Take the 2-minute tour ×
Web Applications Stack Exchange is a question and answer site for power users of web applications. It's 100% free, no registration required.

I have a lot of passwords from various websites. I never use the same one twice, but the problem is that I keep forgetting them so I want to save them somewhere. If I'm on the same computer I can save them in the browser. However, that doesn't work across computers. Is there a safe way to store the passwords somewhere online?

share|improve this question
    
possible duplicate of Security of browser only password managers –  Adam Tuttle Jul 1 '10 at 1:58
5  
@Adam: this isn't a duplicate of that question. –  delete Jul 1 '10 at 2:12
    
@Kinopiko: indeed. –  akira Jul 1 '10 at 6:28
    
Might want to take a look at passSafe –  Woot4Moo Jul 1 '10 at 13:47
2  
They are subtly similar, which is why there's voting. If enough other people agree with my thought that they are very close, then they might end up merged. If nobody else casts the same vote, they won't. That's how the system works. –  Adam Tuttle Jul 2 '10 at 19:20

17 Answers 17

I use Password Hasher Firefox plugin.

How Password Hasher helps:

  • Automatically generates strong passwords.
  • One master key produces different passwords at many sites.
  • Quickly upgrade passwords by "bumping" the site tag.
  • Upgrade a master key without updating all sites at once.
  • Supports different length passwords.
  • Supports special requirements, such as digits and punctuation.
  • Supports restricting a hash word to not use special characters. (New!)
  • Saves all data to the browser's secure password database.
  • Generates a portable HTML page with your site tags and option settings that allows you to generate your hash words in any browser on any machine without the extension installed. (New!)
  • Can add marker buttons to unmask passwords on any web site. (New!)
  • Extremely simple to use!
share|improve this answer

You could take the source of PwdHash, introduce some hashing salt of your own, and host it yourself privatly (or run it of your local devices.)

To introduce even more security to this model, you could split the sites you access up into different security groups with different group passwords.

The draw-back of using something like PwdHash is that you do not actually store the account information. This does mean it cannot be stolen either, but it requires you to at least remember the username and optionally security level (as mentioned above).

Another problem rises wen a site refuses to accept the hashed password due to some or other requirement on their end. Or I'd you needed to change just one password. This would mean that you would have to change all or at least all in that security group.

The better—though more crude—option is probably a self-hosted service like Clipperz or centrally hosted but provider-safe service like LastPass.

share|improve this answer

You can try Passpack.com as an alternative to Lastpass.com. They both have similar functionalities. I personally prefer Passpack. It supports many 3rd party sign on sites, master password, two-factor authentication, password sharing, note taking, mobile version, etc.

share|improve this answer

I can recommend Sticky Password manager. Works also with applications like Skype, QiP, FTP clients etc. Great tool for automation.

share|improve this answer

Combine the password by usering two passwords. Password 1 might be: jmxkjsjhi Every of your full passwords then begins with jmxkjsjhi .

Then add a second password for every website that's different. You can store the seconds passwords in a text file while keeping the first password in your head.

share|improve this answer
    
Interesting because it does not require any encryption software. You can even post the second list on a public website, if you trust yourself not to reveal the first half. –  nic Jul 26 '10 at 6:34
    
besides this, I also like to use the first letter of the website/product/service. e.g for facebook, f+pass :P –  ajax333221 Sep 4 '12 at 2:12
    
My concern is that if any of your full passwords is compromised, combined with your plain text half-password list which will contain the last half of the full password... this could jeopardize all your passwords. –  Kevin Fegan Jan 24 '13 at 4:06

I use PasswordSafe - Free, Open Source password database. http://passwordsafe.sourceforge.net/

share|improve this answer

I'm a big fan of PwdHash, which allows you to use the same underlying password on different web sites, with unguessable "hashed" actual passwords for each specific site. That way if someone at EvilSite.com gets your password, they can't use it to log into your Facebook or Gmail accounts. There's a plugin to use it on your usual computer, and you can use the PwdHash web site if you're on some other computer. Note that your unhashed password never ever goes over the internet, just the hashed password.

share|improve this answer

If you use a password manager and store its database on portable media (USB stick etc.), don't use it from a computer that may be infected with malware (Internet Caffe, careless friend's computer,...). The malware has the potential to extract all URLs/usernames/passwords from the database after you unlock it with the master password, not only the ones you retrieve.

share|improve this answer
    
The question asked for storing the passwords online –  Tobias Kienzler Jul 10 '10 at 11:47

One simple solution is to use a TrueCrypt partition on a USB storage device.

share|improve this answer
1  
the question was on saving online –  Tobias Kienzler Jul 9 '10 at 6:39

I use KeePass and it has served me well.

It's free and has lots of good features. Folders for different groups (Personal, Work, etc), extra fields like URL and Notes.

share|improve this answer
3  
It's surprisingly configurable. Plus, you can stick it in Dropbox for cross-PC synchronization. I'd be lost without it! –  Grant Palin Jul 9 '10 at 6:26

Synchronise your browser preferences (including passwords).

