Münich-based software publisher Steganos is all about privacy. Even the name comes from the word steganography, which is the science of not only hiding secrets, but also hiding the fact that you have secrets. The company offers encryption software, a VPN, a secure deletion service, and other privacy-related tools. Naturally, the privacy lineup includes a password manager. Steganos Password Manager doesn’t have the high-end features that typify the very best password managers, though, and its basic password capture system does not work in testing. Improved mobile apps are a welcome addition in the latest release, version 22, however. Still, Dashlane, LastPass, Keeper, and many others are better bets.
How Much Does Steganos Password Manager Cost?
A one-time payment of $24.95 gets you licenses to install Steganos Password Manager on up to five PCs. You don’t have to pay again unless you want to update to the next version. Existing users who are upgrading can get a 30% discount on newer versions. Steganos offers a 30-day free trial that does not require you to provide payment information.
You can tie any number of iOS or Android devices to your account, but Steganos is not available for macOS systems. It doesn’t have a web interface for managing passwords, which severely limits its platform availability. Most other password managers at least support macOS, while some, such as Enpass and Bitwarden, offer native Linux apps. Nearly every other password manager offers a web dashboard or browser extension that enables you to manage your passwords from anywhere you have an internet connection.
Steganos Password’s pricing is a bit hard to compare with the competitions’, as most charge on an annual basis and give you access to new features as they become available. Most modern, paid password managers don’t limit you to a certain number of devices per account. For comparison, Dashlane costs $59.99 per year and puts no limits on the number of Windows, macOS, Android, or iOS devices users can log in to simultaneously. LastPass Premium ($36 per year) and Keeper Password Manager & Digital Vault ($34.99 per year) do not place limits on the number of devices you can access your passwords on at the same time.
If you don’t want to pay for your password manager, you have some excellent, full-featured free options, among them LastPass, Bitwarden, and MyKi. That said, free versions from several other premium password managers impose limitations on the number of items you can store in your vault or on how many devices can access your passwords at once.
Getting Started With Steganos Password Manager
Installing Steganos Password Manager is painless. If you have a registration code, you enter it during the installation process. If not, you can start the 30-day free trial. After you install and open the software, Steganos greets you with a pop-up window. You choose to create a new keychain (the equivalent of a password database or vault), open a keychain from your cloud storage, import your passwords from a previous version of Steganos, or restore from a backup.
After you name your new keychain, Steganos tells you to create a strong master password. As you type in your password, Steganos fills in five lock icons and displays a description of your password’s strength. At one lock, it says, “This password can probably be guessed.” If you make it to five locks, it declares, “This password cannot be identified by intelligence agencies.” Interestingly, it also reports the number of word fragments found in the password. So, while the password IAmTheWalrusFab4 gets five locks, Steganos warns that it found four word fragments. This password rating system is consistent with other password managers’.
Some people have no trouble remembering a strong password based on a favorite song or quote. Others are more visual, and for those people Steganos offers PicPass. When you choose to define or redefine your master password using PicPass, you start with a grid of 36 photos or 36 symbols. You proceed to click on as many of the pictures as you think you will remember, and then repeat that same pattern of picture-clicks.
However, there’s a catch, and it’s a big one: The 36 pictures correspond to the 10 digits and 26 uppercase letters, and your fancy pattern of clicks becomes a mundane password like 1UB3OX. Steganos doesn’t hide this fact; it even offers to display the generated password. According to Steve Gibson’s password search space calculator, an offline password cracker could brute-force that password in a fraction of a second. Yes, you can make the PicPass process tougher by having Steganos scramble the picture locations, but doing so just makes it harder for you to get the right sequence. It doesn’t make the password itself more resistant to brute-force cracking.
As for the virtual keyboard, its purpose is to protect your master password from capture by a keylogger, even a hardware-based keylogger. Of course, most keyloggers also capture screenshots, so it’s conceivable a spy program (or a shoulder-surfer) could visually capture your password. For paranoid-level security, Steganos can scramble the key positions on each use and suppress visual indications that a key was pressed. But wow, the aggravation level entering your password this way is sky-high.
Another option is to store your master password on a USB device. This isn’t true two-factor authentication, since you use either the USB device or the master password for authentication, not both. True Key and LogMeOnce both allow authentication using multiple other factors, without the need for a master password. In fact, passwordless login is the default for LogMeOnce.
Steganos now offers true two-factor authentication, too. You can use any authentication app that supports the standard Time-based One Time Password (TOTP) algorithm, such as Microsoft Authenticator. To link the password manager to your mobile app, scan the QR code displayed by Steganos with your authenticator app of choice, and enter the six-digit code the app generates. Now, when you log in to the Steganos desktop application you need both the master password and the TOTP code from the authenticator app. By observation, you cannot access your keychain via the mobile apps if you have two-factor authentication enabled. Steganos does not support hardware-based authentication keys, such as the YubiKey.
