is for anything else I can’t use the above for. So my Bitwarden export/backups are in this level too. I also use this layer for things that I need to use to bootstrap a system. Think sensitive dotfiles. This can be kept in sync with git as well.

Git is the best sync solution imo because you can store it anywhere and use anything to sync that repo. Just throw that raw repo on Dropbox, use ssh with it on a vps, rsync it, etc. you’ll always have it somewhere and on something.

My work flow goes like this Bitwarden -> Apple/Google/Firefox -> Pass -> Ansible -> AGE/PGP

This allows for syncing things as needed and how needed. It also gives you the option of having an encrypted text file if/when everything fails.

Apple keychain. Supposedly secure, extremely convenient, may be in the Cloud but not centralized - can’t lose everyone’s credentials at once.

The plug-in for Windows works pretty well too, although I wonder if that puts my confidential data at more risk

I keep my passwords in Google. Unencrypted of course

For highest security don't store in cloud or multiple places. Memorize them or keep a separate device that has no intermet access and keep them on that device encrypted/locked

I'd never store my passwords in the cloud.