Folks, I'm in the market for a hardware-based password management solution. Here is my wishlist / specification for a product: 1. password management: i.e. store my passwords for websites etc. in an encrypted 'vault' accessible under a master password 2. hardware device (not software-only) 3. USB3 preferred; functional on Windows (and Android if possible) 4. no software installation required upon inserting the device into host system 5. multifactor authentication 6. local-only password vault (no cloud storage) 7. FIPS 140-2 (minimum) compliance 8. testing / certification to FIPS by independent lab preferred 9. AES 256 minimum 10. ability to backup password database 11. feature to generate master randomized passwords for new login accounts Does anyone have a suggestion for a product(s)? Also please let me know if there's a more appropriate forum to place this into. Pan
While I recommend everyone use a password manager so they NEVER EVER write their passwords down, I have never used a "USB" manager so I cannot recommend one based on any personal experience. But a simple Bing Google search shows there are several. I have been using SplashID's password manager for nearly 20 years, originally on my Windows based computer and my Palm PDA device. You would sync the password manager databases stored on your computer(s) and PDA, ensuring you always had the most recent on every device. Today, it works between your computer and smart phone. I highly recommend this product. And because I have full confidence in the company, I recommend you check out their SplashID Key Safe. While I have not used it, I do trust it will keep your passwords secure. RoboForm is a very popular and often recommended password manager. Therefore, I have to assume their RoboForm2Go USB Drive password manager is a quality product. However, note the comment on this page about them discontinuing the product as it may apply to ALL such USB devices in the near future. You may end up with a manager that you have to access, read the password, then enter it manually (most managers do let you copy and paste - though not all websites allow that!). And while I understand your desired to avoid the cloud (I share that concern), I do believe, with the use of a very strong master password, you can do so safely.
