How To Host Your Own Password Server

Take control of how your passwords are synched and where they’re stored

- Nick Peers

Everyone needs a password manager. You simply can’t get by online these days relying on a handful of easily guessable passwords—just take a trip to https:// haveibeenpwned.com to confirm your trusted passwords of yesteryear have almost certainly been exposed by now.

The value of a password manager can’t be overstated, whether it’s generating unique, random, lengthy passwords that are almost uncrackable, or storing them securely in a vault protected by strong encryption and—if you’re diligent—extra layers of security. But it’s not necessarily all good news. Where is your password vault stored, and who can access it?

Services like LastPass and 1Password that make it easy to sync and access passwords between mobile, desktop, and browser store your encrypted vault on their own online servers. They argue their “zero-knowledge” model, where they have no access to your password or the keys that encrypt your file (which is done locally on each device), keeps them nice and secure. Great, but that’s an awful lot of trust you’re placing in their hands— they’re not immune to attack, and while LastPass maintains no encrypted vault data was compromised when its security was breached in 2015, hackers were still able to access the files, putting any vaults protected by weak passwords at risk.

So, how do you ensure your passwords can’t fall into the wrong hands? You could go old school and use a single password manager app on your PC, where the vault is encrypted and stored locally (perhaps backed up to a USB key, stored in a fireproof safe). That’s almost watertight, but at what cost? Convenience, for one: Copying passwords by hand on your phone or using the clipboard to transfer passwords from app to browser is slow.