Bitwarden vs KeepassXC - Which Is The Best Password Manager?

one of the most important things you can do to protect yourself online is to ensure that your passwords are not the same on every single service same thing with your usernames it's really hard for a hacker or whatever to get your personal information across all of your services if your password is different across every site unfortunately it is really hard for you to have truly secure passwords that are different on every single site and actually remember them now in the olden days you would just write these things down on a piece of paper and while that is probably something you could still do I know a lot of people still do this it's not the most secure obviously and it has the potential of getting lost right it's really or damaged or any number of things can happen to your passwords on a piece of paper plus if you're anything like me and back in the day you probably wrote all these things down in a notebook and over time that notebook probably got a little bit disorganized so the whole manual way of using a password manager isn't the best way of doing it fortunately there are many different software password managers out there now we've obviously heard a lot about LastPass in the last couple months because of the data breach and stuff like that and I am not going to recommend LastPass to anyone ever again I don't think it's a good service I don't think that they have really good security protocols in place to protect users data I think overall no one should ever use LastPass luckily there are some open source alternatives to LastPass and one password and stuff like that that I do that I can recommend So today we're going to compare two of them now these are the most popular ones as far as I'm aware one of them has been recommended to me over and over again the other one I've actually been using for two years and those applications are called keepass XC and bit warden so today we're gonna do a little bit of a versus we're gonna compare and contrast these two very popular password managers and see if you can determine between M which one is right for you so before we start off and get into the details the first thing that I want to talk about is the major differences between these two password managers and that is that keepass XC is 100 local meaning that there is no synchronization service there is no server somewhere on the internet where all of your passwords are stored none of that stuff everything is stored in a database that you have complete control over that is stored on your computer or wherever you want to store it now this gives you a lot of flexibility but it also has some drawbacks which we'll talk about later bit Warden on the other hand is a service and what I mean by that is that it is by default it will take your passwords from an account that you sign up for and synchronize them to the cloud where you can then access them from any device and obviously the elephant in the room here is that you do not have control over that service now bit Warden is 100 open source they do have independent audits on all of their software so out of all of the password manager Services out there this is the one that I trust the most so I don't see it as a downside that you sync your passwords to a Cloud Server now like I said obviously there are pros and cons to both of these approaches and we'll talk more about them as we go along here but I wanted to take that and put that difference right up here at the top because I think it's probably the most important thing now let's go go ahead and jump into keepass XC and I'm going to spell this out for you because I'm for sure going to have a problem saying this I'm having a really hard time talking today words are just not my 4K for whatever reason so keepass is spelled key K you see this is what I'm talking about k-e-e-p-a-s-s-x C is in the letter c you'll probably hear me say keepass XE because apparently c and e are exactly the same letters in my little brain so if I say that just know that I made a mistake it's keepass XC now keepass is an interesting application in that it is just one of many different versions of keepass out there keepass XC is one there's keepass X there's keepass XD or something like that there's probably six or seven different versions of keepass from what I can tell keepass XC is the most popular of all the keypads Forks whether or not that's actually true I don't know it's just been the one that's been most recommended to me so that's the reason why I'm comparing this version instead of one of the others so when it comes to availability keeps XC is available on Mac windows and Linux it is not available on mobile devices so in terms of availability it's a little bit constrained now that being said there are key pass alternatives on mobile devices at least there is on Android and you should be able to find some application that will read a key pass database and get your passwords on mobile it shouldn't be that hard they should be intercompatible and I say should be knowing that I didn't test that so that's kind of your mileage may vary but for sure it's available on Mac Linux and windows now in terms of synchronization this is where it's going to be a little bit different than bit worn in that like I said this is a hundred percent local so any synchronization is completely done on your end so if you wanted to have your database available on multiple devices you can actually take your database directory or file and move it from one to computer to another computer if you want to do that and that's the way you would synchronize it obviously you could also put it your database in like a p cloud or Google drive or Dropbox or something and have it synchronized that way of course then you're going to be relying on the security of your Dropbox or whatever to