I am fairly new Mac user, so sorry for a newbie question. I work as a webdev and i have hundreds of login credentials for websites/FTPs/cPanels for different clients and so far i used a text document to store and manage them all (what can i do, Mac newbie lol).

Since it has become to hard to keep track of that, i am looking for the best and most secure offline password manager so i can keep track of them on a single place. I dont need any fancy features like multiple devices sync (only thing i need is an autofill) and to be honest, since the iCloud leak this year, i dont trust any company to hold that sensitive data.

Can anybody suggest me any solution, doesnt matter is it paid or free as long as it does the job.

Thanks a bunch!

  • 3
    See this answer on SuperUser - 1Password or LastPass – Mark Nov 12 '14 at 23:40

I am also a web developer and couldn't recommend 1Password more highly: https://agilebits.com/onepassword/mac

Honestly, the price has by and far been worth it for me. I believe I have ~300 login items in there and nearly all of them have different, very secure passwords. You can store nearly any data in the there and it is extremely flexible. The keyboard shortcut Command + \ automatically fills out logins and makes that part extremely easy (as long as there is a URL with that). Note that as of 1Password 5.0 it does not support auto-filling HTTP Basic Authentication. You can still copy/paste those credentials, though.

It is also possible to tag and organize items. There are many types of items including logins, servers, credit cards, identities (for filling out your name/address/email/etc.) and notes which also create a natural organization.

Edit: I also like the fact that since the URL can be (and is) saved in 1Password for the login it will not automatically fill in a form that is not the correct URL. For example if a scammer sends you an phishing email with a link to login to your bank, 1Password won't recognize the site and hence will not automatically fill the form when you hit the keyboard shortcut.

I will also note that 1Password offers excellent multi-device syncing.

I have tried SplashID and my brother (who also does web development) has tried LastPass, I believe, several years ago but we both are on 1Password and love it.

I am not affiliated with 1Password.

  • 2
    One nice feature of 1Password that you don't mention is the Watchtower, which shows websites that have been hacked or vulnerable (e.g., Heartbleed) and you should change your password. Similarly, it shows me weak, old, or duplicate passwords that I needed to change. – Geoff Hutchison Nov 13 '14 at 3:00
  • @GeoffHutchison, you are very right. There are a remarkable amount of things "under the hood" of 1Password that are great from security or convenience standpoints. – bassplayer7 Nov 13 '14 at 15:23
  • I am a huge fan of 1Password. However, as you mention that you are a web dev you need to be aware is that it does not yet support HTTP Basic Auth. As a dev I find that a big frustration. You can use the built-in Keychain application for this or LastPass which has also been mentioned supports it. – cclark Nov 19 '14 at 0:41
  • @cclark, thank you. I had forgotten about that, but edited my answer to note that. – bassplayer7 Nov 19 '14 at 15:34
  • @cclark - it used to support HTTP Basic auth but Safari changed its API so that can't be done now - see Password blogs or forum for more info – Mark Nov 19 '14 at 16:37

OSX comes with a good Keychain manager, you can sync, encrypted to iCloud or store locally.

  • Thanks for the help! Is there any standalone app that i can use (so i can sort them into different categories, export them...)? – tokmak Nov 12 '14 at 23:17
  • type Keychain Access into Spotlight – cmason Nov 13 '14 at 0:31

Another option is "pass: the standard unix password manager", which encrypts all password files with gpg.

It's an open source project, so you don't have to trust a company with your password data, which perhaps makes this preferable to the other two answers that have been suggested so far. Given that the encryption is done with gpg—a pretty widely-used open source tool for encryption—it's likely that the passwords will be pretty safe.

Moreover, the gpg-encrypted files can be stored offline, as requested by the OP. However, since the files are encrypted with gpg you can probably safely put the binary files online somewhere, so long as you take the necessary steps to protect your gpg key that decrypts the passwords.1

Passwords that are tracked by pass are stored in ~/.password-store, which is, by default, a git repository. Since the files are encrypted with gpg and can only be decrypted with your key, one thing you can do—if you want to—is add a git remote that is hosted on some cloud service, like GitHub or Bitbucket. I personally keep my ~/.password-store directory in a private repo on Bitbucket (since Bitbucket has unlimited private repos, unlike GitHub). And I feel pretty safe with this setup, given that the files are encrypted and can only be decrypted with my gpg key.

As far as autofill goes, there is a Firefox plugin that has been written by the community that uses pass.

The community has also developed a cross-platform GUI app, an Android app, a Windows client, and an emacs package.

I suppose one reason to prefer some of the other answers is that they are probably more user-friendly, but I personally prefer pass to any other options that I have come across for a Mac, since I don't have to trust companies and their closed-source password managers and since the encryption of the passwords is done with a widely-used open source encryption tool.

If the set up process seems intimidating, here is a blog post that walks you through the process.


  1. Here are two blog posts (1, 2) that detail good and safe ways to generate and protect your gpg keys.

Your Answer

 

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.