How this page works. This is a hub for password managers, sorted by who holds the encrypted file rather than by feature checklist. Each category below gets an introduction and its tools; every tool links to its official site or repo. Prices, licences, version numbers and project health were verified in September 2026 and will drift — the per-tool pages get updated first.
2026 was the year the password managers put their prices up. Bitwarden nearly doubled Premium in January, the first rise in about a decade. 1Password added $12 a year to both consumer plans in March. Meanwhile the manager already built into your phone became free, competent and passkey-native, and the local and self-hosted options kept costing nothing but your own weekends.
So the useful question is no longer which vault has the longest feature list. Every serious option below does the same three things well: it encrypts locally, it syncs, and it fills passkeys. What actually separates them is who holds the encrypted file, and what that costs you — money, or maintenance. Pick the row of that table you can live with, then pick within it.
1 — Managed cloud vaults
You rent a company's server. They hold ciphertext they can't read; you get sync, apps on everything, account recovery and someone to page when it breaks. This is the right answer for most people, and it is where the whole category's pricing moved this year. The free tiers are the thing to read carefully: Bitwarden's is genuinely unlimited, Proton's caps aliases rather than passwords, and LastPass's restricts you to one device type — phone or computer, not both.
One practical filter before the features. Two of the free tiers below are only free until they meet your actual devices, and two of the paid ones are only cheap until the first renewal. Settle those two questions and the shortlist usually picks itself.
- Bitwarden — the default recommendation, and still the best free tier: unlimited passwords on unlimited devices. Premium went from $9.99 to $19.80/yr on 21 January 2026, gaining vault health alerts, password coaching, 5 GB of attachments and up to 10 security keys. Clients are GPL-3.0. Worth knowing: the free plan did not lose anything in that change, whatever the roundups say.
- 1Password — the most polished apps in the category, and no free tier at all — 14 days, then pay. Prices rose on 27 March 2026: Individual $35.88 → $47.88/yr, Families $59.88 → $71.88/yr. The $2.99/month you see advertised is a first-year new-customer promotion, so budget for the renewal, not the sticker.
- Proton Pass — the privacy pick, Swiss, and the strongest free tier after Bitwarden's: unlimited logins and devices, passkeys everywhere, plus 10 hide-my-email aliases, which is the feature people actually stay for. Plus is $1.99/mo on annual billing and unlocks unlimited aliases, a built-in authenticator, sharing and emergency access.
- NordPass, Dashlane, Keeper — competent, closed-source, and priced against each other rather than against Bitwarden. Reasonable if you're already inside one of those ecosystems; hard to argue for otherwise.
- LastPass — the cautionary one. The 2022 breach put encrypted vaults in attackers' hands and ended in a $24.5M class-action settlement whose final approval hearing was in July 2026. If you are still on it with a long master password and 2FA, you are not in danger — but there is no remaining reason to choose it new.
2 — Self-hosted servers
The same shape as the category above, on hardware you control: your box holds the ciphertext, and no company can raise your price or lose your vault. What you pay instead is attention — backups, TLS renewal, and the upgrade that breaks a client on a Tuesday. Worth it if you already run a server and would notice it going down; a bad idea as your first server.
- Vaultwarden — the obvious one: an unofficial Rust reimplementation of the Bitwarden server API (AGPL-3.0, 66.7k stars, 1.37.2 in August 2026) that works with every official Bitwarden client. It turns on the paid features — organizations, Send, TOTP, emergency access, WebAuthn and YubiKey 2FA — at no licence cost, and runs comfortably on a Raspberry Pi.
- Bitwarden self-hosted — the official, supported route. Heavier than Vaultwarden and licence-gated for some features, but it is the one to pick if "supported" matters more than "light".
- Passbolt — built for teams rather than households: AGPL, EU-based, OpenPGP with genuine per-resource sharing. The right shape when several people need overlapping-but-not-identical access.
- Psono — Apache-2.0, client-side encryption, no per-user GPG key infrastructure to administer. The pragmatic team option when Passbolt's key management is more ceremony than you want.
3 — Local encrypted files
No server exists. Your vault is one encrypted file on disk, and sync — if you want it — is a problem you solve yourself. This is the only category where nobody, anywhere, holds a copy of your ciphertext by default.
It also works differently from every other category here, and this is the part newcomers miss: you are not picking a product, you are picking a file format and then a client per platform. That format is KDBX, and a dozen independent apps read and write it. Your vault outlives any one of them — which matters, because as the health notes below show, several of these apps have stopped moving while the format carried on.