You can do it with Firefox using Mozilla Weave/Firefox Sync. Or across other browsers using Xmark's password sync

share|improve this answer
    
I really like using Xmark...which handles syncing up all your bookmarks and your passwords as well across all computers you use. –  Tall Jeff Jul 10 '10 at 19:59

I've been using 1Password for a while now, and really like it. It started out as Mac only, but they recently came out with a version for Windows. They also have versions for Android, iOS (iPhone, iPad), and Palm OS. When combined with dropbox, it allows you to keep your passwords synced across systems.

share|improve this answer

You can use a Google Docs to track passwords. If you connect using HTTPS it should be secure enough.

It has been pointed out that this method may become insecure if you stay logged into your email on an insecure machine.

share|improve this answer
    
I'm not sure if this is a good idea, given how easy it is to forget to logout. –  Kendall Hopkins Jul 1 '10 at 2:52
    
Good point! Didn't think of that –  Joe Philllips Jul 1 '10 at 3:54

I suggest the use of Keepassx, an cross-platform password manager, and Dropbox. Create your password database with Keepassx and then synchronize it across all of your computers using Dropbox. I've used this approach for about a year and a half with no issues.

(I should also mention that Dropbox keeps older revisions of files so even if your database is lost, deleted, or corrupted it can be recovered. Between the version on the dropbox servers and the version on each of the machines you sync it to, you have a built in backup system)

share|improve this answer
1  
Also making a backup to a USB stick on your keychain is a good way to have your passwords with you if you don't have access to dropbox. There is a portable version of Keepassx that you can run off the keychain also. –  thelsdj Jul 1 '10 at 0:30
2  
I've used keepass for years and it's great (both the Windows and *nix variants). Have a simple backup solution of emailing the databases to a couple email addresses every week (if modified; all automated of course) since it's encrypted, which also works out well if I'm elsewhere and the copy on my thumbdrive is old. –  Roger Pate Jul 1 '10 at 1:32
1  
Great solution - unless DropBox is blocked by your corporate firewall. –  Jeff Yates Jul 1 '10 at 14:03
2  
@Jeff Yates: There are other alternatives to dropbox, especially if being cross-platform is less of an issue for you. Take a look at unison ( cis.upenn.edu/~bcpierce/unison ), Syncplicity ( syncplicity.com ), and SugarSync ( sugarsync.com ). However, I haven't tried any of these and have no idea their quality and utility. –  Zxaos Jul 1 '10 at 14:27
    
Thanks. –  Jeff Yates Jul 1 '10 at 14:29

I use http://www.clipperz.com/ it's a great open source webapp that stores passwords and even better if you want to host your own copy on your own server you can.

The service includes the ability to download backups in multiple formats, import the data, setup one-time super secure access codes and even an offline copy if you need it.

share|improve this answer
    
Clipperz is a good attempt but they have a lot of work to do yet on the fit and finish. –  Sim Jul 1 '10 at 5:49
    
Agreed on fit and finish, but the ability to self-host is a huge plus for me. –  tnorthcutt Jul 10 '10 at 13:46

There are several web based apps that you can use. One is obviously dropbox, which you could also have on your iphone. Another is evernote. Both are easily accessed online and via phone.

share|improve this answer
    
Thanks very much for taking the time to answer, but I mentioned that it's possible to save passwords in the browser in my question. –  delete Jul 1 '10 at 0:08
    
harsh ;0 apologize for overlooking it –  Jeff Epstein Jul 1 '10 at 0:24

I've never looked into its security, but LastPass (http://lastpass.com/) is designed to do just that

share|improve this answer
3  
I've used LastPass for over a year now, and have had no problems with security. Technology in use explained here: lastpass.com/whylastpass_technology.php –  Raithlin Jul 1 '10 at 6:51
    
I pay $12/year for the premium version -- the big advantage is that I can use the iPhone app. –  Doug Harris Jul 1 '10 at 14:27
1  
Upvote for Lastpass. I have switched to Lastpass and been using it for the last couple of months, and could not be happier: * Keeps passwords in sync across multiple machines * Keeps passwords in sync across multiple browsers (Firefox, Chrome, IE, etc.) * Does not store un-encrypted passwords on their server so its less vulnerable to malicious users * Easy to use! * Free (there is a premium version with more capabilities) I can't imagine living without Lastpass anymore. –  joyjit Jul 9 '10 at 17:53
    
+1000 I and all my friends/co-workers recently switched from KeyPassX to LastPass. It's got all the benefits of KeyPass (and many more) with none of the problems. It is also just as secure as KeyPass (none of the passwords are actually stored/transferred on their servers, all encryption/decryption is done client-side) –  BlueRaja - Danny Pflughoeft Oct 1 '10 at 2:31

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.