Password Safe

Last updated
Password Safe
Original author(s) Bruce Schneier
Developer(s) Rony Shapiro, volunteers [1]
Initial releaseJanuary 15, 2002 (2002-01-15)
Stable release
3.65.1 / February 23, 2024;
3 months ago
 (2024-02-23) [2]
Repository
Written in C++
Operating system Microsoft Windows, Android, Linux (beta)
Size 17.0  MB
Available in17 languages
Type Password manager
License Artistic-2.0
Website www.pwsafe.org

Password Safe is a free and open-source password manager program originally written for Microsoft Windows but supporting a wide array of operating systems, with compatible clients available for Linux, FreeBSD, Android, IOS, BlackBerry and other operating systems.

Contents

The Linux version is available for Ubuntu (including the Kubuntu and Xubuntu derivatives) and Debian. A Java-based version is also available on SourceForge. On its page, users can find links to unofficial releases running under Android, BlackBerry, and other mobile operating systems.

History

The program was initiated by Bruce Schneier at Counterpane Systems, [3] and is now hosted on SourceForge (Windows [4] ) and GitHub (Linux [5] ) and developed by a group of volunteers. [6]

Design

After filling in the master password the user has access to all account data entered and saved previously. The data can be organized by categories, searched, and sorted based on references which are easy for the user to remember. [7]

There are various key combinations and mouse clicks to copy parts of the stored data (password, email, username etc.), or use the autofill feature (for filling forms). The program can be set to minimize automatically after a period of idle time and clear the clipboard. It is possible to compare and synchronize (merge) two different password databases. The program can be set up to generate automatic backups.

Password Safe does not support database sharing, but the single-file database can be shared by any external sharing method (for example Syncthing, Dropbox etc.). The password database is not stored online.

Features

Note: All uncited information in this section is sourced from the official Help file included with the application

Password management

Stored passwords can be sectioned into groups and subgroups in a tree structure.

Changes to entries can be tracked, including a history of previous passwords, the creation time, modification time, last access time, and expiration time of each password stored. Text notes can be entered with the password details.

Import and export

The password list can be exported to various file formats including TXT, XML and previous versions of Password Safe. Password Safe also supports importing these files.

Password Safe supports importing TXT and CSV files which were exported from KeePass version 1.x (V1). KeePass version 2.x (V2) allows databases to be exported as a KeePass V1 database, which in turn can be imported to Password Safe.[ needs update ]

Password Safe cannot directly import an XML file exported by KeePass V1 or V2, as the fields are too different. However, the Help file provides instructions for processing an exported XML file with one of multiple XSLT files (included with Password Safe) which will produce a Password Safe compatible XML file that can then be imported.[ needs update ]

File encryption

Password Safe can encrypt any file using a key derived from a passphrase provided by the user through the command-line interface.

Password generator

The software features a built-in password generator that generates random passwords. The user may also designate parameters for password generation (length, character set, etc.), creating a "Named Password Policy" by which different passwords can be created.

Cryptography

The original Password Safe was built on Bruce Schneier's Blowfish encryption algorithm. Rony Shapiro implemented Twofish encryption along with other improvements to the 3.xx series of Password Safe. [8] The keys are derived using an equivalent of PBKDF2 with SHA-256 and a configurable number of iterations, currently set at 2048. [9] [10]

In a 2012 paper analysing various database formats of password storage programs for security vulnerabilities the researchers found that the format used by Password Safe (version 3 format) was the most resistant to various cryptographic attacks. [11]

Reception

Reviewers have highlighted the program's simplicity as its best feature. [12]

See also

Related Research Articles

Pretty Good Privacy (PGP) is an encryption program that provides cryptographic privacy and authentication for data communication. PGP is used for signing, encrypting, and decrypting texts, e-mails, files, directories, and whole disk partitions and to increase the security of e-mail communications. Phil Zimmermann developed PGP in 1991.

<span class="mw-page-title-main">PDF</span> Portable Document Format, a digital file format

Portable Document Format (PDF), standardized as ISO 32000, is a file format developed by Adobe in 1992 to present documents, including text formatting and images, in a manner independent of application software, hardware, and operating systems. Based on the PostScript language, each PDF file encapsulates a complete description of a fixed-layout flat document, including the text, fonts, vector graphics, raster images and other information needed to display it. PDF has its roots in "The Camelot Project" initiated by Adobe co-founder John Warnock in 1991. PDF was standardized as ISO 32000 in 2008. The last edition as ISO 32000-2:2020 was published in December 2020.

<span class="mw-page-title-main">John the Ripper</span> Password cracking software tool

John the Ripper is a free password cracking software tool. Originally developed for the Unix operating system, it can run on fifteen different platforms. It is among the most frequently used password testing and breaking programs as it combines a number of password crackers into one package, autodetects password hash types, and includes a customizable cracker. It can be run against various encrypted password formats including several crypt password hash types most commonly found on various Unix versions, Kerberos AFS, and Windows NT/2000/XP/2003 LM hash. Additional modules have extended its ability to include MD4-based password hashes and passwords stored in LDAP, MySQL, and others.

<span class="mw-page-title-main">The Bat!</span> Email client for Windows

The Bat! is an email client for the Microsoft Windows operating system, developed by Moldovan software company Ritlabs. It is sold as shareware and offered in three editions: Home Edition, Professional Edition, and Voyager which is a portable version and is included with Professional Edition.

<span class="mw-page-title-main">PhpGedView</span>

PhpGedView is a free PHP-based web application for working with genealogy data on the Internet. The project was founded and is headed by John Finlay. It is licensed under the GPL-2.0-or-later license.