The desktop clients
- KeePassXC — the reference implementation and the one to start with: 2.7.12 (10 March 2026), GPLv3, Windows/macOS/Linux, with browser integration, passkeys and TOTP built in. Actively developed, 28.6k stars.
- KeePass — the original, still maintained: 2.61.1 (May 2026), GPL-2.0, Windows and .NET-native, with a large plugin ecosystem and a UI that has aged exactly as much as you would expect. Runs elsewhere under Mono, unhappily.
- MacPass — a native macOS client, and a cautionary example: the repo still takes commits, but the last tagged release is 0.8.1 from February 2022 and
macpassapp.orgno longer resolves. Use KeePassXC on a Mac unless you specifically want the native feel. - KeeWeb — the good-looking web and desktop client, 13k stars, and the ambiguity is worth spelling out: the last stable release is v1.18.7 from July 2021, with v1.18.8 and v1.18.9 arriving in 2026 as pre-releases. Alive, but not on a schedule you should depend on.
- AuthPass — Flutter, GPL-3.0, genuinely every platform including mobile, with WebDAV / Drive / OneDrive sync built in. Commits through August 2026, though the last tagged release was February 2024.
The mobile clients — the part people underestimate, because KeePassXC has no mobile app at all.
- KeePassDX — Android, GPL-3.0, and the most active client in the whole KDBX ecosystem right now: 4.5.2 shipped on 31 August 2026. Autofill, biometric unlock, hardware key support.
- Keepass2Android — Android, GPL-3.0, v1.15-r3 in July 2026. The one to pick if you want the vault fetched directly from your own cloud or WebDAV rather than synced as a file.
- KeePassium — iOS and macOS, source-available, freemium. Active through 2026; the free tier is usable and Premium buys convenience rather than access.
- Strongbox — iOS and macOS, AGPL-3.0, freemium, the more polished of the two. Active through mid-2026.
The file still has to travel. Nothing above syncs by itself. Syncthing is the usual answer for people who chose this category to avoid clouds in the first place; iCloud, Dropbox or WebDAV work fine if you do not mind the cloud, since the file is encrypted either way. Whatever you pick, edit on one device at a time until you have seen what your setup does with a conflict — that is this category's one genuinely sharp edge.
Two variations on the theme
- Enpass — the commercial version of the idea: a local vault you sync through your own cloud account, about $23.99/yr, one price rather than per seat. Not KDBX, so you are back to picking a product.
- LessPass — stores nothing at all. It derives each site's password from a master password plus the site name, so there is no file to hold, sync or lose. The trade is absolute: you cannot rotate one password without changing its inputs, and a site with awkward password rules will fight you. A real answer for a small number of people and a trap for everyone else.
4 — Built into what you already use
Free, already installed, and in 2026 genuinely good — this is the category that quietly ate the low end of the market. The catch is the ecosystem boundary: it is excellent until you own a device from a different vendor, and then it is somewhere between awkward and useless.
- Apple Passwords — a real app since iOS 18 / macOS 15, handling passwords, passkeys, Wi-Fi and verification codes, end-to-end encrypted with breach alerts. On Windows it works through iCloud for Windows plus a Chrome/Edge extension, but that path has historically covered passwords only, not passkeys.
- Whatever your Android maker ships — Samsung Pass and its equivalents follow the same logic as Apple's: free, invisible, tied to that vendor's account. They travel out of the ecosystem even less well than Apple's does.
- Google Password Manager — the same deal for Chrome and Android: free, invisible, passkey-capable, and effectively a Google account dependency.
- Firefox's built-in manager — the least ambitious of the three, and the only one that does not tie you to a hardware or search company.
5 — Terminal and Git-native
A directory of encrypted files, one per entry, with git for sync and history. No GUI, no company, no sync service — and grep, git log and shell scripts all work on your vault because it is just files. A small category with an unusually devoted audience, and completely inappropriate for anyone who wanted this decision to be over quickly.
- pass — the standard Unix password manager: one GPG-encrypted file per entry, git for everything else.
- gopass — the modernised take: MIT, Go, v1.17.0 in August 2026, with team sharing and secret rotation on top of the same model. The most actively developed thing in this category.
- passage — pass with age instead of GPG, which removes the single most common reason people bounce off pass. Small and quiet; last touched in 2024.
