Switching Password Managers in 2026
74 points by soulcutter
74 points by soulcutter
Before switching to Apple Passwords, I think it’s worth pointing out that the only web browsers that can access Apple Passwords passkeys are those that Apple allows.
I guess it’s always good that you can export everything to a different password manager.
Which include Chrome, Safari, Firefox.
What browser are you using that cannot access Apple Passwords passkeys?
Would you rather arbitrary programs access your passkeys?
Would you rather arbitrary programs access your passkeys?
Yes. Definitely. Ideally by providing my OS password on first access, more or less how it works for passwords when an application wants to access the macOS keychain.
I see no need for Apple to insert itself here and to arbitrarily limit who is allowed to make a full-featured browser and who isn’t.
Isn't that the case will all apple services? I don't understand why the author doesn't use a more device agnostic service such as Vaultwarden.
From the original post:
I work at Apple in the password management and app/website authentication spaces
I think they may have some reasons to use the Apple Passwords app.
The criteria seem reasonable, but I understand the concern. I believe that the passkey threat model assumes the browser is trustworthy - eg the indication of which domain (RP_ID) is requesting authentication is critical to the phishing resistance, and comes entirely from the browser. So there is some justification for vetting that an app is actually a browser before letting it request authentication.
I've been using KeePassXC for years and that's been great. It's synched to my devices via Syncthing (so it stays P2P) and thus it never goes to any cloud. I could probably set up Vaultwarden on my homelab server, but the ease that KeePassXC offers doesn't really make me want to switch away from it.
On android I have been using Keepassdx and the interop with PC is great. Quite good UX on mobile these days
Been using it for years too. Awful UX but I like the sync model and that's keeping me there for now.
I badly want to switch to "Apple Passwords Exclusively + readonly encrypted blob export", but this is a deal breaker:
The Passwords app unlocks using ... your device passcode. You cannot set a different “master” password.
I am happy to hide 95% of my credentials behind a short, easy to type on the on-screen keyboard mobile passcode. But I want more entropy for the master password guiding the remaining 5%, which means I have to using something different TT
Interesting that Apple Passwords requires an application outside of your browser to work. Specifically, the iCloud Passwords browser extension depends on iCloud for Windows if you're not on MacOS. That means you can't access your passwords unless you can install software on the client, which means you can't get your personal credentials on an enterprise-managed work device.
True, but it seems the same for any alternatives? It's not like you can (or should) install your personal 1p setup onto a locked-down, presumably spyware laden work device, either.
The method outlined in this post worked perfectly for me migrating from 1Password to Bitwarden. In fact, it worked better than using the 1Password export to Bitwarden's importer, with respect to a couple SSH keys.
I wrote some notes on my experience migrating from 1Password to Apple Passwords here: https://bsky.app/profile/hermanradtke.com/post/3murtzghpfk2w
It surprises me how few technical people use pass/gopass. It's a git repository with encrypted secrets inside. Do you trust GPG or age encryption? If so, maybe consider it.
I prefer gopass for its speed and age encryption. And use pass for ios on ios devices. Granted, I use my own build of pass for ios to encrypt/decrypt age secrets on mobile devices.
Hey I need that age patch, I switched from pass to age and now just ssh into my dev box to copy passwords
Shoot me an email, happy to help!
Unless you have licensing concerns, posting it as a gist/pastebin/ghostpaste/whatever would be better than having 20,000 people email you
With two years of support for the feature request measured in a handful of people putting in the effort to mash a thumb up button, I know I'm not at risk of inundation.
This arrangement communicates to people that I've built this for myself, and I'll add features as needed. Anyone is welcome to take the code and release it as their own if they like, or take the testflight build for a test drive.
I've added more features in my private repo and will continue doing so.
The problem is key management then.
I like the NitroKey. I know a lot of people like the YubiKey.
Generate your PGP key on a computer you trust. Store a copy on a USB stick in a safe location. Transfer another copy to e.g. a NitroKey. Delete copy from computer. Voila!
My first NitroKey lasted 8 years of being in a sweaty pocket with house keys all day, and hours of use each day, before it became unreliable. If that's representative, I think people can survive doing the above dance about once per decade! (To guard against any downtime whatsoever – even once a decade – I keep a spare NitroKey fully set up and ready as a standby in the safe that holds the plaintext secret backup.)
As a bonus, the latest NitroKeys and YubiKeys also do FIDO so you can reduce reliance on passwords where possible.
PS: I agree that the GnuPG user experience leaves something to be desired. But you only really have to interact with its pain points once a decade with the above process. And I have high hopes that Sequoia will remedy a lot of its faults.
The relative absence of git users unable to manage their ssh keys suggests it isn't a large problem for technical people. GPG can be a bit more of a chore, which is why I use age.
Idk how often you move keys around. I often just make new keys and add those to my account instead.
I generally don't move them and have a key per device; secrets get encrypted for every public key. So public keys get shared when new devices are given access, and private keys never leave devices.
This is my strategy with age. I just have a script that I run to rekey when I add a new device.
https://erock-git-dotfiles.pgs.sh/tree/main/item/bin/pa-rekey.html
It wasn’t a huge problem until recently, but the fact that most people have their private keys sitting unencrypted in ~/.ssh makes them a juicy target for attackers who plant malware in dev devices. I much prefer letting 1Password manage my keys, and even better, using biometrics instead of a password to unlock them.
meta: This post is clearly riding the 1Password Omarchy support fall out. Given the amount of negative press, I wonder if there was tangible financial impact for AgileBits Inc or not.