Mostly i get by by not telling others how or where I keep my passwords

With gnupg, git, and a hardware security token. Also known as "pass".

I think Vaultwarden is the self-hosted version

keepassxc

Do you add 1 and then ! or ! And then 1 to secure your passwords?

That was what I did 20 years ago

My journey as well. Paid for LastPass (bought 10 years for $20) and changed when they went too much shit.

Bruteforcing a safe might be easier than a password manager.

A bit of a tangent but these are the right people to ask... What do you think when a site or app says that your password is too long?

Or a USB with a Gpg encrypted text file locked with a slightly easier password.

Nice try

I'm glad they told me and didn't just truncate it forcing me to reset everytime.

I write down a password hint on a physical piece of paper.

Since the primary threat vector is remote access and not physical access, I'd argue that is fine.

Additionally the password hint has to pass through several thought chains in order to provide the actual password.

I do wish sites would up front tell you what the password requirements were when you logged in though.

Have you considered trying pass phrases? Weirdly, they can sometimes be easier to remember depending on where you take it from.

KeePass database in cloud storage, synced to my phone.

I use KeePass database for all my passwords and other database for recovery passwords (like from 2FA codes etc). I have it synced in my Nextcloud and ProtonDrive (In case my Nextcloud would fuck up).

Once physical access is achieved you have already lost. They can just brute force your brain. A safe is perfectly fine for the usual remote attacker.

I use Password123$ everywhere.

I ask AI to make me a random password for "x" service. Whenever I need to remember it, I just ask again \s

Vaultwarden

I ask AI to make me a random password for “x” service. Whenever I need to remember it, I just ask again

I've already seen someone do that, a certain family member. At first I found it funny when they asked an LLM about their WiFi password, which was some gibberish. But it worked. There's no way something like that would be default across entire product line.
Indeed, when I asked, I got "I gave it screenshots of everything because I didn't know what to type where".

Self host. Keepass, NAS with a sync app across devices. Occasional manual backup. Probably overkill.

It really does depend on your threat model, yeah?

I think the site stores my password in its original form, without hashing. its way too common, even at high profile services like banks, university or government systems.

with that you need to type the unlock password for every single read and search, right?

In addition, Fdroid vets apps far better than Google ever has so I'm comfortable with the app's security.

I agree but they aren't checking every version for malicious changes. they would likely only get to know if a user checks it and notices it, and the developer could just make the change for a single release version.

of course that applies to any app but this handover/takeover was very sketchy.

No, you can configure the timeout in gpg-agent.conf. I've set mine to a few hours.

Not really. Bitwarden is hosted by Bitwarden, why would you want to run the sync yourself?
Vaultwarden is self hosted anyway.

I assumed that's what you meant by saying bitwarden and Vaultwarden.