Any time you want to switch to a new password manager, the ability to import passwords from the product you’re leaving behind is a big plus. LastPass can import from more than 30 competitors. KeePass can do so from nearly 40. Steganos imports from just two other password managers (KeePass and 1Password) and one browser (Chrome).
Password Extension and Portable Version
Steganos offers extensions for Chrome, Edge, and Firefox. However, when you click on the Install button in the desktop app, Steganos annoyingly opens the extension’s installation page in your default browser regardless of which extension you are trying to install. You are better off navigating to your browser’s respective extension store and searching for Steganos Password Manager manually. We installed the Chrome extension without issue. Note that you must follow special instructions to install the extension in Firefox.
The Steganos browser extension cannot function independently of the desktop app, which severely limits its utility. For instance, you cannot even view or edit vault items directly from the browser extension, let alone use the password generator. Instead, most of the available options relate to filling forms. As we explain later, many of these features don’t work consistently.
If you anticipate needing to use Steganos Password on an unfamiliar computer, consider creating a portable edition on any USB device. Just select the keychain and select a save location from the desktop application’s Settings menu. Any future changes you make in the main app don’t appear in the portable edition, so you should re-create the portable edition frequently. In addition, all the data in the portable edition is read-only.
Cloud Syncing
Dashlane, Sticky Password, and most password managers sync your passwords across multiple devices without the need for you to involve a personal cloud storage account.
As with Enpass, syncing Steganos passwords between devices requires you to store your keychain in a separate cloud storage service. Steganos supports Dropbox, Google Drive, and OneDrive, as well as the Europe-centric Magenta Cloud. Setting up the connection is simple enough, and Steganos encrypts your data before sending it to the cloud. Still, this might be a good time to toughen up the password on your cloud storage. We successfully synced passwords using Dropbox.
There is one more option for syncing your keychain to your mobile device, but it’s not particularly seamless. Navigate to File > Export for mobile apps to get started. Of course, you have to repeat the manual sync process after you make any changes to your vault.
Neither of these options is convenient, but some security wonks may appreciate the option to not put their encrypted data on a company’s web servers.
Organizing Your Passwords
We had no issues installing Steganos Password’s latest desktop application on our Windows 10 test machine. The app’s design is functional, but the interface (we selected the Modern – Light theme) looks antiquated compared with most other password managers. In Settings, you can set the program to start automatically, change some autofill settings, and edit preferences for the virtual keyboard and PicPass features. We experienced some performance hiccups in testing, but the application never fully crashed.
Steganos uses a standard password management layout. Your saved entries appear as a list at left, with details for the selected item in a panel at right. From this window, Stenos lets you add notes, upload an attachment, or add a category. You must right-click on an item to rename it; after you create an entry, the Description field cannot be edited from the right-hand panel. Steganos enables you to create multiple keychains, for example, if you want to keep work and personal passwords separate. 1Password allows you to create multiple password vaults, too.
You can sort the simple password list by title, category, most recently used, and a few other criteria. It’s very different from what we saw when we last reviewed this product. In the earlier version, categories appeared as folders (and nested folders) in a tree-like structure.
The way to create category folders is not immediately obvious. To create a category, open a password entry for editing and type in the name of the category you want to create. Once you save that entry, that category will be a selectable option for all other password entries in your vault. Steganos does not support drag-and-drop conventions for organizing entries. LastPass, RoboForm, and Sticky Password permit you to create multilevel folders.
Other menu options in the application include Bank Accounts, Credit Cards, Private Favorites (presumably website favorites you don’t want to store in a browser), and Identities. The Identities category is now easier to find, but the implementation needs work, as we discuss in a later section.
Password Capture Problems
In testing, Steganos did not capture any logins automatically and would not save items to our keychain even after we selected the manual save option from the browser extension’s menu on any site login page we tried. We had to manually add each password entry to our keychain, which is surely inconvenient enough to convince users to give up on managing their passwords altogether. The password capture system seems to be even a further step backward from the previous edition.
LastPass, Sticky Password Premium, and RoboForm capture login data on demand and don’t need any help with most pages. And when we did need to invoke manual capture with these other services, it worked.
Typically, when you revisit a secure site, a password manager either automatically fills your credentials or adds an icon to the login fields so that you can select the correct login. On some sites, Steganos filled the credentials automatically. On others, we had to manually click the Fill form now option in the extension’s drop-down menu. On some sites this tool did not work at all. For example, Steganos could not fill our credentials for Vimeo’s pop-up login form or Eventbrite’s multi-page form.
Many password managers turn your data into a menu of saved websites and allow you to open a webpage just by clicking on the entry. With Steganos, you have to open the main desktop application window and launch the site from there.
