I've been using Bitwarden for close to a decade now, and it still works, but given silent documentation changes and increasingly opaque communication following the CEO change, I started considering self-hosting. While vaultwarden exists, and would be the obvious choice, I started shopping around as well.

So hijacking the thread to ask if anyone has used Aliasvault [0] (no affiliation)?

[0] https://github.com/aliasvault/aliasvault

I migrated from an older 1password to self hosted bitwarden (vaultwarden) using premade configurations which are available for Portman and Docker in the usual places. Mine uses caddy for the Web front, which automates letsencrypt certification. All the client app which talk to bitwarden talk to vaultwarden, but there's no guarantee into the future I guess. I just like self hosted.

The export is through CSV in clear. I wish they agreed to use some pkcs defined superencypherment and a json format so you could avoid the pass through plaintext.

Do this on a machine you trust, offnet I guess.

Bitwarden has corporate options. Password sharing under a reasonable model, group structure.

Just encrypt your CSV after export with the tool of your choice.

Here you go, I made a quite wide-ranging set of notes here when I switched: https://taoofmac.com/space/apps/1password

I really enjoy Proton Pass (but I have a paid subscription so I have passmail aliasses as well). I've been going full passkeys recently, no issues yet.

Before this I used Vaultwarden, but I was always a bit afraid of the self-hosting (of something this critical), and I really didn't like how you share credentials in BitWarden (through organizations), Proton Pass is much more intuitive with just straight up sharing of credentials or sharing whole Vaults. You can also share through public 1-time visit, limited time valid-urls. I use that a lot when I set up people's accounts.

What I don't like is the tight coupling to Proton's services, Pass should have had it's own credentials. But if you're not a Proton user that doesn't matter (or perhaps it doesn't matter t you in any case.)

Im a happy Proton customer since a decade for their email and recently file storage service, but I’m concerned about having my passwords and my files and my emails in the same system. It’s risky to have so much in one company, if I lose my proton access for some reasons I’m out of everything

You can set an extra password for pass but still.

I for one also have my 2fa with them... I get the feeling.

I moved to self hosted Vaultwarden (Bitwarden server reimplementation that's client-compatible). You can also directly run Bitwarden, but Vaultwarden is easier to self-host, especially OIDCwarden is nice if SSO is your cup of tea.

I don't like Bitwarden's UI as much as 1Password's, but at least it feels faster.

OIDCwarden still requires two passwords :(

KeePassXC or Bruce Schneier's Password Safe. The nice things about Keepass* is that the format is an open standard with multiple implementations and if any one turns out to be a problem, you can switch easily.

Whenever I see KeePass mentioned as an alternative I think we should add this disclaimer:

KeePass does not offer sync and conflict resolution. This must be handled by your filesystem/OS/other tools. While this is typically not a problem for single users or very small groups, this can be catastrophic in company/group settings. So please think hard about whether you want sync/conflict resolution (server/client based solutions like Bitwarden/Vaultwarden) to be part of your Password manager – or not.

Yeah, KeePassXC is pretty basic but is trustworthy and it works.

The KeePassXC-Browser extension for Firefox and Chromium-based browsers is useful too: https://github.com/keepassxreboot/keepassxc-browser

Passkeys, SSH keys, Fastmail's masked email integration.

Did I get myself into vendor lock-in, or are these items covered by those password manager exports?

Oh, I was only storing and using it in AWS KMS because of the pricing issue, but thanks for the comment. I’ll look into it a bit more.

n00b question I guess but what is the value of a standalone password manager? Seems like most browsers and operating systems offer this capability nowadays.

1Password offers a lot more functionality than, say, Apple Passwords.

Apple Passwords will store a user/pass combo for a site. That's it, feature list over.

1Password will let you configure how those things autofill, it provides an `op` CLI that you can use with service account tokens, you can store stuff like photos of your passports and licences, it understands 'Sign in with GitHub', it has per-user access per vault for shared accounts, you can add any number of extra fields to each entry, it integrates directly with Claude, it monitors your passwords against Haveibeenpwned, it'll tell you where you could be using 2FA and aren't … and the list goes on.

