Password manager for Linux and Android

Question

I'm looking for a password manager which is available as Android App and Linux Desktop application alike. I know there's e.g. KeePassDroid (see: Password manager for Linux with just working in-browser autotype), but that does not fit my requirements, as it has a "fixed layout" when it comes to its "password form".

What I need:

• must be available as native Android app and native Linux Desktop application
• specific forms for different "password" types, such as credit cards, login information, etc.
• folder-like organization (or at least categories somehow)
• secure storage (i.e. good encryption)
• data file location should be configurable (requirement for the next item)
• Sync between Desktop and Mobile must be possible by simply synchronizing the database file
• Android app must not require network access (sync will be done separately)

Preferred options (not mandatory)

• nice GUI
• icon-sets to select icons from for folders and "leafs"
• is contained in Ubuntu repositories (PPA is fine, a .deb would do, no problems if it comes as .jar or ready-to-go .tar.gz however, or source if not too many dependencies (I feel fit enough to configure && make && check-install ;) I'm currently running Ubuntu 12.04, but plan switching to Debian with my next install – which won't be too soon, however)

Candidates tried, but failed:

• KeePassDroid / KeePassDroidX: While offering clients for multiple platforms, the format is fixed for "web logins" (name, url, login, password, comment), which is unsuitable for e.g. credit or debit cards.
• Pocket: while offering an Android app and Java desktop, and seemingly even different "forms" suitable for credit cards, logins, and more, the Android app requires the Internet permission, and it wants to sync via Dropbox. Also I couldn't get the desktop app working (it required an existing database, which was of course not there to start with), using the same database on both ends involves permanent renaming of the file (both ends are fixed to different file names), plus the Desktop has trouble with mixed-case directory names on case sensitive file-systems.

Answer 1

The easy thing about your criteria is that you don't actually need a matched set. As long as the data file is completely inter-operable, any combination of unrelated apps will work.

TL;DR

KeepassX 2 + Keepass2Android use the same data format and are the only pair I know of to meet all your criteria, even though there are a couple "gotchas".

Data format

As far as password-manager data formats that are interchangeable go, there is basically one 800 pound gorilla in the room. The data format originally conceived for KeePass is both well established and widely supported. The cryptography used has also been extensively peer reviewed so it is arguably safer than many smaller players or commercial solutions that use proprietary formats.

The trick is going to be that you need to use version 2 of the data format (kdbx). Your criteria includes several items including the need for custom data fields that were not possible in the version 1 database format (kdb) which restricted entries to a pre-defined set of fields that made is suitable for a rigid "login credentials manager" roll but not a "private data manager" role that you are looking for.

History

The original KeePass software was written for Windows. and the 1.x series only worked on that platform (although it worked under WINE so some of us got Linux mileage out of it before there were alternatives. The 2.x series is basically a rewrite with many advancements that includes a port that will run under Mono for Linux, OSX and BSD support.

I would actually recommend not using the original client software and using some of the alternatives instead. The pair I use seem to match all your criteria perfectly with one caveat. The keepass database format allows arbitrary key/value pairs to be stored with each entry. While theoretically this could be used with a smart interface that intelligently adapted to different entry types (e.g. website login, credit card data, passport, etc), to my knowledge no clients yet do this. What you can do is use the arbitrary fields to organize your own data.

That caveat aside, I tried a LOT of alternatives when I was picking my own solution and was unable to find a better pair. If something else is out there that meets your criteria better I would like to hear about it too as our needs seem similar. This is the best setup I could arrange.

Linux Client Recommendation

The KeePassX project has been around quite some time. It was originally conceived as a parallel to the Windows project and indeed called KeePass/Linux. After the original project got a port of it's own, the name KeePassX was adapted and the code has in fact been ported to also run on Windows and OSX. As you can see from the commit log it is actively developed, but unfortunately the project has always suffered from very long release cycles and a hesitancy to call anything stable that hasn't stood up to years of testing.

For your purposes you will need to use the 2.x series. If your distro still has the 0.4.x series the data format won't be interchangeable with the Android app in this recommendation.