In computing, a Personal Storage Table (.pst) is an open proprietary file format used to store copies of messages, calendar events, and other items within Microsoft software such as Microsoft Exchange Client, Windows Messaging, and Microsoft Outlook. The open format is controlled by Microsoft who provide free specifications and free irrevocable technology licensing.

The Extensible Metadata Platform (XMP) is an ISO standard, originally created by Adobe Systems Inc., for the creation, processing and interchange of standardized and custom metadata for digital documents and data sets.

In cryptography, key stretching techniques are used to make a possibly weak key, typically a password or passphrase, more secure against a brute-force attack by increasing the resources it takes to test each possible key. Passwords or passphrases created by humans are often short or predictable enough to allow password cracking, and key stretching is intended to make such attacks more difficult by complicating a basic step of trying a single password candidate. Key stretching also improves security in some real-world applications where the key length has been constrained, by mimicking a longer key length from the perspective of a brute-force attacker.

A password manager is a computer program that allows users to store and manage their passwords for local applications or online services such as web applications, online shops or social media. A web browser generally has a built in version of a password manager. These have been criticised frequently as many have stored the passwords in plaintext, allowing hacking attempts.

<span class="mw-page-title-main">PeaZip</span> File archive computer program

PeaZip is a free and open-source file manager and file archiver for Microsoft Windows, ReactOS, Linux, MacOS and BSD by Giorgio Tani. It supports its native PEA archive format and other mainstream formats, with special focus on handling open formats. Version 9.4.0 supported 234 file extensions.

<span class="mw-page-title-main">KWallet</span> Password manager

KDE Wallet Manager (KWallet) is free and open-source password management software written in C++ for UNIX-style operating systems. KDE Wallet Manager runs on a Linux-based OS and Its main feature is storing encrypted passwords in KDE Wallets. The main feature of KDE wallet manager (KWallet) is to collect user's credentials such as passwords or IDs and encrypt them through Blowfish symmetric block cipher algorithm or GNU Privacy Guard encryption.

AllMyNotes Organizer is an outliner application for Windows. It allows you to store all documents and notes in a single storage file. Documents are organized in a hierarchical tree representation for quick browsing by topic. A portable version which can be installed on a USB flashdrive, iPod, or removable hard disk drive which can be used on any PC without the need to be installed is also available.

Xena is open-source software for use in digital preservation. Xena is short for XML Electronic Normalising for Archives.

<span class="mw-page-title-main">KeePass</span> Computer password management utility

KeePass Password Safe is a free and open-source password manager primarily for Windows. It officially supports macOS and Linux operating systems through the use of Mono. Additionally, there are several unofficial ports for Windows Phone, Android, iOS, and BlackBerry devices, which normally work with the same copied or shared (remote) password database. KeePass stores usernames, passwords, and other fields, including free-form notes and file attachments, in an encrypted file. This file can be protected by any combination of a master password, a key file, and the current Windows account details. By default, the KeePass database is stored on a local file system.

<span class="mw-page-title-main">LibreOffice Writer</span> Open-source word processor

LibreOffice Writer is the free and open-source word processor and desktop publishing component of the LibreOffice software package and is a fork of OpenOffice.org Writer. Writer is a word processor similar to Microsoft Word and Corel's WordPerfect with many similar features, and file format compatibility.

crypt is a POSIX C library function. It is typically used to compute the hash of user account passwords. The function outputs a text string which also encodes the salt, and identifies the hash algorithm used. This output string forms a password record, which is usually stored in a text file.

<span class="mw-page-title-main">BeerXML</span> Markup language

BeerXML is a free, fully defined XML data description standard designed for the exchange of beer brewing recipes and other brewing data. Tables of recipes as well as other records such as hop schedules and malt bills can be represented using BeerXML for use by brewing software.

<span class="mw-page-title-main">Pleasant Password Server</span>

Pleasant Password Server is a proprietary, multi-user enterprise password server that is fully compatible with a modified version of the KeePass Password Safe. Designed for business users, the password server provides access provisioning as well as per-group and per-entry access restrictions. Pleasant Password Server supports the use of secure passwords, allowing system administrators to manage user passwords from a central web interface.

<span class="mw-page-title-main">VeraCrypt</span> Free and open-source disk encryption utility

VeraCrypt is a free and open-source utility for on-the-fly encryption (OTFE). The software can create a virtual encrypted disk that works just like a regular disk but within a file. It can also encrypt a partition or the entire storage device with pre-boot authentication.

References

  1. "Members".
  2. "Password Safe - Latest News".
  3. "Password Safe Product Review". NMRC. Retrieved 2010-04-29.
  4. "PasswordSafe". Sourceforge. Retrieved 2021-03-31.
  5. "PasswordSafe". GitHub. Retrieved 2021-03-31.
  6. "Password Safe | Encryption Download". PCWorld. Archived from the original on 2010-10-27. Retrieved 2010-04-29.
  7. "Password Safe Review: Make Password Retrieval Easier". Brighthub.com. 2009-10-31. Retrieved 2010-04-29.
  8. "WineHQ – Password Safe". WineHQ.org. Retrieved 2013-02-07.
  9. Shapiro, Rony (2013-02-05). "Master Key Generation from Master Password" . Retrieved November 29, 2014.
  10. Shapiro, Rony (2013-01-08). "PasswordSafe database format description version 3.29".
  11. Gasti, Paolo; Rasmussen, Kasper B. (2012). "On the Security of Password Manager Database Formats" (PDF). Computer Security – ESORICS 2012. Lecture Notes in Computer Science. Vol. 7459. pp. 770–787. CiteSeerX   10.1.1.933.5924 . doi:10.1007/978-3-642-33167-1_44. ISBN   978-3-642-33166-4.
  12. "Password Safe review". Software-Today.com. Archived from the original on 2011-07-16. Retrieved 2011-08-01.