To not be tied to a single machine or OS

Browser password apps are not suited to just store secrets not related to logins.

They are personal, meaning no user management or sharing of secrets.

They do not sync across devices -- or when they do, with restrictions like same browser/same OS only.

They cannot be used for e.g. commit signing or SSH login.

Google Password Manager, the one built into Chrome, doesn't even do end-to-end encryption by default. You have to go into the settings and opt in to encrypt your password data before it gets sent to Google. And since it's closed source, you also just have to take Google's word for it. You'd be better off using a standalone password manager that is a) secure by default b) auditable.

Been using DropBox + Keepass for over a decade now.

How do you store passkeys?

1p is the best.

unix passstore is perfect

piece of paper

Dont know why you are getting downvoted, this is a valid method widely recomended in this day and age. The hacker cant hack your password book locked in your desk drawer!

It's not dumb, it's just a little inconvenient. My passwords are normally 50+ characters and pretty hard to type out, but I could fix that with "Correct Horse Battery Staple" passwords.

Travelling is a little worse. I'd need to carry my little pocket book an risk losing it and now I can't lock my accounts, because I don't have the password for them (I could have a backup).

You know, I'm kinda talking myself into just doing passwords in a pocket book.

Out of pure interest, why not settle down to idk .. 15-20 characters? Why 50+ char (with what I assume lots of symbols and randomized characters) passwords?

Because I just auto-generate them and 50 is the default in 1Password. I rarely change default in any software I use, partly out of laziness and partly to ensure consistency across devices.

Are people in your company moderately technical? If so, I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle (I personally use NitroKey). Then hosting is just a matter of hosting a minuscule git repo per user.

I imagine that a technical company can easily whip up a bespoke simplified interface for its non-technical staff too.

I've used it for about a decade at this point, and it's just perfect.

I have been using https://www.passwordstore.org/ for 10 years and am super happy with it. It does not provide all the convenient integrations of 1Password though.

Checkout gopass for the modern iteration : https://www.gopass.pw/

Here is the migration guide for 1Password. [0]

The CEO of Stripe also donated $1M to Omarchy.

Do we need another migration guide for Stripe since the CEO personally donated to Omarchy and then tell everyone to stop using Stripe and all of their services?

[0] https://www.patreon.com/violetblue/posts/how-to-migrate-1684...

Huh, I guess TIL there is a controversy around Omarchy. I generally dismissed it as a serious distro after 5 second once realized it encourages using the AUR as your default package feed. The AUR is useful, but to me it’s something to be very aware of when you’re installing some software. Encouraging people to install everything through it is a crazy way to configure a distro. I just assumed it’s a distro for a very different target audience so kept my thoughts to myself

A more recent one is https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a

Why is this extreme?

Might be cause I'm from the Balkans, but I see nothing extreme here

Wow. I just read this one now, and DHH really makes it hard to defend him. It's definitely possible to make this argument without likening groups of people to wolves and sheep...

> At what point does it stop?

It never stops which is the problem. While DHH cannot be "cancelled", anyone who associates with him gets the backlash instead.

The real reason is that Omarchy has better marketing and is serious competition against the others distros, hence the reactions.

Expecting people should stop using "Ruby on Rails", Stripe, Dell, and so on and so forth is unrealistic.

Yes, why not?

A migration guide for all the services that funded Omarchy would be nice which the alternative must not do business with another service. (E.g, Alternative A to Cloudflare must not use Stripe, or Alternative B to Shopify must not use Cloudflare or Dell)

They must be completely independent services that is an alternative to any of the companies that funded Omarchy.

Yes

Maybe you should tell Anthropic to not use Cloudflare or Stripe in their services, since they are in-directly funding Omarchy and move to some alternatives.

Given the rapid attention to Omarchy and DHH, its quite an urgent matter...

There's a bit of a jump here from something appearing good to rapidly becoming very very bad. Here's what I read:

> 1Password has pledged $300,000 over three years in support of David Heinemeier Hansson's Linux distribution known as Omarchy, and is now a “distinguished corporate patron” of Omacom. What a nice brand partnership.