protect those passwords now the database itself is encrypted and you can play around with what type of encryption that is by default I believe it offers 256 bit encryption so it is highly encrypted during the initial setup it's fairly simple you enter email and a password this is your master password this is the one password that you have to remember obviously because in order to actually get into your Vault you have to be able to remember that password now the one thing that is different here compared to bitward and as you'll see is that keepass lets you use any password that you want it does warn you if you use a weak password but it allows you to use whatever password so I was able to use a three letter password all of it lower case very simple and that's not obviously the best master password out there but it allowed me to do it so the initial setup is very very easy the other thing that you'll obviously have to do is choose where to put your directory your or your database directory and it brings up a file picker you can choose wherever you want to put it whether it's on you know on your local drive or in a cloud drive or whatever you can store anywhere you want just obviously you want to keep track of it so let's get into a little bit of the password creation and some of the features that keepass XC has so it does offer totp support so if you want to set up any of your accounts for two-factor authentication you can do so I'm not sure how well that's supported outside of keepass so for example I know bitwarn also supports this and it is able you're able to use it on a lot of different Services it works fairly fairly well but there are some services with bit Warden that it doesn't work with for whatever reason it those services are usually ones that prefer using Google Authenticator I'm assuming this is an assumption here that keepass has the same issues it will probably work for most services but you'll probably find that there'll be some Services where the 2fa totp functionality just doesn't work but again it's nice that that hat that that feature is there another thing that obviously allows you to do is Import and Export from other password managers so if you have a CSV from like LastPass or something like say you're leaving LastPass and wanting to come to this password manager you can import a CSV file or and several other different types of files into keepass XC and therefore you don't have to enter your passwords one by one into a new database it should input them along with all the fields that you'd normally expect in a password manager right into your database so that is nice as well so let me show you some of the other features so I'll enter my password here and it has group support so that if you want to organize your passwords and sites and whatever in whatever way you want you can do so via groups uh bit warn has this functionality as well only they don't call it groups they call them folders so this is basically just folders for your passwords and that way you can store like all your banking information sites and passwords in one folder all of your Social Media stuff and other folder and stuff it just enables you to organize your stuff a little bit better during password creation and entry creation you can obviously enter a title username and password for keepass XC you're 100 on your own when it comes to to the username with bit Warden it will generate a username for you if you wanted to have it do that on keepassxc it does give you the option to generate a password which I highly recommend you do basically what this allows you to do is set a length and what kind of characters you would you know want in your password I just select everything and then it will generate a password and that's obviously a password that you would not ever ever want to have to type in on your own so it's really kind of impossible to be and you don't have to have this extended ASCII support or whatever a lot of different sites won't actually support that so probably just keeping these buttons here clicked will make you the safest are safe enough I should say it does have some different options so that if you wanted to choose what kind of characters are in your password you could do so uh and you can obviously if you wanted to have something specific in your password you could put that in these fields here as well you also obviously would enter the URL you can sort these by tags if you wanted to you can set an expiry date for the password so that if your password expires you can set that date and then there's a notes field so that you can kind of explain what's going on there and then you can get fancy and stuff like that and add icons and several different attributes if you wanted to do that you could add attachment so let's say for example if you had some recovery codes or whatever you could actually add those right here and then you could edit the properties like when it's created and stuff like that as well you can also get to the password generator outside of the creation tool so if you wanted to just generate a password maybe it's like a one-time password you could do that by clicking this button up here now there is browser integration so if you want to not have to open up the actual application you can get browser integration working if you do so you can do that by going to the settings going to browser integration you do have to enable it by default it does link to the extensions it's available for Firefox and any Google Chrome based browser so you'd enable it you tell it which browser that you wanted to do and then press OK I have not personally used the browser integration for keepass XC I preferred using the application when I was using it so I don't really need to have both the fewer extensions that I have that I don't use in the browser probably the better so if I have the