Repo Review: Password Managers

By CgBoy

Passwords. We all use them. Some of us only use one password for everything. Others have many complex passwords that are hard to remember. Before I wrote this article, I just had a file on my computer listing most of my passwords. Very secure, right? Anyway, this month we're going to have a quick look at the password managers in the repository. I have put these in the order in which I reviewed them.

KDE Wallet Manager. First up is KDE Wallet Manager. Creating wallets is fairly easy. They can use Blowfish or GPG encryption. As I do not have a GPG key setup, I chose the Blowfish encryption method. KDE Wallet Manager can also import and export wallets as XML files. The user interface of KDE Wallet Manager is good and simple. It also has a system tray applet from which you can open and close wallets.

Other applications like web browsers can store and access passwords in KDE Wallet Manager. You can see all the applications authorized to access the wallet in the Applications tab. From there you can also revoke authorization for applications.

So, is KDE Wallet Manager any good? I'd say it is. It's easy to use, has a good user interface and it has some good features, so I'd say this is a good password manager.

KeePassX. (Note: This is version 2.0.3 of KeePassX, not the old version 0.4.4) KeePassX is often recommended as a good open-source password manager. For those of you who don't know, KeePassX is a fork of KeePass Password Safe. When you create a new password databases in KeePassX, you can choose to just use a master password, use a key file, or both. KeePassX uses either AES or Twofish encryption for its databases.

KeePassX has a good user interface, with the password entries organized in folders. When you create a new password entry, KeePassX can generate a random password for it. The entries can be given icons too. KeePassX can fill in login forms on websites without needing a web browser plugin. You just need to right click on an entry and click "Perform Auto-Type". It will then automatically fill in the form.

There are also Android and iOS apps that can use KeePassX databases, which means you can have your passwords with you all the time! So, what do you think of KeePassX? I think it's an excellent password manager. It's easy to use, has a good user interface, and I really like the Auto-Type feature!

Revelation. The last version of Revelation came out back in 2012, so it is a bit old. It has a nice simple user interface, and the password entries can be organized into folders. The password database is by default an XML file using AES encryption, but it can also use LUKS encryption. Revelation can also import from, and export password databases to many other formats.

Revelation also has a search function. There's a password generator, and a password strength checker tool. Unfortunately, Revelation does not have an Auto-Type feature like KeePassX.

So, how well does Revelation work? Although it's not as advanced as KeePassX, in some ways I like Revelation more. It has a great user interface that's easy to use. But I do wish that it had an Auto-Type feature like KeePassX.

Pass. Unfortunately, I had so much trouble trying to set up Pass, and trying to set up a GPG key, that in the end I couldn't get it working properly. So, I'm just going give you a basic overview of Pass. Pass is a command-line password manager. Instead of storing all the passwords in one database, it stores them each in separate GPG encrypted files. Those password files are then stored in a simple directory tree structure.

There are scripts that allow you to import passwords from other software into Pass, including scripts for KDE Wallet Manager, KeePassX, and even Revelation. There are also plenty of GUIs for Pass, and there are even Android and iOS apps. Unfortunately, there aren't any Pass GUIs in the PCLinuxOS repository.

There are even web browser plugins for Pass. Along with all that, Pass also has a built-in password generator. So, is Pass a good password manager? Well, I don't really know, as I couldn't get it to work right. It does appear to be a pretty powerful password manager, but at the same time, it doesn't look like it's very easy to use.

GNOME Keyring. I didn't even know exactly what GNOME Keyring was until the day before I had to submit this article. GNOME Keyring is a command-line password manager. And it uses AES-128 encryption. I actually don't know much about GNOME Keyring. I couldn't even figure out how to use it...

Other applications can access and store passwords in GNOME Keyring. And there are also GUIs available for it, but unfortunately there aren't any in the PCLinuxOS repository. Because I didn't have time do a full review of GNOME Keyring, I'm not sure if it's a good password manager or not. Sorry.

Summary

Well, we're at the end of the article already. So, out of these five password managers, which is the best? I think I'd probably say KeePassX was the best. It's a good program with some great features. However, my favorite is actually Revelation. I really liked its simple user interface. KDE Wallet Manager is all right, but it's not my favorite. I never could give Pass and GNOME Keyring full reviews, so I don't exactly know how well they work.