Supporting a Linux distribution sounds nice; I hadn't heard of that one.

But the very next paragraph:

> DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI

> In an internal Slack message leaked to press today 1Password’s Roustem Karimov defended DHH as being attacked for his views...

Perhaps they could support a different Linux distribution.

It's also strongly concerning when someone defends someone with views like that, characterising them as being attacked. In general, toxic, racist, fascist views spread like viruses; when tolerated, through acceptance, they grow. A company needs to root them out. If we trust 1Password with our data, we are trusting a company with those views inside it with our data.

> Perhaps they could support a different Linux distribution.

They won't. SV/YC loves the guy, that's the only reason they're donating to Linux/OSS (but really just omarchy).

It's mostly extreme hyperbole and twisting of his views if anything.

One of his criticisms was the virulent attacks on anyone that questioned policy during covid. He for example prefered the Danish approach and they still ended up doing better than the UK or US.

I also can't help but see the folks clamoring for mass migration for the past 2 decades in europe against popular will as anything other than blind oikophobes. If you'd look at my capital and other places you'd question who is actually calling for ethnic cleansing.

I think caution re cultural integration, vs talking about shooting wolves and calling for deportations using a word regarded as a slur, are two different things. (Both these are within the same paragraph, adjacent sentences.)

It does not read as twisting of his views: he has it right in writing on his blog. https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a

Remember one of the tactics is to sound reasonable, while stretching what is acceptable speech. This lets those who approach with bad faith defend the statements while approving of what they imply or lead to.

>I think caution re cultural integration.... are two different things.

I was called similar for much milder views and past caution. I stood by in discussion further in the past when people got attacked in that way lest id be perceived badly and out of line with my ohter progressive views. No caution was had. Now it's too late. You can't reasonably wish to undo most of it. (Denaturalising people who are abusing or comiting crime is not that) I honestly see my culture as a dead one down the line. All so we could supress wages and pretend to hold up a pyramid scheme whilst doing some social signaling.

That doesn't mean i should forget, forgive myself and others and go along. I've developed a strong dislike for the social cooling that got us there in conflict with the opinions of the majority of the public. I no longer want to be overly nuanced and I am more than able to remember and throw back every past claim and defense regarding all this i read countless times a decade or 2 ago.

> vs talking about shooting wolves and calling for deportations using a word regarded as a slur

It's a stupid analogy. That said deportations within the law of foreign nationals that have no permission to be there is a historic normality the world over. The slur i can see tho i also don't give it much weight because I think it's one squarely on the euphemism threadmil. I used to argue your very point roughly a decade ago alongside an american against a polish friend who was very much opposed to them. Putting his grandma in the hospital over a bike, killing a mates dog along the whole cultural chasm with forced marriages and attitudes towards education and authority really didn't sit well which i could see. But i thought words have power and will worsen the situation and generalisation. But in the end the word gypsies will be forced out of the vocab, zigeuner/cigany will go as well and then roma will be used with those conotations all whilst useful change is sidestepped. I think Slavoj Žižek had a good bit on this.

>Remember one of the tactics is to sound reasonable, while stretching what is acceptable speech. This lets those who approach with bad faith defend the statements while approving of what they imply or lead to.

And the opposite has happened as well and has had far far more impact. Curtailing what is acceptable speech to defend in bad faith and hide what it's all leading to.

COVID lab leak is not a conspiracy theory.

it doesn't mean it's true (we may never know), but framing as "conspiracy" was a product of conflict of interest where certain scientists were protecting grant money. Since then even some of the scientists who participated in it walked it back and openly said that both natural and lab leak theories were credible: https://www.science.org/doi/10.1126/science.abj0016

> DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI

Leaving aside all the rest of this, I thought "lab leak" was considered a reasonable hypothesis, although not especially likely, these days, rather than some kind of fringe theory.

I believe it was disproved, but regardless, there is a lot between accepting an hypothesis and possibly valid and building a conspiracy around it. I don't about this case, but this conspiracy typically degenerate in anti-science behaviours, perosonal attacks (on researchers or just chiense people) and similar nice things.

