Password Security
Written on Aug 17, 2026
Like many people I knew before the Internet became a thing, I kept user names and passwords in a small notebook. I observed two Filipino women (dual-citizens) still doing it that way, just within the last few months.
I suppose doing it the old-school way is okay for some people, especially if they only have a few passwords to keep track of, but too many to memorize. It's better than using the same password for everything. I use a password manager because I have over 200.
Password Security Evolution
I started with a notebook, and when that became too unwieldy, I started using my web browser's password manager. When I learned of security breaches, I switched to LastPass. After LastPass experienced multiple security breaches, I switched to self-hosting a password database file with KeyWeb.
It worked fine until every web browser extension I used stopped working with the desktop application. I don't remember when I started using it, but Bitwarden was my next password manager. At some point, Bitwarden started supporting passkeys (WebAuthn).
I wanted to go back to using something based on KeePass again, but I had to wait. They didn't support passkeys at the time, and I didn't think about it again until recently. I'm now using KeePassXC on my Linux PC and KeePassDX on my Android phone.
The version in the Linux Mint repository was outdated. It didn't offer a way to import a Bitwarden exported JSON file, so I installed the AppImage version from the KeePassXC website. It isn't limited to Ubuntu and its derivatives like the PPA file.
I exported a JSON file from Bitwarden then imported it into KeePassXC. After that, I installed the official extension in my web browser. I copied the database file from my PC to my phone, and I had no problem with KeePassDX using it.
KeePassXC doesn't work perfectly. In some ways it doesn't work as good as Bitwarden and in some ways, it works better. It's being actively developed, so I expect it will get even better. I no longer need Bitwarden, and it's another online account I need to delete.
Backups
The database file is encrypted, so I don't mind having a copy uploaded to a cloud provider along with my other document backups. Since I have multiple portable solid-state drives, I have the file copied to one of them as well, along with my other document backups.
I use rclone for uploading to the cloud and rsync for drive to drive copies. Including the original, I always have four copies of the database file in four different locations. It's good to be paranoid when it comes to security.
I've been actively deleting accounts I've had for years that I don't access anymore. Surprisingly, many of the websites no longer exist. Anyway... I now have less than 200 accounts to deal with and I hope to get far below 100.