Is there a safe way to save passwords?

Question

I have a lot of passwords from various websites. I never use the same one twice, but the problem is that I keep forgetting them so I want to save them somewhere. If I'm on the same computer I can save them in the browser. However, that doesn't work across computers. Is there a safe way to store the passwords somewhere online?

Answer 1

I suggest the use of Keepassx, an cross-platform password manager, and Dropbox. Create your password database with Keepassx and then synchronize it across all of your computers using Dropbox. I've used this approach for about a year and a half with no issues.

(I should also mention that Dropbox keeps older revisions of files so even if your database is lost, deleted, or corrupted it can be recovered. Between the version on the dropbox servers and the version on each of the machines you sync it to, you have a built in backup system)

Answer 2

I've never looked into its security, but LastPass (http://lastpass.com/) is designed to do just that

Answer 3

I use KeePass and it has served me well.

It's free and has lots of good features. Folders for different groups (Personal, Work, etc), extra fields like URL and Notes.

Answer 4

I use http://www.clipperz.com/ it's a great open source webapp that stores passwords and even better if you want to host your own copy on your own server you can.

The service includes the ability to download backups in multiple formats, import the data, setup one-time super secure access codes and even an offline copy if you need it.

Answer 5

I've been using 1Password for a while now, and really like it. It started out as Mac only, but they recently came out with a version for Windows. They also have versions for Android, iOS (iPhone, iPad), and Palm OS. When combined with dropbox, it allows you to keep your passwords synced across systems.

Answer 6

Synchronise your browser preferences (including passwords).

You can do it with Firefox using Mozilla Weave/Firefox Sync. Or across other browsers using Xmark's password sync

Answer 7

Combine the password by usering two passwords. Password 1 might be: jmxkjsjhi Every of your full passwords then begins with jmxkjsjhi .

Then add a second password for every website that's different. You can store the seconds passwords in a text file while keeping the first password in your head.

Answer 8

There are several web based apps that you can use. One is obviously dropbox, which you could also have on your iphone. Another is evernote. Both are easily accessed online and via phone.

Answer 9

One simple solution is to use a TrueCrypt partition on a USB storage device.

Answer 10

If you use a password manager and store its database on portable media (USB stick etc.), don't use it from a computer that may be infected with malware (Internet Caffe, careless friend's computer,...). The malware has the potential to extract all URLs/usernames/passwords from the database after you unlock it with the master password, not only the ones you retrieve.

Answer 11

I'm a big fan of PwdHash, which allows you to use the same underlying password on different web sites, with unguessable "hashed" actual passwords for each specific site. That way if someone at EvilSite.com gets your password, they can't use it to log into your Facebook or Gmail accounts. There's a plugin to use it on your usual computer, and you can use the PwdHash web site if you're on some other computer. Note that your unhashed password never ever goes over the internet, just the hashed password.

Answer 12

I use PasswordSafe - Free, Open Source password database. http://passwordsafe.sourceforge.net/

Answer 13

I can recommend Sticky Password manager. Works also with applications like Skype, QiP, FTP clients etc. Great tool for automation.

Answer 14

You can try Passpack.com as an alternative to Lastpass.com. They both have similar functionalities. I personally prefer Passpack. It supports many 3rd party sign on sites, master password, two-factor authentication, password sharing, note taking, mobile version, etc.

Answer 15

You could take the source of PwdHash, introduce some hashing salt of your own, and host it yourself privatly (or run it of your local devices.)

To introduce even more security to this model, you could split the sites you access up into different security groups with different group passwords.

The draw-back of using something like PwdHash is that you do not actually store the account information. This does mean it cannot be stolen either, but it requires you to at least remember the username and optionally security level (as mentioned above).

Another problem rises wen a site refuses to accept the hashed password due to some or other requirement on their end. Or I'd you needed to change just one password. This would mean that you would have to change all or at least all in that security group.

The better—though more crude—option is probably a self-hosted service like Clipperz or centrally hosted but provider-safe service like LastPass.

Answer 16

I use Password Hasher Firefox plugin.

How Password Hasher helps:

• Automatically generates strong passwords.
• One master key produces different passwords at many sites.
• Quickly upgrade passwords by "bumping" the site tag.
• Upgrade a master key without updating all sites at once.
• Supports different length passwords.
• Supports special requirements, such as digits and punctuation.
• Supports restricting a hash word to not use special characters. (New!)
• Saves all data to the browser's secure password database.
• Generates a portable HTML page with your site tags and option settings that allows you to generate your hash words in any browser on any machine without the extension installed. (New!)
• Can add marker buttons to unmask passwords on any web site. (New!)
• Extremely simple to use!

Answer 17

You can use a Google Docs to track passwords. If you connect using HTTPS it should be secure enough.

It has been pointed out that this method may become insecure if you stay logged into your email on an insecure machine.