52

I'm looking for a password manager which is available as Android App and Linux Desktop application alike. I know there's e.g. KeePassDroid (see: Password manager for Linux with just working in-browser autotype), but that does not fit my requirements, as it has a "fixed layout" when it comes to its "password form".

What I need:

  • must be available as native Android app and native Linux Desktop application
  • specific forms for different "password" types, such as credit cards, login information, etc.
  • folder-like organization (or at least categories somehow)
  • secure storage (i.e. good encryption)
  • data file location should be configurable (requirement for the next item)
  • Sync between Desktop and Mobile must be possible by simply synchronizing the database file
  • Android app must not require network access (sync will be done separately)

Preferred options (not mandatory)

  • nice GUI
  • icon-sets to select icons from for folders and "leafs"
  • is contained in Ubuntu repositories (PPA is fine, a .deb would do, no problems if it comes as .jar or ready-to-go .tar.gz however, or source if not too many dependencies (I feel fit enough to configure && make && check-install ;) I'm currently running Ubuntu 12.04, but plan switching to Debian with my next install – which won't be too soon, however)

Candidates tried, but failed:

  • KeePassDroid / KeePassDroidX: While offering clients for multiple platforms, the format is fixed for "web logins" (name, url, login, password, comment), which is unsuitable for e.g. credit or debit cards.
  • Pocket: while offering an Android app and Java desktop, and seemingly even different "forms" suitable for credit cards, logins, and more, the Android app requires the Internet permission, and it wants to sync via Dropbox. Also I couldn't get the desktop app working (it required an existing database, which was of course not there to start with), using the same database on both ends involves permanent renaming of the file (both ends are fixed to different file names), plus the Desktop has trouble with mixed-case directory names on case sensitive file-systems.
  • Hello Izzy, have you looked into EnPass? It supports iPhone, Android, Windows and Linux. It categories accounts, has standard encryption, is 100% local etc. I'm not able to answer this at the moment but can go into details later. Please give it a look (it's free up until 20 logins). – DankyNanky Sep 21 '15 at 1:34
  • Thanks, @MichaelNancarrow – but it disqualified itself by permissions (Android): "Android app must not require network access" – Enpass requires network state, wifi state, and full internet access. – Izzy Sep 21 '15 at 6:59
  • Hello Izzy. My apologies. It requires this to enable you to sync data (it is local by default). It also allows sync to setup a service where you go to a web address on a specific port to access the file. The app itself must require this but to operate it does not. – DankyNanky Sep 21 '15 at 7:52
  • 2
    I thought so, but I don't want that ("sync will be done separately"). When it comes to sensitive data, I'm rather "paranoid". If the app has network access, it theoretically could even transfer unencrypted data somewhere else. No guarantees it does not. – Izzy Sep 21 '15 at 8:24
  • 1
    Just as a note (not tested, and not being a perfect match lacking e.g. credit card / free format of fields): CodeGuard seems to come close. Offers PIN and Logins, and has a desktop pendant using Java. – Izzy Mar 2 '16 at 15:51
47

The easy thing about your criteria is that you don't actually need a matched set. As long as the data file is completely inter-operable, any combination of unrelated apps will work.

TL;DR

KeepassX 2 + Keepass2Android use the same data format and are the only pair I know of to meet all your criteria, even though there are a couple "gotchas".

Data format

As far as password-manager data formats that are interchangeable go, there is basically one 800 pound gorilla in the room. The data format originally conceived for KeePass is both well established and widely supported. The cryptography used has also been extensively peer reviewed so it is arguably safer than many smaller players or commercial solutions that use proprietary formats.

The trick is going to be that you need to use version 2 of the data format (kdbx). Your criteria includes several items including the need for custom data fields that were not possible in the version 1 database format (kdb) which restricted entries to a pre-defined set of fields that made is suitable for a rigid "login credentials manager" roll but not a "private data manager" role that you are looking for.

History

The original KeePass software was written for Windows. and the 1.x series only worked on that platform (although it worked under WINE so some of us got Linux mileage out of it before there were alternatives. The 2.x series is basically a rewrite with many advancements that includes a port that will run under Mono for Linux, OSX and BSD support.