> “I thank each of the 27 members of SAGO for dedicating their time and expertise to this very important scientific undertaking over more than three years,” said Dr Tedros Adhanom Ghebreyesus, WHO Director-General. “As things stand, all hypotheses must remain on the table, including zoonotic spillover and lab leak.” [but] “the weight of available evidence…suggests zoonotic spillover”

... so I think your framing there is too strong.

https://www.who.int/news/item/27-06-2025-who-scientific-advi...

It's a result of political division in US. If you are on the left then you have to see lab leak as a racist rightie conspiracy theory or you will have issues fitting in. Also lab leak is rejected as a side effect from being confused with intentional leak/bioweapon theory, which is entirely radioactive.

Political right is the other way around.

It is not conclusively proven one way or the other, but most people just made their conclusion: left that it's the market, right that it's the lab (or bioweapon for especially out there).

Oh fuck, 1Password is also part of the DHH crowd?!

This anti-DHH movement is so weird to me. People seem to read summaries of his views, often based on interpretations that get exaggerated from one article to another until they become something else entirely. At least read the articles yourself, including his other work, so you don’t just cherry-pick the ideas that conform to your existing beliefs. Then form your own opinions.

Reading the sources makes it way worse…

Yes, I dismissed the reactions as overreaction and the usual drama, until I read what DHH himself has written this summer. He would no longer fit the European far right comfortably to be honest, his current views align better with the 1930's. And that way SV happily invests tens of millions to your collection of dotfiles.

You and others have been provided with links to DHH's writing plenty of times when you've asked for evidence in the many threads on this subject that you've participated in over the past few months.

If you don't want to give the impression that you're sealioning in an attempt to derail people's conversations, it might be a good idea to first read some of those links before asking for them again.

>"less immigrants please"

By God, is that how you read it? The comparison to animals, that he could not live with people of different ethnicity? And by "ethnicity", this literally means "non-white" people, as he, as a Danish person, wanted to move to London and complains that there are too many foreigners.

This is the AfD-level right-wing, not your casual conservative. Regardless, it's pretty expected that people would not want to support someone who writes this awful kind of similes.

I'm honestly not entirely sure what you're doing.

>He's comparing locals to sheep

Yes, you're right! Romani people to wolves. And locals as sheep. And we should put down the wolves.

>I read the links before I posted. One link specifically says "non-Danes" the other one is talking about Brits and non Brits.

Yes, you're right! Brits and non-brits. Let's scour:

>That was then. Now, I wouldn't dream of it. London is no longer the city I was infatuated with in the late '90s and early 2000s. Chiefly because it's no longer full of native Brits.

There's a hint of what's going on here. Danish person wants to move to London. Gets to London. "gee, I could never migrate here, there are way too few native Brits". It's almost like he considers himself "a native Brit". Buddy just doesn't like colored people.

This is exactly what you'd find in der sturmer in the 30's, Nazis regularly used predator/prey analogies when describing jews as invading their country.

OK. I thought they compared them to parasites... Kind of the opposite of predator. incompatible metaphors if you ask me, but I guess population didn't care.

Feature #8 in Umberto Eco's essay Ur-Fascism:

> The followers must feel humiliated by the ostentatious wealth and force of their enemies. When I was a boy I was taught to think of Englishmen as the five-meal people. They ate more frequently than the poor but sober Italians. Jews are rich and help each other through a secret web of mutual assistance. However, the followers must be convinced that they can overwhelm the enemies. Thus, by a continuous shifting of rhetorical focus, the enemies are at the same time too strong and too weak. Fascist governments are condemned to lose wars because they are constitutionally incapable of objectively evaluating the force of the enemy.

The incompatibility is a feature of the propaganda.

They did both actually. Could call it broad spectrum rhetoric, as some rhetoric works on some people and not others, and people riled up on emotions don't stop and consider if they're being internally consistent in their rhetoric.

Even popular today in right winger rhetoric about globalism or the deep state. They're both controlling and running the world but are also completely incompetent and inept at stopping their "enemies" from gaining power.

