A built-in password manager with two-step codes and leak checks

A separate password manager usually means one more app, one more browser extension and often one more subscription. Barside's is already there. It is a built-in password manager: save a website's login once, and next time choose the account and press Fill. It needs no browser extension and no separate app, and it keeps your logins encrypted on your own computer, apart from your notes. Two-step login codes, a private leaked-password check and warnings about reused passwords come with it, free.

This guide covers how it protects your logins, filling and copying, two-step codes, the leak check, and its limits.

What the built-in password manager does

• Saves logins for websites: the address, an optional name, the email or username, and the password.
• Fills them into Chrome, Brave and Edge on Windows. Barside fills the form, and you press the website's sign-in button.
• Copies them on Linux and in Barside for Mac, for the website open in your browser, and clears the clipboard after 45 seconds.
• Makes two-step codes, the 6- or 8-digit codes an authenticator app shows, from a QR code on your screen or a setup key.
• Checks for leaks with Have I Been Pwned, without sending your passwords, once you turn it on.
• Warns about reuse when two logins share a password, worked out on your computer.
• Moves with you through an encrypted export file that you protect with a password.

Open it from wherever you are: the key icon in Barside's title bar, in a pinned note or on the desktop bar; Passwords in the tray menu; pw in the search bar; or Settings → Passwords & autofill → Open Barside Passwords.

How your logins are protected

• Encrypted by your system, for your account. On Windows, the vault is encrypted with Windows' own data protection (DPAPI) for your Windows account. On Linux, Barside uses your keyring through the Secret Service, such as GNOME Keyring, KWallet or KeePassXC, and tells you when no keyring is open. Barside for Mac uses the macOS Keychain.
• Kept apart from everything else. Logins live in their own vault file, outside your notes. They never go into ZIP backups, cloud backup, cloud sync, Library search, logs, error reports or assistant memory, and the AI apps you connect cannot read them.
• A private window. The Passwords window masks what you type, asks Windows to keep it out of screen captures, and closes when you lock your computer. Saved passwords are never sent to the window itself: when you press Fill, only that one login goes to the small helper that fills the form.
• The exact website. Before it fills or copies, Barside checks the page's exact address against the login's website, so a look-alike site gets nothing. The page must use HTTPS.
• Private copies. A copied password or code is marked private, so Barside's own clipboard history, Windows clipboard history and the cloud clipboard skip it. On Linux, the mark tells KDE's clipboard that it is a password, and Barside for Mac marks copies with the concealed and transient types that Mac password managers use. Barside clears it after 45 seconds, unless you copied something else since, and when you lock your computer.

Save a login and fill it on Windows

1. Open the website's login page in Chrome, Brave or Edge.
2. Open Barside Passwords. Under Current website, Barside shows the site it found in your browser. If it shows nothing, press the refresh button next to it.
3. Choose Save a login for this site, or Add login. Barside fills in the Website from your browser. Enter the Email or username and the Password, and a Name if you like, such as Work account.
4. Choose Save & fill. Barside saves the login and fills the form, and you press the website's sign-in button. Save login saves without filling.
5. Next time, open Passwords on that login page, choose the account and press Fill.

Barside cannot read a password you already typed into a website's masked field, so you enter each one in Barside once. With Offer help on login pages on, a quiet notification appears when a supported login form or code box is on screen, so you do not have to remember to open Passwords. The switch is inside Passwords, if you would rather not see it.

Filling works on visible username and password forms, and on sign-ins that ask for the username first. Barside never submits the form, and it does not resize your browser.

Copy logins on Linux

Browsers on Linux do not let other apps fill their forms safely, so Barside copies instead:

1. Open the login page in your browser, then open Barside Passwords. Barside reads the page's address from the address bar with xdotool, then puts your clipboard back. Without xdotool, copy the page's address yourself first.
2. Choose the account, press Copy username and paste it into the website. Then press Copy password and paste again.
3. Barside clears each copy from the clipboard after 45 seconds.

On Linux, Barside never types into a website, since it cannot see the form itself. It copies only for HTTPS pages, and only the login saved for that exact website.

Windows, Linux and Mac, side by side

There, Barside reads the page's address from Safari, Chrome, Edge, Brave, Arc, Vivaldi or Opera, after macOS asks you once for each browser. Firefox and Zen do not share their address on a Mac.

Two-step codes, built in

Many websites ask for a code from an authenticator app after your password. Barside can make those codes itself:

1. On the website, start setting up two-step login with an authenticator app, so that it shows a QR code.
2. In Barside Passwords, edit the login with its pencil and choose Add two-step code.
3. Choose Scan QR code on screen. Barside checks each screen once and shows QR code found. You can also paste the Setup key or otpauth:// link instead.
4. Choose Save login. The login now shows its current code, with a ring that counts down the seconds, and a Copy button.
5. Enter that code on the website to finish its setup. From then on, open Passwords on the website's code page and choose Fill code, or Copy code on Linux.

