Keepass has lots of red flags for me:

- No https on site

- Update file hosted via http (not https)

- Downloads via sourceforge which has injected adware in downloads before

- FAQ downplays lack of constant time comparison instead of using constant time comparisons and being extra safe

- You have to cobble together multiple apps from multiple developers to get a full working solution; means you have to trust lots of individual entities

That being said I can hardly defend staying on Lastpass anymore.

I just wish 1Pass was crossplatform so there was a clear universal winner!

Got a link to that FAQ thing? I find downplaying of potential security issues a rather important red flag.

The https thing is unfortunate and should be fixed, but I've always got my KeepassX from a signed repo.

The cobbling together is also an important part of its strengths. In particular I want the sync of the encrypted DB to be decoupled from the app that decrypts and manages the password entry into forms (the latter being yet another entity, btw).

I'm really curious to see that FAQ entry! Because I can't imagine a scenario where timing sidechannel attacks would be relevant to a password manager app (provided the sync is decoupled, which is one reason why that's so important). If you're gonna bruteforce the master key, you'll use an external program any way, so constant time comparisons in Keepass's routines shouldn't matter? Also it's not like you could remotely trigger Keepass to decrypt 1000s of times in order to glean info from timing data, because it's not a browser plugin. Which is one of the reasons why we don't want our password manager to be a browser plugin. Again, decoupling is a strength.

- No https, agree, its a very old site, but it's not sensitive material that you're submitting. You can check the integrity of the download [0]

- Sourceforge, again not ideal but again it has very old beginnings from when Sourceforge was as respected as Github is. You can't blame the developer for the environment changing. Perhaps they're just a stickler for loyalty. I've never had any crapware with Keepass

- FAQ - I could't find your reference in the FAQ page [1]

- You have one app + plugin with a browser extension from two developers, hardly a mishmash. You know directly who those two developers are. You've no idea who was working on LastPass. I'd say it was more in the bazaar philosophy vs the LastPass cathedral.

  [0]: http://keepass.info/integrity.html
  [1]: http://keepass.info/help/base/faq_tech.html

You can download the file via https [0], this is what the Chocolatey package does [1]

  [0]: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.35/KeePass-2.35-Setup.exe
  [1]: https://chocolatey.org/packages/keepass

Sounds interesting, but requires a password program, a 3rd party plugin for the program, and a browser plugin... and yet another app to do cloud sync like Dropbox.

Sounds like a huge pain compared to LastPass, as well as increasing attack surface.

LastPass is a Cloud password program + browser plugin

So the extra layer is the plugin that is written by the same developer as the browser plugin. Which is a drop in plugin.

It's all open source so it's much easier for people to check the vulnerabilities. It's also easier to raise issues and other people to help fix them.

Separately Keepass is an offline database, so you have total control over access to it. The overhead of course is using something like Dropbox, plus probably Boxcryptor to ensure it's encrypted before it gets to Dropbox.

I've commented elsewhere here - it's similar to the Keepass bazaar vs the LastPass cathedral. Keepass might look uglier, but I trust it more.

It kinda is. I just dropped the database on my Nextcloud instance though, which has so far not suddenly caught fire.

Clickable: http://keepass.info/help/base/importexport.html

For using with FF, I'd recommend KeeFox.