I was gonna ask about the biometrics part in a separate question, but its both about security, so might as well combine it in one post.
Okay so I don’t use password managers. I just try to make easy to remember passwords 3-4 random words + 3-4 random numbers. Online accounts can’t be brute forced anyways. Edit: I mean most websites have log in limits don’t they? Maybe I’ve been mistaken?
For offline accounts, I just increase the words and numbers. For mobile I don’t use biometrics, although I’ve been testing whether or not I want a pin + no biometrics or alphanumeric password + biometrics. I just can’t decide.
Local GPG key pair + https://www.passwordstore.org/ synced peer-to-peer between devices via https://syncthing.net/
So the key is always local but the password database is being synced between devices.
pass on its own is great already (it’s basically just GPG encrypted text files with a good CLI frontend) but I make it even greater by using a slightly modified “passmenu” script which utilizes wofi (rofi for wayland) in dmenu mode to show a very fast popup of all your sites you have passwords stored for and by selecting it / pressing enter the pw gets copied into the clipboard.
Gpg? I get nervous when people say that instead of a symmetric key system. When a quantum computer powerful enough gets invented, all non-quantum resistant asymmetric encryption systems will be broken. Honestly why not just use AES 256 just in case a quantum computer gets invented?
I manage my passwords with Bitwarden and Authy for 2FA. Another good option, is to use KeepasXC with Symcthing to have the passwords both on the pc and smartphone
I only pay for 2 subscriptions: 1Password for families (and Spotify)
I have 236 logins… No way I’m gonna create secure and memorable passwords for that many sites.
I use 1Password on Linux and Android.
I run my own instance of vaultwarden (100% compatible fork of bitwarden) and use the standard bitwarden client on Android and browser plugin in Firefox. My master password is really long and I use 16 character passwords as standard in BW. I have biometric set up for my phone just to make it a bit less hassle.
Edit: and I set up MFA wherever possible with a yubikey
Bitwarden for my personal stuff, KeePass for work (like to keep everything separated). Biometrics on devices that support it. I used to do what you did, and then Facebook got hacked and all my other online accounts fell like a house of cards, found out when my friend texted me asking WTF was going on and why was I posting links to porn sites everywhere. So, password manager and strong passwords for all the things. MFA is something that needs to become more common as well.