The list gets worse and worse as you go... he starts out with the usual right wing demagogue opinions and then just gets more and more explicitly racist as he goes. In the end talking about shooting wolves as an analogy for deporting gypsies... ??? I can't hand wave this stuff away.

1. https://world.hey.com/dhh/failed-integration-and-the-fall-of... (Jan 2025) Argues that people from certain cultures can never integrate into European societies no matter what anyone does, which amounts to saying that where you come from permanently determines whether you can belong.

2. https://world.hey.com/dhh/closing-the-borders-alone-won-t-fi... (Mar 2025) Calls Danish-born children and grandchildren of Middle Eastern, North African, Pakistani and Turkish immigrants "culturally-incompatible" and blames them for school violence and women feeling unsafe. These are Danish citizens being written off because of their ancestry.

3. https://world.hey.com/dhh/gender-and-sexuality-alliances-in-... (Jun 2025) Describes a trans-inclusion week at his kids' school as indoctrination and talks about trans identity spreading among children like a contagion. This is the post people point to for transphobia.

4. https://world.hey.com/dhh/as-i-remember-london-e7d38e64 (Sep 2025) The post that started the backlash. Says London is no longer full of "native Brits," but the numbers he uses are census figures for white British people, so non-white Londoners born in the UK don't count as British by his definition. Calls this a nightmare and a "demographic replacement," which is Great Replacement conspiracy language, and describes a Tommy Robinson march as heartwarming.

5. https://world.hey.com/dhh/we-ve-all-had-enough-of-this-nonse... (Sep 2025) His response to being called racist: the critics are woke loonies, and calling someone a Nazi is really a signal that violence against him has been authorized. Doesn't engage with what he actually wrote.

6. https://world.hey.com/dhh/the-rape-of-britain-610412f8 (Jun 2026) Presents the grooming-gang scandal as Pakistani Muslims raping White British girls, based on a report published by Rupert Lowe's Restore Britain party rather than any official inquiry. The scandal is real; the ethnic-versus-ethnic framing and the partisan source are the problem.

7. https://world.hey.com/dhh/three-sacred-cows-that-must-die-so... (Jul 2026) Says stopping immigration isn't enough and that "millions who are already in Europe must go." He calls this remigration, a mass-deportation idea that came out of the European far right as the solution to the Great Replacement.

8. https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a (Jul 2026) Compares Roma migrants in Copenhagen, whom he calls gypsies, to wolves killing sheep, and ends with: you shoot the wolves, you deport the gypsies. An ethnic group likened to predators, using a word many Roma consider a slur.

9. https://world.hey.com/dhh/i-m-sorry-dave-380ec27d (Jul 2026) Defends the wolves post as banal mainstream opinion and approvingly cites The Camp of the Saints, a novel that white nationalists treat as a foundational text. Doubling down rather than walking anything back.

You edited your comment substantially.

About the two links you originally posted: I read them just before commenting here. It's a common (especially recently) view about immigrants in many countries. In Europe and USA it's a common politically conservative view, in PRC, Korea, Japan, Russia it's more mainstream.

Not something I fully support. I disagree about disliking let alone deporting immigrants just because they're different or because of the skin color. However, I can see an issue when immigration significantly worsens tragedy of the commons. My view as I mentioned in some other thread before is that it's not unreasonable to expect an immigrant to culturally integrate (note that this doesn't mean abandoning religion or traditions) and speak local language. I guess DHH may be more conservative than me, but comparing it to German Nazi seems a stretch. Also, nearly half of Europeans I come across in my experience have similar views.

I'll read the other links in a bit, thanks!

Yeah I found more stuff when I searched farther.

Based on your summaries, I stand by my opinion. The average conservative European is against trans weeks (no opinion), may agree that some cultures can never integrate (I disagree), may claim that some people are culturally incompatible because their parents are from some countries (this may be the worst, and I disagree), may claim that London is no longer full of Brits (contrary to your summary of it census puts a number on Brits of any skin color-59%-but I disagree that it is in itself an issue), would classify the grooming gang scandal as a Muslim-related issue (no opinion, as far as I recall Mohammed's recorded sayings discount harm to non-believers but no idea if that played any significant role), dislikes gypsies' effect on public places (I heard similar stuff from other Europeans, personally I don't have anything against gypsies and disagree with stressing ethnicity, but haven't lived where their presence is noticeable and IMO it's not unreasonable to expect integration from immigrants), etc. These don't seem like extreme views even if I don't support them.