- QtPass — a cross-platform GUI over pass, v1.7.0 in April 2026, for when you want the model but not the typing.
Worth knowing but not compared here: browser-only managers, phone-OEM vaults, and the password features bundled into VPN subscriptions — all fine as a floor, none worth switching to. Avoid choosing new: LastPass. Stalled or dead: Buttercup (repo archived, site down), Padloc (last release March 2023). Adjacent: Syncthing, for anyone who lands in category 3.
Comparison table
Prices are the standard annual rate at time of writing, per year unless noted. "Who holds the vault" is the question the whole table exists to answer.
| Tool | Kind | Who holds the vault | Free tier | Price | Passkeys | Platforms | Open source |
|---|---|---|---|---|---|---|---|
| Bitwarden | Managed cloud | Bitwarden | Unlimited passwords & devices | $19.80; Families $47.88 (6) | Yes | Everything + CLI | GPL-3.0 |
| 1Password | Managed cloud | AgileBits | No — 14-day trial | $47.88; Families $71.88 (5) | Yes | Everything + CLI | No |
| Proton Pass | Managed cloud | Proton (CH) | Unlimited logins, 10 aliases | Plus $1.99/mo annual | Yes | Everything + CLI (Plus) | Yes |
| NordPass | Managed cloud | Nord Security | Limited | ~$1.99/mo (1-yr) | Yes | Everything | No |
| Dashlane | Managed cloud | Dashlane | Limited | ~$4.06/mo | Yes | Everything | No |
| Keeper | Managed cloud | Keeper | No | ~$39.99; Family ~$84.99 | Yes | Everything | No |
| LastPass | Managed cloud | LastPass | One device type only | ~$3/mo | Yes | Everything | No |
| Vaultwarden | Self-hosted | You | n/a — free | Free + your hardware | Via Bitwarden clients | Bitwarden clients | AGPL-3.0 |
| Bitwarden self-host | Self-hosted | You | n/a | Free; some features licensed | Yes | Everything | GPL-3.0 |
| Passbolt | Self-hosted | You | Community edition | Free CE; paid tiers | Partial | Browser-first | AGPL |
| Psono | Self-hosted | You | Community edition | Free CE; paid tiers | Partial | Browser-first | Apache-2.0 |
| KeePassXC | Local file (KDBX) | Nobody | n/a — free | Free | Yes | Win/macOS/Linux | GPLv3 |
| KeePass | Local file (KDBX) | Nobody | n/a — free | Free | Plugin | Windows (.NET); Mono | GPL-2.0 |
| KeePassDX | Local file (KDBX) | Nobody | n/a — free | Free | Partial | Android | GPL-3.0 |
| Keepass2Android | Local file (KDBX) | Nobody | n/a — free | Free | Partial | Android | GPL-3.0 |
| KeePassium | Local file (KDBX) | Nobody | Usable free tier | Freemium | Partial | iOS, macOS | Source-available |
| Strongbox | Local file (KDBX) | Nobody | Usable free tier | Freemium | Partial | iOS, macOS | AGPL-3.0 |
| KeeWeb | Local file (KDBX) | Nobody | n/a — free | Free | No | Web, desktop | MIT — stable stalled at 2021 |
| AuthPass | Local file (KDBX) | Nobody | n/a — free | Free | No | Every platform | GPL-3.0 |
| MacPass | Local file (KDBX) | Nobody | n/a — free | Free | No | macOS | Last release 2022 |
| Enpass | Local file | Nobody (your cloud) | Limited | ~$23.99 | Yes | Everything | No |
| LessPass | Derived — stores nothing | Nobody; no file exists | n/a — free | Free | No | Web, browser, CLI | GPL-3.0 |
| Apple Passwords | Built in | Apple | n/a — free | Free | Yes (not on Windows) | Apple + Win via extension | No |
| Google Password Manager | Built in | n/a — free | Free | Yes | Chrome, Android | No | |
| pass | Terminal | Nobody | n/a — free | Free | No | Unix + ports | GPL-2.0 |
| gopass | Terminal | Nobody | n/a — free | Free | No | Cross-platform CLI | MIT |
| passage | Terminal | Nobody | n/a — free | Free | No | Unix | BSD-style |
| QtPass | Terminal (GUI) | Nobody | n/a — free | Free | No | Win/macOS/Linux | GPL-3.0 |