As with 1Password, the Steganos application must be running any time you want to use its browser extensions. That’s a bit different from many competing products. We kept accidentally shutting it down, when all we really wanted to do was get it out of the way. The correct way to handle that situation is to minimize the application to its tiny desktop widget. From the widget, you can restore the main window, or drag/drop the username and password for the selected login.
Password Generator
When you’re editing one of your saved password entries, you should invoke the built-in password generator to provide a strong new password. However, you need to update your password on the site yourself. Steganos doesn’t automatically offer the password generator when you’re setting up a new online account, which the vast majority of other password managers do.
The password generator defaults to creating 16-character passwords, which is good. But it only uses uppercase letters, lowercase letters, and digits, by default. We advise adding symbols to the mix. Note that Steganos doesn’t save changes to the password length and character sets as new defaults, so you have to change those settings each time.
A 16-character password is tough to crack using brute force techniques, but since you don’t have to remember it, longer is better. KeePass and 1Password default to 20 characters, and the free Myki Password Manager & Authenticator creates 30-character passwords by default.
Random numbers used by computer programs aren’t truly random. Rather, they start with what’s called a “seed” number and use a pseudorandom algorithm on each request for a random number. Steganos takes the unusual step of seeding its random number generator by recording your truly random mouse movements. AceBIT Password Depot uses a similar system to ensure a truly random result.
Limited Web Form Filling
As mentioned, Steganos can store personal data, such as bank accounts, credit cards, and identity details such as your name, address, email, phone, and birthdate. Steganos allows you to create multiple identities, but you cannot add custom categories of information as with Enpass and 1Password or create multiple instances of data fields as with RoboForm Everywhere. You won’t find the nice interface touches of other services that generate realistic-looking and color-accurate thumbnails for each payment card you enter either.
Steganos Password Manager cannot currently fill forms with personal identity or payment details.
Steganos Password’s Mobile App
If you want to use Steganos for logging in to secure sites on your mobile devices, you must configure your account to use one of its cloud storage options. You then need to install the free Steganos Mobile Privacy app from the Google Play store or Apple App Store, connect it with your cloud storage, and enter your master password.
We tested the experience on a Google Pixel 3 running Android 11 and had no issues installing the app. Keep in mind that Steganos cannot sync your keychain if you have enabled two-factor authentication for it. This is a severe limitation and other password managers that support two-factor authentication have no trouble syncing your vault across devices with this protection enabled.
The mobile app displays a list of all your saved items in your keychain, including passwords, bank accounts, credit cards, identities, and private favorites. You also get access to your password history and categories. New since our last review, you can edit entries directly from the mobile app, which is a huge improvement. However, Steganos shows all of your passwords in plain text and we couldn’t find any way to change that visibility.
In fact, we could not find a dedicated settings section in the app at all. Another oddity: the Steganos mobile app supports biometric authentication (fingerprint), but it sets this up automatically and we could not find a way to disable it. A representative from Steganos confirmed that on iOS, the mobile app supports authentication using Touch ID and Face ID.
In testing, Steganos filled passwords on the mobile version of websites and within apps without an issue. The autofill implementation on mobile feels slicker and more reliable than on the web, possibly because of mobile sites’ more-consistent login screens.
What’s Not Here (or Not Working)
Dashlane, LastPass Premium, Keeper, and LogMeOnce let you securely share login data with other users. RoboForm, Password Boss Premium, and several others deal with the problem of passing on your credentials in the event of your demise. Steganos sticks with the basic password management features and makes no attempt at password sharing or inheritance.
Stashing all your passwords in a password manager is a good start, but if you use “password” you still have a problem. Dashlane, Keeper Password Manager & Digital Vault, and several others offer actionable password strength reports. Many of our top picks include tools that scan the dark web for breaches that contain any personal details you save within your vault.
We would also like to be able to fill forms online with the personal details and payment information we added to our keychain. Steganos Password’s password capturing capabilities need an overhaul, too.
You Can (Still) Do Much Better
It’s nice to see a password manager that charges a one-time fee rather than a per-year subscription, but there are disadvantages, too. That yearly subscription pays other companies for things like server space to hold your encrypted data. With Steganos Password Manager, you supply that storage yourself, in the form of an account with one of the big cloud storage providers. Steganos offers two-factor authentication, but it lacks other advanced features such as password sharing, an actionable password strength report, and password inheritance. The password capture features did not work in our testing and Steganos cannot currently fill identity and payment details in web forms.
If the low, one-time price really resonates with you, you’re probably better off getting one of our top free password managers, such as MyKi or LastPass, instead. Editors’ Choice password managers Dashlane and Keeper offer a smoother experience than Steganos and pack a ton of advanced features, but this does come at a price. A single Dashlane license costs $59.99, more than twice the one-time price of five Steganos licenses. And you pay $74.99 per year for five Keeper licenses, or $34.99 for one.