application I use the application but if you want to have the browser applic the browser extension you can it does require you to have the application installed on your system and setup so if you are on another person's system and you have the browser application or the browser extension installed but you don't have the database or you don't have the application up and running and set up it's not going to work for you that browser integration integrates with the application not with any some remote server like bitworm does in terms of other settings it does have a dark mode so if you wanted to go to dark mode you could do that one thing it doesn't do is recognize your gtk theme so if you're worried about that it just doesn't do that for whatever reason there are other settings that we can go through so it will allow you to ensure that you only have one instance of keypass XC this is important so that if you already have it open you don't open up another one and have one unlocked one locked and leave yourself open to vulnerable or bullies there you can set it to launch automatically at startup and as a minimal application a startup and it does have some settings for your managing your database as well so things like automatically saving your database after every change backing up your database after before savings and automatically backing up every time it's modified externally so I'm not sure if I change those settings or not so you'll have to forgive me there but I think that's all those things are the default so if you do make a change to your database it will back it up automatically one thing that I don't see is an automated backup like based on a time so if you wanted to have your your database backed up on a certain time frame I don't see that functionality but you can set it so that you have two different places for your database one of them can be a backup in a different place like on a server somewhere or in a like a cloud file or whatever that way you always have a backup your database because remember if you you lose your database you lose all of your passwords and that can be devastating so ensure that your database directory or file or whatever is always backed up honestly that feature there should be default but it's not you have to select it yourself in terms of security here's a couple things that I noticed so it does have clear clipboard after a certain amount of time it does not work on xfce for whatever reason so if you copy a password to the clipboard it just stays there forever so don't show people your password so right here I have clipman I'm not going to show you because I have passwords in there probably but it does have a clipboard history so don't show people your clipboard history unless you know for sure that this is working so uh for whatever reason the clipboard management of keepass XC does not work also by default the application just stays unlocked okay there's no timeout of the the Vault or the database over a certain period of time by default you can turn that on if you want but by default it's just it once you unlock it it stays unlocked so that is a security flaw I would say it should definitely be after 30 seconds of inactivity or whatever it is it should it should lock itself but it doesn't you can set it up obviously another feature that it has is a SSH integration I'm not exactly sure how this works I'm thinking that it allows you to SSH into your database so that you can use your database on other devices I'm not sure how well or how secure that actually is but it does have that functionality another cool major feature of keepass XC is it allows you to have multiple databases so you could have two different databases on your device for certain like one for work one for personal if you wanted to do it that way you know one for social media one for you know you're more sensitive that banking accounts and stuff like that if you wanted to separate your passwords that way you can have as many databases as you want and you can merge them and unmerge them however you want to do or you can just log into one log out log into the other one however you want to manage it that's one of the coolest features of keypass that bit one does not have as far as I'm aware you have full control over your databases and because of that you can have multiple and that just really works out very well one feature that I didn't get a chance to try is something called auto type basically what that does is when you have a username and password field selected you can use this auto type and it will try to close this window go to the previous window that you were on and autofill the username and the password again I didn't get a chance to actually try this out but if it works it'd be similar to what you would expect with a browser integration if you don't want to use the browser integration so that is another feature as well so I'm going to talk a little bit now about some of the missing features some of the or missing things that I that I noticed while I was using this and some of them I've already talked about so obviously the big missing thing here is cloud integration and synchronization functionality if you want to synchronize this to other devices you have to do it all manually again that's both a feature and a downside it's a feature and obviously that you have the security of knowing that you have complete and control of your database it's a downside in that you you lack the convenience of being able to access your passwords from multiple devices without unless you have set that functionality up yourself so both sides of the coin there really does depend on how much you value having complete local control I mentioned the lack of gtk support I'm not sure what this is actually written in but it's obviously not a gtk application so if you know look and feel bothers you uh