I would actually recommend not using the original client software and using some of the alternatives instead. The pair I use seem to match all your criteria perfectly with one caveat. The keepass database format allows arbitrary key/value pairs to be stored with each entry. While theoretically this could be used with a smart interface that intelligently adapted to different entry types (e.g. website login, credit card data, passport, etc), to my knowledge no clients yet do this. What you can do is use the arbitrary fields to organize your own data.

That caveat aside, I tried a LOT of alternatives when I was picking my own solution and was unable to find a better pair. If something else is out there that meets your criteria better I would like to hear about it too as our needs seem similar. This is the best setup I could arrange.

Linux Client Recommendation

The KeePassX project has been around quite some time. It was originally conceived as a parallel to the Windows project and indeed called KeePass/Linux. After the original project got a port of it's own, the name KeePassX was adapted and the code has in fact been ported to also run on Windows and OSX. As you can see from the commit log it is actively developed, but unfortunately the project has always suffered from very long release cycles and a hesitancy to call anything stable that hasn't stood up to years of testing.

For your purposes you will need to use the 2.x series. If your distro still has the 0.4.x series the data format won't be interchangeable with the Android app in this recommendation.

Since anything you would be putting in such a system is obviously important and irrecoverable if you were to corrupt it, you should definitely have a fail safe backup system it place. I like to keep my database it a private git repository so there is a versioned history of it spread across many of my machines as well as some special backup provisions. You said you are going to be syncing and managing the database file yourself. This is fine, just do your homework and do it right. It is NOT the client software's fault if a corrupted copy of the DB gets synced across all your devices and clobbers your backups!

The latest KeepassX 2 release tag as of this writing edit is 2.0.3, but check the project news and source code tags for new ones. That source can be downloaded, compiled and installed from the announcement page or you can download an up to the minute zip from the project's Github mirror

Android Client Recommendation

You mentioned you had tried KeePassDroid, which was an attempt to port the KeePass 1 software to Android. I found the interface to be clunky and (when I last tried it) it did not support custom fields. There is support for kdbx format files (marked beta) but not all the features are exploited.

Instead I use use Keepass2Android and find the interface to be better than any of the other KeePass compatible clients available. There is an offline version that is stripped of all connectivity options if you prefer to do the sync yourself, so that criteria is met. Custom fields are also supported and the interface even makes this relatively simple. The download is a little heavy weighing in at an unwieldy 13 MB, but in practice the front end is clean and fast and has been updated regularly to keep pace with the latest Android UI guidelines. The backend is heavy because is it wraps up other widely used code for the actual encryption but this does mean you can be pretty sure that the cryptography is being done right than some one-off design.

Bonus

Let's say you are on a Linux box (or almost any other desktop platform) and need into your password database but can't be bothered to install a program from source or fiddle with custom package repositories. There is an open source JavaScript client with read-only support for KeePass (kdbx only) files called BrowsePass (Chrome extension here).

  • I've just tried KeePassX 2.0 and it's very very promising so +1 for your answer. The only thing that I have problem with is the auto-type - custom placeholders (e.g. {S:xxx}) and key modifiers (^,%,+) does not seem to be supported (yet). – tmt Jan 6 '15 at 15:52
  • @Caleb, actually unless I'm missing something, you just said "I would actually not recommend using the original client software" and left it at that without any reasons. What makes KeePassX better than the original client in your mind? I'm personally very happy with the original (version 2). – Ben Aug 26 '15 at 3:45
  • @Ben If you want to recommend that feel free to post your own answer but it I found the interface clunky and slow and prone to glitches, largely due to it not using a native widget framework but running on a Mono portability layer. Not everyone is going to be happy with having Mono on their system. It especially doesn't play nice with tiling window managers. – Caleb Aug 26 '15 at 4:04
  • Thanks, good reasons. I admit the client does not look very good in Linux; I primarily use it in Windows. Maybe I'll give KeePassX a try later. Does it have browser extensions like chromeIPass for "normal" KeePass? – Ben Aug 26 '15 at 4:31
  • 1
    @Izzy To quote myself above: «The pair I use seem to match all your criteria perfectly with one caveat. The keepass database format allows arbitrary key/value pairs to be stored with each entry. While theoretically this could be used with a smart interface that intelligently adapted to different entry types (e.g. website login, credit card data, passport, etc), to my knowledge no clients yet do this.» So no dice on that one. As you note if you try to setup custom fields the result is pretty clumsy. – Caleb Oct 8 '15 at 5:01
1

Another pair coming pretty close (it seems there's none matching all my requirements) is this:

Revelation is a password manager for the GNOME desktop, released under the GNU GPL license. It stores all your accounts and passwords in a single, secure place, and gives you access to it through a user-friendly graphical interface.

