3 款开源的密码管理器
密码管理器 Padlock Passbolt KeePass

> 
> 使用一款安全开源的密码管理器来储存唯一、复杂的密码来保护你数据及账户的安全。
> 
> 
> 


![](/data/attachment/album/201612/22/155524dwn9gnaeswbtwmug.jpg)


为你使用的每个站点和服务维护一份唯一、复杂的密码是安全专家每年给公众最常提的建议。


然而不管说过多少遍，几乎每周我们都能听到 XX 网站又被黑了的新闻，问题是这些网站的用户们就爱用一些像“12345”或“password”这样的口令来保护他们的账号。


或许用户对经典的密码做了足够的变形，符合了网站所要求的最低的密码规则。但不幸的是，“Pa$$w0rd!”也不是真正意义上的安全密码。从这方面来说，大多数单词、短语及数字的组合或替换对于密码破解工具而言都太容易破解了，密码越短越容易破解。


最棒的密码应该是长长的，任何可能的字符的随机或者伪随机组合，每个使用场景都用不同的密码。但对一个普通人而言怎么可能记住上百甚至上千个他们创建的独立的账户密码呢？简短的答案是：不能。甚至不管是在现实世界或者数码世界不应该明文记录下任何一个密码。


或许最简单地保存这些复杂、唯一密码的方法是使用密码管理器，它提供了一种访问这些强密码的简单方式。虽然像 LastPass 这样商业解决方案很受欢迎，但是还有一些开源方案。另外对于密码，可以审计你的密码管理器的源码也是很重要的，因为它可以确保你的密码被正确地加密，并且没有后门。


所以不用多说，下面有几款你可以考虑的密码管理器。


### KeePass


![](/data/attachment/album/201612/22/155137atrq7znnbaagqmjq.jpg)


[KeePass](http://keepass.info/) 是一个 GPLv2 授权的密码管理器，主要设计用于 Windows ，但是同样可以在其它平台运行。KeePass 提供多个强加密选项、便于导出、多用户密钥、高级搜索特性等等。其为桌面用途设计，也有可以直接运行在浏览器中的插件，并且如果你想要在不同的机器间随身携带你的密码，它可以运行在 U 盘中。想要了解更多 KeePass 信息，你可以从在 Ricardo Frydman 的这篇[旧贴](https://opensource.com/business/16/5/keepassx)中找到。


[KeePassX](https://www.keepassx.org/)，是 KeePass 的 Linux 移植版本，是另一个你可以考虑的项目。KeePassX 与 KeePass 2 密码文件兼容，并且已经被移植到不同的操作系统上。事实上，KeePass 的[非官方版本](http://keepass.info/download.html)列表覆盖了日常使用的所有系统。


### Padlock


![](/data/attachment/album/201612/22/154501bujcqj2clcskdymy.jpg)


[Padlock](https://padlock.io/) 是一个最近新进的开源密码管理器。目前在 Windows、iOS、Android 上可用，Linux 版本正在开发中，Padlock 被设计成为了一个“极简风”的密码管理器。它的[源码](https://github.com/MaKleSoft/padlock)以 [GPLv3](https://github.com/MaKleSoft/padlock/blob/master/LICENSE) 授权的形式发布在 Github 上。项目同样也正在开发一个[云后端](https://github.com/maklesoft/padlock-cloud)，同样是开源的，这对那些厌烦了管理密码文件或者在多台电脑间设置同步的人而言是一个很好的补充。


### Passbolt


![](/data/attachment/album/201612/22/154414v2xgroeoppotpxjq.jpg)


[Passbolt](https://www.passbolt.com/) 是另一个相对较新的选择，它有 Firefox 和 Chrome 的插件，支持移动设备，还有正在开发的命令行。它基于 OpenPGP，你可以查看在线的一些功能[演示](https://demo.passbolt.com/auth/login)（虽然这需要你安装浏览器插件）。以 [AGPLv3 授权](https://github.com/passbolt/passbolt_browser_extension/blob/master/LICENCE)发布，你可以在 [Github](https://github.com/passbolt) 上查看它的源码或者浏览一下项目的[路线图](https://www.passbolt.com/roadmap)来了解下目前和将来计划的功能。




---


使用一款你信任的密码管理器以及用复杂的密码并不能代替其他安全预防措施，它也不是万无一失的。但是对于许多用户而言，它是让你的数字生活保持安全的很重要的一部分。这些的确不是唯一的选择。还有一些更老的选择，比如 [Clipperz](https://clipperz.is/) 和 [Password Safe](https://pwsafe.org/)，还有我有兴趣想尝试一下的基于 web 的工具 [RatticDB](http://rattic.org/)。


你会使用哪款密码管理器？为什么呢？




---


via: <https://opensource.com/article/16/12/password-managers>


作者：[Jason Baker](https://opensource.com/users/jason-baker) 译者：[geekpi](https://github.com/geekpi) 校对：[wxy](https://github.com/wxy)


本文由 [LCTT](https://github.com/LCTT/TranslateProject) 组织编译，[Linux中国](https://linux.cn/) 荣誉推出


OK
Maintaining complex, unique passwords for each site and service you use is among the most common pieces of advice that security professionals provide to the public every year.