that's something to keep in mind there uh I talked about the availability of the mobile application earlier so if you want to have an actual keepass XC mobile application that doesn't exist it does have other keypass variants on there so you should be able to use it again should be the word there because I'm not actually sure uh if you're using the snap version of keepass XC the browser integration does not work as at the moment and I talked about the keyboard exploration not working on an xfc I'm not sure if that works on other desktop environments it just did not work on xfce and then I also talked about the default of the application not locking after a certain period of time it by default it just stays open but there is an option to set it to lock I'm pretty sure I would argue that by default it should lock after a certain period of time that should be default but it's not so that is keepass XC and overall it is a very good password manager if you want to have full local control over your passwords this is a good one to try some of the for me personally I prefer to have my passwords on multiple devices and I'm a lazy SOB so having it synchronized automatically like bit Warden does is a boon for me not a downside so as I said at the beginning the biggest difference between these two is one is Local 100 local the other one is by default set up to use the cloud so that major difference is probably the thing that's going to be the biggest decider for most people whether or not you want the local aspect of it or whether or not you want the Cloud sync those two or that one feature is probably the biggest thing for most people so let's go ahead and move on to bit Warden okay so let's first talk about availability bit Warden is available on every platform form and by every platform I mean every platform because it also has a web version so native applications are available for Mac Linux and windows if you want to use a native client you can obviously get it for mat for Android and iOS as well like I said there's a web interface which we'll talk about a little bit later there's browser extensions as well so you they'll have browser Integrations we'll again talk about that here in a few minutes so in terms of availability bit Warden is much more available across multiple devices than key passes also because you're signing up for an account that's going to synchronize all of your data to a server your data is available on every single platform that you can sign in on so if I have say bit Warden on this computer here and on my computer there and on my laptop all I have to do is sign in and I have access to all of my passwords as I said in the keepass XC part of it this is both a boon and a downside so it's a boon in that it's very convenient it means that you don't have to worry about synchronizing a synchronizing any of that stuff yourself but you are relying on someone else's server to secure your data now obviously all of the Vault information and stuff like that is highly encrypted so the chances of a hacker actually getting into your vault is pretty slim also bit Warren is 100 open source and they perform outside audits or independent audits on their data so they hire a firm to audit all of their source code and stuff like that to ensure that it's as secure as possible now obviously no software is 100 bug free so it's a weighing of convenience versus security obviously so you want to kind of keep that in mind if you choose to use bit warden for me personally I trust bit Warden quite a bit mostly because it's open source and I've read a lot of their security documentation and I've read the audit so I know that they've put a lot of effort into making this as secure as possible and like I said I trust them more than a closed source application like LastPass where they obviously have some security problems because they continue to use lose user data so again it's one of those things where you kind of have to weigh your options do you prefer to use that local options of keepass or do you prefer the convenience of bit wardens so the availability and synchronization features are the two things that I wanted to talk about up front so next let's go ahead and talk about initial setups and this is a little bit different than keepass in that because it has a lot of online functionality they require you to have a certain level of password now they don't require you to have like certain characters or whatever in your password but they do require a certain length so you'll notice in the b-roll that I'm showing right now there were several passwords that it just didn't accept so and unlike with keepass where it took the three letter password for your master password for me I had you find it a you know an eight character password and it does not like the fact that I used a really weak password and you can tell that by the fact that it showed me captcha twice now I can tell you from having used bit warden for over two years that's not normal it just does not like that you're using a weak password it's assuming that I'm a some kind of Bot and that I've created just a very weak master password because you know it's easier to type or whatever so the capture thing that you see in the b-roll here is not normal that's just because I have a weak password the stronger your password is the less likely you are to see that captcha you will see it from time to time but it's not nearly as often as you see in this the the b-roll there so uh just create a strong master password obviously do that for any password manager you're using that should go without saying but just know that bit Warren's a little bit more strict when it comes to what your master password is so let me show you a bit War now this is what bitworm looks like and let me see if I can remember that password that they actually forced me to use which