It ships in the repos of most Linux distribution, and has a user-friendly GUI (not perfect, but fine). It offers specific forms for different "password" types, such as credit cards, login information, etc., has a folder-like organization. Of course the database is stored encrypted – though I cannot tell how good this encryption is, the software claimed to have improved that with its latest version (I was asked to update to the newest format). The data file location is configurable (you are asked where to store it), and Sync between Desktop and Mobile is possible by simply synchronizing the database file. As said, it has a nice GUI (not perfect, but I like it more than the one of KeePassX). No icon-sets to select icons from for folders and "leafs" – icons are pre-defined and cannot be changed (same, unfortunately, for the templates). It is contained in Ubuntu repositories – but with Ubuntu 12.04 in an older version not compatible with the Android pendant (affected users can check with this PPA).

Revelation View-Entry Revelation New-Entry
Revelation: View an entry, add a new entry (see templates). Source: Revelation (click images for larger variants)

So far all requirements are somehow met; my caveats are:

  • templates are not adjustable (also cannot add my own). Not a show-stopper, as existing ones are almost sufficient (and unused fields are not shown in "view mode")
  • Last version was released in 2013, last activity in their source-code repo was a year ago (Bitbucket; at Github even 2 years ago) – so it's not clear wheather the software is still maintained.

The Android counter-part is available at F-Droid: aRevelation. It's pretty small-sized (just an 80 kB .apk file), and currently only a reader – so maintenance of the passwords etc. must be done at the Linux desktop, and the Android app can only be used to browse the database. Last activity in the app's Github repo was just 4 months ago – so there are chances this might change (I've explicitly asked for it yesterday, answer is pending). Only requested permission is "storage", so the requirement Android app must not require network access is fulfilled.

Update: After long time of inactivity, aRevelation has been forked. The fork, available at Github, is no longer read-only, and its GUI got a nice lift as well. This app is also available in my F-Droid repo for those interested. Once it is "up to snuff", its developer plans to work on a Revelation fork as well.

Conclusion: Not perfect, but something I could live with – provided the Android client adds some edit functionality in the near future (its fork meanwhile does). Both components are OpenSource and freely available, which is a big plus (auditing etc). Looking forward to how this evolves – and if things change, I will update this answer.


Another potential "future candidate": NS Wallet. According to their website, a Linux client is planned (they already offer desktop clients for Mac and Windows, so this one would be even more cross-platform). Will keep an eye on it and post a separate answer if and when it becomes available and meets the requirements sufficiently.

  • 1
    NS Wallet reviews on Android indicate it has a track record of loosing data. And still no Linux client, so I'd say that one is a dead end. Revelation hasn't seen any development progress since 2013. aRevelation likewise has seen no development progress over the last year and your inquire about write support went unanswered. If a read-only and heavily dated app suites your needs then great, but I would advise against this whole route for anybody new considering it. – Caleb Dec 29 '16 at 9:31
  • Thanks, @Caleb – I totally agree. But both wasn't clear when I wrote this answer more than a year ago. – Izzy Dec 29 '16 at 9:37
  • I understand. When I wrote my own recomendation I was suggesting an alpha version of something! It has since been brought to a stable release and is in many distros and all is well, but when you asked this question this was definitely a harder call. My comment was just a word to potential current visitors. – Caleb Dec 29 '16 at 9:44
  • @Caleb just as an heads-up: (a)Revelation has been forked. The aRevelation fork just made some nice progress, and its author plans to further the Linux version as well, as soon as the Android client is "up to snuff". Which makes it seem I'm going to stay with that combination a while longer :) – Izzy Jan 28 '18 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.