Yet no matter how many times it is said, it seems like a week doesn't go by where a high-profile hacking story hits the news, revealing that users of the service in question more often than not had such *secure* passwords as "12345" or "password" as the only wall of protection on their account.

Or perhaps a user offers up just enough variation on the classic password selection to get past the minimal rules of the service. Unfortunately, "Pa$$w0rd!" isn't secure in any meaningful way, either. At this point, almost every variation of words and phrases strung together with a few numbers or substitutions is simply too easy for a password cracking tool to make its way through, and the shorter the password, the easier.

The best passwords are long, random or pseudo-random combinations of every possible character allowed, with a different password for each unique use. But how could a normal person remember the hundreds or even thousands of individual passwords associated with each account they've ever created? The short answer is: they can't. And don't even think about writing a password down in plain text, whether in the physical world or the digital.

Perhaps the easiest way to keep track of these complex, unique passwords is with a password manager, which provides easy access to strong encryption. While proprietary commercial solutions like LastPass are popular, there are several open source solutions as well. And with passwords, being able to audit the source code of your password manager is especially important, as it helps ensure that your passwords are encrypted properly and are not vulnerable to backdoors.

So without further ado, here are a few open source password managers we hope you will consider.

## KeePass

[KeePass](http://keepass.info/) is a GPLv2-licensed password manager, primarily designed for Windows but also running elsewhere. KeePass offers multiple strong encryption options, easy exports, multiple user keys, advanced searching features, and more. Designed for desktop use, there are plugins that allow direct use from your web browser, and it can run from a USB stick if you'd prefer to physically carry your passwords from machine to machine. More on KeePass can be found in this [past article](https://opensource.com/business/16/5/keepassx) from Ricardo Frydman.

[KeePassX](https://www.keepassx.org/), which started as a Linux port of KeePass, is another project you may consider. KeyPassX is compatible with KeePass 2 password files, and has also been ported to run on different operating systems. In fact, the list of [unofficial releases](http://keepass.info/download.html) of KeePass covers ports to just about every system in common use.

## Padloc

[Padlock](https://padloc.app/) is a very new entrant into the world of open source password managers. Currently available for Linux, Windows, Mac, iOS, and Android, with a ChromeOS client in the works, Padlock is designed as a "minimalist" password manager. Its [source](https://github.com/padloc/padloc) is available on GitHub under a [GPLv3](https://github.com/MaKleSoft/padlock/blob/master/LICENSE) license. The project also has developed a [cloud backend](https://github.com/maklesoft/padlock-cloud), also open source, which is a welcome addition to anyone tired of managing password files or setting up syncing across multiple computers.

## Passbolt

[Passbolt](https://www.passbolt.com/) is another relatively new option, with plugins available for Firefox and Chrome and mobile and command-line options on the way. Based on OpenPGP, you can check out its online [demo](https://demo.passbolt.com/auth/login) which shows off some of the features (you'll need to install the plugin for your browser, though). Licensed under the [GPL Affero version 3 license](https://github.com/passbolt/passbolt_browser_extension/blob/master/LICENCE), you can check out the source code on [GitHub](https://github.com/passbolt) or view the project's [roadmap](https://www.passbolt.com/roadmap) for a list of current features and more on what is planned.

## Bitwarden

[Bitwarden](https://opensource.com/bitwarden.com) offers an easy and safe way for teams and individuals to store and share sensitive data, and it works on all major platforms and devices. You can also integrate Bitwarden into your favorite web browser (including Firefox, Chrome, Opera, Safari, Microsoft Edge, and others). You can access your sensitive data from a "web vault" in your browser, too, so you're never without the information you need.I The data is fully encrypted end-to-end with AES-256. If you prefer, you can even [host your own instance](https://bitwarden.com/help/article/install-on-premise/).

You can create a Bitwarden account for free. Bitwarden is open source and released under a [GPLv3](https://github.com/MaKleSoft/padlock/blob/master/LICENSE) license, and the Bitwarden community is vibrant and inviting. Visit their forum to learn more about the software, or to pose any questions you may have.

Using a password manager that you trust alongside complex passwords is not a substitute for taking other security precautions, nor is it foolproof. But for many users, it can be an important part of keeping your digital life secured. These definitely aren't the only options out there. There are some older options, like [Clipperz](https://clipperz.is/) and [Password Safe](https://pwsafe.org/), and web-based tools like [RatticDB](http://rattic.org/) that I would be interested to try out. Which open source password manager do you use, and why?

*This article was originally published in December 2016 and has been updated with new information.*

## 11 Comments