Ask HN: Advice on Migrating from 1Password?
I am considering migrating from 1Password to a self-hosted password manager. I've looked into Vaultwarden and am interested in self-hosting with Docker and Caddy for the web front, automating Let's Encrypt certification. I'm concerned about the export process, which is through CSV in clear text, and wish there were a standardized encrypted format to avoid plaintext exposure. I also need to consider password sharing and group structures for my team. Has anyone made a similar migration and can offer advice?
I migrated from an older 1password to self hosted bitwarden (vaultwarden) using premade configurations which are available for Portman and Docker in the usual places. Mine uses caddy for the Web front, which automates letsencrypt certification. All the client app which talk to bitwarden talk to vaultwarden, but there's no guarantee into the future I guess. I just like self hosted. The export is through CSV in clear. I wish they agreed to use some pkcs defined superencypherment and a json format so you could avoid the pass through plaintext. Do this on a machine you trust, offnet I guess. Bitwarden has corporate options. Password sharing under a reasonable model, group structure.
- ggm
I migrated from an older 1password to self hosted bitwarden (vaultwarden) using premade configurations which are available for Portman and Docker in the usual places. Mine uses caddy for the Web front, which automates letsencrypt certification. All the client app which talk to bitwarden talk to vaultwarden, but there's no guarantee into the future I guess. I just like self hosted.
The export is through CSV in clear. I wish they agreed to use some pkcs defined superencypherment and a json format so you could avoid the pass through plaintext.
Do this on a machine you trust, offnet I guess.
Bitwarden has corporate options. Password sharing under a reasonable model, group structure.
- mplanchard
Apart from everything about DHH, I personally feel like the choice to invest so much money in Omarchy, of all things, shows a lack of good technical sense from the folks at 1pw. If you’re doing charitable giving, why not give to an established product that will be around in 10 years time, or one that provides core technology the other linux distros depend on? I don’t want the money I spend on 1pw going to some poorly chosen bet on a vibecoded distro, just because it’s in the SV hype limelight at the moment.
- rcarmo
Here you go, I made a quite wide-ranging set of notes here when I switched: https://taoofmac.com/space/apps/1password
- croon
I've been using Bitwarden for close to a decade now, and it still works, but given silent documentation changes and increasingly opaque communication following the CEO change, I started considering self-hosting. While vaultwarden exists, and would be the obvious choice, I started shopping around as well.
So hijacking the thread to ask if anyone has used Aliasvault [0] (no affiliation)?
- teekert
I really enjoy Proton Pass (but I have a paid subscription so I have passmail aliasses as well). I've been going full passkeys recently, no issues yet.
Before this I used Vaultwarden, but I was always a bit afraid of the self-hosting (of something this critical), and I really didn't like how you share credentials in BitWarden (through organizations), Proton Pass is much more intuitive with just straight up sharing of credentials or sharing whole Vaults. You can also share through public 1-time visit, limited time valid-urls. I use that a lot when I set up people's accounts.
What I don't like is the tight coupling to Proton's services, Pass should have had it's own credentials. But if you're not a Proton user that doesn't matter (or perhaps it doesn't matter t you in any case.)
- netniuq
I moved to self hosted Vaultwarden (Bitwarden server reimplementation that's client-compatible). You can also directly run Bitwarden, but Vaultwarden is easier to self-host, especially OIDCwarden is nice if SSO is your cup of tea.
I don't like Bitwarden's UI as much as 1Password's, but at least it feels faster.
- fmajid
KeePassXC or Bruce Schneier's Password Safe. The nice things about Keepass* is that the format is an open standard with multiple implementations and if any one turns out to be a problem, you can switch easily.
- hs86
Passkeys, SSH keys, Fastmail's masked email integration.
Did I get myself into vendor lock-in, or are these items covered by those password manager exports?