It's clear I don't agree with him but if there was a smoking gun that made his opinions too extreme considering mainstream I'm sure they would surface in your summaries.

Not sure it's 1930 German Nazi level bad, though him being a bit famous makes it worse. I can see why some people may feel like they want to switch providers. luckily I don't use 1password.

Thanks!

I don‘t think that‘s a fair summary. Reading his own words definitely should create doubt in his political standpoints. Additionally after the posts created a fair bit of controversy, he never came out publicly and put his statements in a better light. At least to my knowledge.

https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a

https://world.hey.com/dhh/as-i-remember-london-e7d38e64

HN rivals Reddit wrt extreme left and woke views. Shadow of its former self.

Commenting isn’t worth it.

Does DHH actually deserve to be cancelled, or Omarchy "defunded"? I just read the OOTL on Reddit, and I have to say that I am not entirely convinced. https://www.reddit.com/r/linux/comments/1oa74wh/im_out_of_th...

He did post at least two blog posts with very questionable political standpoints, while also not displaying a high level of critical thinking, one could say. Not sure where the point of „should be cancelled“ is reached, but doesn’t paint the best picture of him to say the least.

Probably the worst quote:

> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation. [0]

The comparison between shooting wolves here seems definitively bad tase and missing nuance.

[0] https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a

[1] https://world.hey.com/dhh/as-i-remember-london-e7d38e64

Yes

Not sure what'll convince you then, if DHH's own rant against immigrants and roma doesn't.

It's amazing that even after the Holocaust, prejudice against Roma is so prevalent in allegedly polite society.

IMO choosing products over politics is a pointless game. Use the best tool for the job.

100%, but this is unimaginable on HN :)

Which of his viewpoints is affecting you?

The fomenting of racial hatred a few tens of kilometres from me? I’m lucky to not be targeted by him and his chosen cause, but a lot of my colleagues are right in his firing line.

Nobody is asking you to give a shit, yet somehow you managed to post a 225 word 5 paragraph screed on something you don't give a shit about. Why should we give a shit about your ramblings?

Nowhere did I write I don't give a shit about this. I said I don't give a shit about attempts to force social cooling anymore. Your reading comprehension is lacking.

Nobody is attempting to force social cooling. How is any of this being forced upon you?

If you have a set of opinions and people who vehemently oppose them start pushing a bandwagon where they twist your words to make them sound more extreme and typify them with the worst descriptors they can think of (nazi, antivaxer, etc) , spread all this around and then call for boycots of you and anyone that associates with you what would you call that?

I disagree with some of his views but can see it across the board. One doesn't have to agree with him or others to take note and this doesn't affect only some well known rich people. It's far more pervasive and from my perspective it is pushing self-censorship and conformity under a pervasive reputation economy. That is social cooling and it's often done purposefully.

Once one of your oppinions sticks out and bumps into this wall it becomes very easy to see how often it actually applies. How falling too much out of line on one front creates all kinds of connected assumptions about anything else you might say. From there it is easily visible how it pushes a lot of people to political fringes (helped by the social media bubbles) and has other consequences.

Yeah, as long as the tech worker himself isn't on the list to be deported, shot or gassed to death, he has no need to worry.

The total lack of empathy, praise of strongmen like Musk and Trump and DHH, promoting slave labour. This whole view of society is simply disgusting and far too common in the startup circles.

> by DHH’s abhorrent views

You know that's just your opinion right? Not an objective truth.

We are on a forum discussing our opinions on things FFS

Make sure you look closely into politics of anybody connected to the password manager you are switching too, it could be even worse!

If you switch to a free one, at least you can be sure that your money isn't being funnelled to people who you fundamentally disagree with, even if the creators have shitty beliefs.

"funnelled to people" is a weird way to describe funding a free open source project.

No it isn't.