I can so this is what bit Warden looks like again no GDK support here so it doesn't really pull in a lot of your gtk stuff it does have its own Dark theme and stuff so it's not going to fit in I know I point that out but when it comes to looking feel stuff that's the first thing that I always notice for whatever reason so like with keepassxc obviously you can Import and Export from other password managers it supports multiple different file formats so if you have a CSV or whatever you can import that and it has the standard Fields you have so if you if we take a look at the password creation or the the item creation here you can choose a different type so it does support different types whereas keeps XC you could probably use keepass to store like credit cards or whatever it just doesn't have that functionality built in whereas bitwarn does bitwarn also allows you to create secure notes so if you wanted to have some kind of encrypted note you could do that in terms of the actual storage of login information stuff like that you name the the site or whatever that you're going to be storing it for you can generate a username or you can type in your own username you can generate a password just like you can with keep sxc and it also allows you to to create different passwords based on different options like length and the number of type of characters that are there so you have a lot of control over what the password actually looks like uh just like you do with keepass XC also like keep sxc this does have totp functionality so if you use or you want to use bit Warden as your two-factor authenticator you can do so the one thing that I will note for you is that bit Warden also supports 2fa login to bit Warden and that's something that keepass does not support so if you want to have 2fa on your master password for bit Warden you can do that obviously you'll have to use a different authenticator to do that so if you want to use uh Google Authenticator or authy or whatever you can do that just for bit warden so that you have two-factor authentication enabled on your bit Warren account that adds an extra layer of security that you don't have with keepass XC so just keep that in mind it's really really nice that that's able I do think it's more important to have on bit Warden because all of your stuff is online because it's online it obviously has more exposure to threats so having two-factor authentication enabled for your actual bit Warren account is something that is much more needed on bit Warden than it is on keepass which is all local similar to keepass it does have quote unquote group functionality they call them types you can you have login card identity security note but you can also create folders for those items so the folder functionality here is similar to the group's functionality in keepass XC so if you want to have all of your stuff organized by type you can do so also unlike keepass XC but Warren supports by metric information so if your computer has a touch or a fingerprint reader you can use that and if you have a fingerprint reader or you have face unlock or whatever on your phone you can use your fingerprint or your face to unlock bit Warden you do have to set that up it's obviously not by default so if you want to that adds an extra layer of functionality but also it enables an added level level of convenience that you can enter your Vault without having to enter your your master password it also has browser integration just like keepass XC but unlike keepass that browser integration can work on its own so you don't have to have the the application local for your browser integration to work because it's not accessing accessing your database from your computer it's accessing it from the server side so you can log in on a friend's computer if you wanted to do so or you know at a you know whatever on some other device and you wouldn't have to worry about having your database locally it finds it all from the server side so that means that the browser integration or the browser extensions can work on their own in terms of settings there's not nearly as many settings here as with keepassxc but that's because most of the settings are actually on the online account so if you have more security concerns in terms of setting actual security settings most of that stuff is online instead of in the application itself so basically these are just application specific settings most of your main account settings are through a web interface which I'll show you here in a minute so the settings here you can set how it or what it does when your Vault times out so you can either set it to lock which is just basically just put a lock screen on it or it can log you out completely also like keypass XC by default the Vault timeout is on restart of the application not on a time again I would argue that every password manager should set this to some period of time by default at least this has Vault Timeout on by default the other one did not so if you do use the desktop application I would say come in here and change it to some one of these time periods it doesn't really matter what you just want to make sure that your vault is locked if you should walk away from your computer most people just close the application so this default is probably at least a little bit better than keep sxc it also has an option to clear the clipboard just like keepass XC it does not work in xfce so if you copy a pass a password to your clipboard it just stays there I'm not sure why it does that maybe that's probably just an xfce or a clipman uh bugger or whatever but for whatever reason it does just stay there you can minimize the application to the tray if you wanted to keep it running all the time I don't do that you can also start automatically and log in if we go to a browser and go to bitwaren.com you can we can