If Barside cannot find exactly one code box on the page, it copies the code instead and says so. A few details:

• Supported: time-based codes (TOTP) with SHA1, SHA256 or SHA512, 6 or 8 digits, and a new code every 15 to 120 seconds.
• Not supported: counter-based (HOTP) codes, Steam codes, and the export QR codes authenticator apps make to move accounts (otpauth-migration://).
• The scan stays private. It captures each screen once, looks for the QR code in a separate background process, leaves the Passwords window out of the capture, saves nothing, and Cancel stops it.
• Setup keys are stored in the same encrypted vault, and codes are made on your computer only when they are needed.
• Keep a way back in. Removing a code from Barside does not turn off two-step login on the website, so keep its recovery codes somewhere safe.

Password health: leaked and reused passwords

Password health, inside Barside Passwords, looks at two things.

• Reused passwords are found on your computer, with no network at all. A login that shares its password says so, with the number of other logins that use it.
• Leaked passwords are checked when you turn on Check my passwords against known data leaks in Settings → Passwords & autofill. It is off by default. Once it is on, Barside checks every password that has no result yet, and then each new or changed one. Check now, in Settings or in Password health, checks every password once, even with the setting off.

The leak check is built so your passwords stay with you. Barside makes a SHA-1 hash of each password and sends only the first 5 characters of that hash to Have I Been Pwned. The service answers with every leaked hash that starts with those 5 characters, padded with filler entries so the size of the answer gives nothing away, and Barside compares the list on your computer. Your password and the rest of its hash never leave your computer. For each login, Barside keeps only the number of leaks and the time of the check, encrypted in the vault, and forgets them when the password changes.

Move your logins to another computer

Because logins stay out of backups and sync, they move on their own:

1. In Barside Passwords, choose Export encrypted logins.
2. Choose a backup password of at least 10 characters, confirm it, and save the .barside-logins file. Two-step codes are included.
3. On the other computer, open Passwords and choose Import logins. Enter the backup password, choose Choose backup to import and pick the file. Logins with the same website and username are updated.

The file is encrypted with AES-256-GCM, with a key made from your backup password by scrypt. Barside never stores the backup password, so keep it somewhere safe.

Barside or the password manager built into your browser?

Your browser can save passwords too. Chrome, for example, saves them to your Google Account when you are signed in and uses them across your devices. Barside's built-in password manager works differently, and the difference decides which one suits you:

• One vault for three browsers. On Windows, Barside fills the same saved logins in Chrome, Brave and Edge, so trying another browser does not split your passwords.
• Codes beside logins. A website's two-step code sits on the same card as its login, with Fill code (on Linux, Copy code), so that website needs no separate authenticator app.
• Outside any browser profile, with no sign-in. The vault is encrypted by your operating system on your computer, and it never goes into Barside's backups or sync.
• What you give up. Logins stay on one computer until you move them with an export, and the limits below apply. If you want your passwords on your phone or synced everywhere, a dedicated password manager or your browser's own fits better.

Limits worth knowing

• Filling is for Chrome, Brave and Edge on Windows. Forms with several password boxes, forms inside frames, and forms Barside cannot read clearly are filled by hand.
• Codes split over several boxes are not filled; Barside copies the code for you to paste.
• No password generator. Barside saves the passwords you choose; it does not make up new ones.
• Logins and codes only. There is no place for passkeys, payment cards or secure notes.
• No importer from other password managers. Add each login once. Import logins reads only Barside's own export.
• No phone app and no sharing. Barside is a desktop app, and there is no way to share a login with other people.

Who it suits

• People tired of one more subscription who want logins and two-step codes in an app they already use every day.
• Freelancers and consultants with separate accounts per client. Pair each login with a bookmark that shows which account you use on that site.
• Anyone moving off text-message codes to authenticator codes, who wants each code next to its login.
• Local-first people who would rather keep secrets on their own computer than in a cloud vault.

Privacy

Your logins and two-step setup keys are encrypted by your operating system and kept outside your notes, backups, search and AI connections. The leaked-password check is the only part that goes online, and only when you turn it on or press Check now. Read how passwords are stored, and how Barside keeps your library local-first, with private backups.

How it compares

Dedicated password managers usually add things Barside does not have, such as phone apps and shared vaults. If you are weighing one against Barside, read the 1Password alternative guide. If you want the rest of your tools on your own computer too, compare the best local-first apps.

Works well with