Bitwarden is an open-source password manager with apps on every platform and a company whose product is the vault. The database is encrypted on your devices before it syncs. Independent audits are published. The free tier covers unlimited passwords across devices. Paid adds a few sharing and emergency features. TOTP codes and passkeys live in the same vault.
The default sync server is theirs. That server stores ciphertext, not your master password, and it is still a service you depend on. You can run the official server, which is heavy, or Vaultwarden, which is unofficial. The browser extension is where most leaks happen if you leave it unlocked on a shared computer. A manager you do not lock is a text file.
Use it as the default for a household. bitwarden.com
Bitwarden’s generator inside the app is where new passwords should be born, so they are saved before you need them. Turn on two-factor for the Bitwarden account itself, with a method that is not only email. Write the account recovery code on paper. Self-hosting is optional and it is not more private if the server is a VPS you do not patch. The official cloud is fine for most people. An unlocked browser extension on a family PC is not.