actually log in here with our username and password so the email at the linuxcast.org is the email that I used it's going to show me capture again because it's a really weak password so it wants me to anything with sunflowers so there's sunflower those are all sunflowers you really got to know your flowers because that's the second one that I've seen with flowers it's going to make me do it again that's excellent so this now you got to know your daisies uh gonna know what a daisy looks like I think that's a daisy and I think that's a daisy okay verify again there we go now we should be able to log in so the reason why I wanted to show you this is because if you don't have access to the application you can get access to your entire Vault here on the online and it does obviously email you that somebody logged in and then you can see your account settings as well this is where most your security stuff is this is where you want if you wanted to change your master password this is where you would do it whereas with keepassxc you would change your master password inside of the application you can also set up 2fa here so if you wanted to use a Yuba key or anything like that you could use all that stuff and all that stuff is set up here there are several other settings here these are the settings that you see in the application so those are basically the same and this is where something's a little bit different now by default basically everything that you'd want with a password manager is free but they do have a yearly 10 subscription basically what it does is just adds a amount of storage to your account where you can store secure notes it also enables the totp verification in generator for login so by default the totp stuff is hidden behind the paywall so that is a downside it also enables yubikey and Fido support so some of the stuff that I've talked about is behind a paywall but the thing is that it's ten dollars a year so it really really is very cheap I pay the ten dollars a year for the totp support that's really the only feature that I care about and it is open source so by paying them I do support an open source project but I understand that not everybody wants to pay for this so this is probably one of the biggest downsides of bit Warden is that some of the stuff that they offer you like the totp the UB key stuff is hidden behind that paywall one thing that we should talk about next and that I can't show you because I don't have it set up is that that Warren has an option to host everything locally so if you want to have something similar to keypads XC you could do so with bit Warden there are options out there there's bitward and CLI there's Vault Warden which is a self-hosted version of bit Warden I believe it's written in Rust so it's supposed to be faster so you could theoretically if you wanted to host everything that bitwarn does in their server in their servers on your own server that way it gives you complete control and this is enabled because it is open source so that's definitely an option if that's something that you want to do so just wrapping up I've already talked about the downsides throughout this whole thing but I'll recap a couple of them the clipboard exploration does not work the default timeout is set to restart and not a time and it does have fewer app app it does have fewer app settings than keepass XC does also I'm going to put the paywall thing there as a downside too because because that two-factor authentication stuff is hidden behind the paywall that does take one of the big reasons why I like but Warren kind of off the table for people who don't want to pay so that is something that is kind of a downside but again it's ten dollars a month or ten dollars a year I should say and if you need that functionality I think it's well worth it so that's keepass and bit Warden now the question is which one of these two is best for you and the you probably can already guess my answer to this for me personally I like bit worn better because of the convenience of having it online and I can access it from any device that I want also I think the two the two-factor authentication stuff is really really good so I use that extensively for all of my 2fa stuff online I will say that for you for you out there making this decision it's really going to depend on which one of those things that you want do you want the local functionality of keepass or do you want the more convenient Cloud synchronization of bit Warden that feature is like I said before the deciding factor for most people all the other stuff is just kind of Superfluous honestly most of those features are available in both applications and you know it's just really how those features are implemented so the features themselves really don't matter nearly as much as deciding which you'd rather have would you want the local support or the local control or do you want the convenience of the cloud you know integration so that's this video if you have thoughts on keepass XC or bitward and you can leave those in the comment section below I'd love to hear from you you can follow me on Mastodon or obviously those links will be in the video description you can support me on patreon patreon.com linuxcast links for YouTube and liberape will be in the video description thanks to everybody who does support me on patreon YouTube you guys are all absolutely amazing Without You The Challenge will not be anywhere near where it is right now so thank you so very much for your support I truly do appreciate it thanks everyone for watching I'll see you next time [Music]

Channel: The Linux Cast

Views: 12,169

Keywords: linux, open source, apps, keepassxc, bitwarden, keepass vs bitwarden, keepassxc vs bitwarden, keepass xc vs bitwarden, best password manager

Id: LJooJC2LfcM

Length: 34min 18sec (2058 seconds)

Published: Thu Feb 09 2023