Best password manager setup for a dedicated GrapheneOS Pixel?

Questions
1

Hi everyone,

I’m trying to set up a simple and secure password-manager solution and would appreciate some recommendations.

I was looking at the Privacy Guides password manager recommendations:

My main goal is that if I lose my primary phone or computer, I still have a safe way to access my passwords.

I have an older Pixel that I would like to dedicate almost entirely to this purpose. I would install GrapheneOS on it and ideally keep it very minimal — no Google account, no sandboxed Google Play, and as few additional apps as possible.

I originally thought about KeePassXC, but I now understand that KeePassDX is the Android version I should probably be looking at.

A few questions:

Would KeePassDX be the best choice for this setup, or would something cloud-based like Bitwarden or Proton Pass actually make more sense because my main concern is being able to recover/access my passwords if another device is lost?
If I use KeePassDX, what is the simplest secure way to make sure the encrypted database is backed up somewhere else? I don’t want the dedicated Pixel itself to become a single point of failure.
I don’t want Google Play on this phone. What is the best way to install KeePassDX and keep it securely updated?
GitHub APK + Obtainium?
Accrescent, if available?
Something else?

I’d prefer whichever method requires the least additional software and maintenance while still getting timely and trustworthy updates.

I already use IVPN. Would it make sense to install IVPN on this dedicated password-manager phone as well, especially when it connects to Wi-Fi? If so, would you recommend the IVPN app through Accrescent/direct APK, or another method?
Finally, is there anything else you would recommend for a dedicated GrapheneOS password-manager device, or is it actually better from a security perspective to keep the setup extremely minimal and not add anything that isn’t necessary?

I’m not very advanced technically, so I’m looking for something that is secure but also straightforward to maintain.

Thanks!

2

Go for Bitwarden or Proton Pass, they are easy to use and synchronized on all your devices.

3

is it all encrypted on proton pass so I dont need to get a vpn for this phone? for my proton pass password and the password i save there?

4

The encryption is e2e so it happens on your device before the sync. No need for a VPN for this.

5

I use KeePassDX and run Syncthing-Fork to sync my password file to my other devices.

Works pretty well. Just gotta remember to wait for the sync after saving before making changes on other devices.

You could avoid this by using a cloud storage tho.

6

I’m not sure why you need a separate dedicated device for this. Why not just use a cloud based password manager like BW or PP and then log into it?

If you’re worried about losing 2fa or something, you can write down back up codes and store some at home or at a friend’s house on paper. All you need to remember is your master password.

7

It’s kind of nice to not use a service where your password db is shared with other people’s or is reliant on the security practices of others.

Depends on your threat model I guess. KeePass’s DBs are battle tested and wherever you host it isn’t necessarily exposed to the public. But services like BW, PP, Lastpass, etc, those are exposed to the internet and regularly do have data leaks.

8

Of those listed I only know of lastpass having leaks/breaches.

9

You’re right that the only data leak that I can remember is Lastpass. Bitwarden’s tools uses NPM which had them caught in this:

To be fair, the blast radius for this wasn’t very large because it only affected their CLI tool (which could have happened to any software using NPM).

But to address the “why store your own password db vs use a cloud service”:

We use E2EE software because we want remove the problem before it becomes a problem. This is the same reasoning. Why wait for a compromise to happen? And with all the data leaks and attacks that happen, it is literally just a matter of time. Best course of action: remove that extra possible security hole. Of course, this really depends on your threat model. And if you have good OPSec or not. There are real benefits to not using a service for your password manager.

10

You probably want something cloud based then, unless you can articulate some reason why that’s a problem. It’s rare that people’s bitwarden or proton pass passwords get leaked, assuming a strong password was used. Even getting access to the encrypted database won’t leak the passwords in that case.

If you choose to with keypass, many people choose to combine it with syncthing to ensure backups happen automatically. This is more complex, with the possibility of losing passwords if you don’t understand it. Given the level of knowledge displayed in this post, I’m not saying you can’t learn. However, you might prefer to not do so.

I’m a self hosted vaultwarden user, for what it’s worth. I get the appeal of keypass for some people.