Since anything you would be putting in such a system is obviously important and irrecoverable if you were to corrupt it, you should definitely have a fail safe backup system it place. I like to keep my database it a private git repository so there is a versioned history of it spread across many of my machines as well as some special backup provisions. You said you are going to be syncing and managing the database file yourself. This is fine, just do your homework and do it right. It is NOT the client software's fault if a corrupted copy of the DB gets synced across all your devices and clobbers your backups!

The latest KeepassX 2 release tag as of this writing edit is 2.0.3, but check the project news and source code tags for new ones. That source can be downloaded, compiled and installed from the announcement page or you can download an up to the minute zip from the project's Github mirror

Android Client Recommendation

You mentioned you had tried KeePassDroid, which was an attempt to port the KeePass 1 software to Android. I found the interface to be clunky and (when I last tried it) it did not support custom fields. There is support for kdbx format files (marked beta) but not all the features are exploited.

Instead I use use Keepass2Android and find the interface to be better than any of the other KeePass compatible clients available. There is an offline version that is stripped of all connectivity options if you prefer to do the sync yourself, so that criteria is met. Custom fields are also supported and the interface even makes this relatively simple. The download is a little heavy weighing in at an unwieldy 13 MB, but in practice the front end is clean and fast and has been updated regularly to keep pace with the latest Android UI guidelines. The backend is heavy because is it wraps up other widely used code for the actual encryption but this does mean you can be pretty sure that the cryptography is being done right than some one-off design.

Bonus

Let's say you are on a Linux box (or almost any other desktop platform) and need into your password database but can't be bothered to install a program from source or fiddle with custom package repositories. There is an open source JavaScript client with read-only support for KeePass (kdbx only) files called BrowsePass (Chrome extension here).

Answer 2

Another pair coming pretty close (it seems there's none matching all my requirements) is this:

Revelation is a password manager for the GNOME desktop, released under the GNU GPL license. It stores all your accounts and passwords in a single, secure place, and gives you access to it through a user-friendly graphical interface.

It ships in the repos of most Linux distribution, and has a user-friendly GUI (not perfect, but fine). It offers specific forms for different "password" types, such as credit cards, login information, etc., has a folder-like organization. Of course the database is stored encrypted – though I cannot tell how good this encryption is, the software claimed to have improved that with its latest version (I was asked to update to the newest format). The data file location is configurable (you are asked where to store it), and Sync between Desktop and Mobile is possible by simply synchronizing the database file. As said, it has a nice GUI (not perfect, but I like it more than the one of KeePassX). No icon-sets to select icons from for folders and "leafs" – icons are pre-defined and cannot be changed (same, unfortunately, for the templates). It is contained in Ubuntu repositories – but with Ubuntu 12.04 in an older version not compatible with the Android pendant (affected users can check with this PPA).

^{Revelation: View an entry, add a new entry (see templates). Source: Revelation (click images for larger variants)}

So far all requirements are somehow met; my caveats are:

• templates are not adjustable (also cannot add my own). Not a show-stopper, as existing ones are almost sufficient (and unused fields are not shown in "view mode")
• Last version was released in 2013, last activity in their source-code repo was a year ago (Bitbucket; at Github even 2 years ago) – so it's not clear wheather the software is still maintained.

The Android counter-part is available at F-Droid: aRevelation. It's pretty small-sized (just an 80 kB .apk file), and currently only a reader – so maintenance of the passwords etc. must be done at the Linux desktop, and the Android app can only be used to browse the database. Last activity in the app's Github repo was just 4 months ago – so there are chances this might change (I've explicitly asked for it yesterday, answer is pending). Only requested permission is "storage", so the requirement Android app must not require network access is fulfilled.

Update: After long time of inactivity, aRevelation has been forked. The fork, available at Github, is no longer read-only, and its GUI got a nice lift as well. This app is also available in my F-Droid repo for those interested. Once it is "up to snuff", its developer plans to work on a Revelation fork as well.

Conclusion: Not perfect, but something I could live with – provided the Android client adds some edit functionality in the near future (its fork meanwhile does). Both components are OpenSource and freely available, which is a big plus (auditing etc). Looking forward to how this evolves – and if things change, I will update this answer.

---

Another potential "future candidate": NS Wallet. According to their website, a Linux client is planned (they already offer desktop clients for Mac and Windows, so this one would be even more cross-platform). Will keep an eye on it and post a separate answer if and when it becomes available and meets the requirements sufficiently.