PasswordSafe is intended to be a secure solution for maintaining a list of passwords. It uses a secure, encrypted database to store each password and can only be accessed by providing the master password. Originally developed by Bruce Schneier's Counterpane Labs it is now developed and administered by Jim Russell and Rony Shapiro as a SourceForge project. PasswordSafe can be downloaded here.
How is PasswordSafe more secure than storing passwords in a text file or database? All passwords within the database (called a safe) are encrypted using the Blowfish algorithm, also developed by Bruce Schneier, which has so far proven to be unbreakable. Provided a secure master password, referred to as the combination, has been chosen for the safe, no one should be able to decrypt the passwords stored within the safe, even if they obtain a copy of the file. For this reason, it is imperative to choose a strong master password. For guidance in selecting the master password, refer to Eric Wolfram's "How to Pick a Safe Password". Take caution to never lose or forget the combination (master password) for any safe. PasswordSafe intentionally has no way to recover a lost combination, because doing so would compromise its security.
Getting started with PasswordSafe
First, download and install the latest version of PasswordSafe which is available for all Windows platforms, including WinCE. For Linux users, there is a forked version (from the old 1.x series) called MyPasswordSafe available here, but its use is beyond the scope of this article.
The first time PasswordSafe is started, the following dialog appears:
Select "Create new database" and a prompt for the master password appears.
Weak passwords are discouraged with the following prompt.
If this prompt appears, a different master password should be created.
The newly created safe looks like this:
To create a new entry choose "Add Entry" from the Edit menu.
The password above has been created using the Random Password generator button on the right.
A prompt will appear asking if the default username should be the one supplied for the first entry.
Once the entry has been created it will show up in the safe.
Reading our newsletter every Monday will keep you up-to-date with security news.
Receive a daily digest of the latest security news.