Open source alternatives to 1Password

What 1Password does

1Password stores logins, payment cards, notes, passkeys and developer secrets such as SSH keys and API tokens, and fills them in browsers and apps on macOS, iOS, watchOS, Android, Windows and Linux. Watchtower flags breached, weak and reused passwords, items can be shared with family members, colleagues or through links that expire, and a CLI and secrets tooling serve developers. According to its security documentation, data is end-to-end encrypted with AES-GCM-256, and the key is derived from the account password with PBKDF2-HMAC-SHA256 and combined with a 128-bit Secret Key generated on the device; login uses the SRP protocol so the password is never sent.

Why people look for an alternative

• Subscription only. The Individual and Families plans come with a 14-day trial, and there is no free plan.
• No local-only vaults. 1Password 7 and earlier supported standalone vaults stored only on your devices. 1Password says version 8 requires a 1Password membership, so all data now sits in its cloud service, with no self-hosted option.
• Closed source. The security model is documented, but the apps and servers are not open to inspection or modification.
• Long-term control. Some people and organizations simply want their vault on infrastructure they run, or in a file format several apps can open.

What to compare in an alternative

1. Where the vault lives. A cloud account, your own server, or a local encrypted file you sync yourself.
2. The encryption model. Whether encryption happens on the device, what stays unencrypted, and whether a second secret like 1Password’s Secret Key is involved. Most alternatives rely on the master password alone, so its strength matters more.
3. Audits. Which projects publish recent independent audits.
4. Sharing. Family vaults, organizations, groups and roles, and which of them are free.
5. Developer features. CLI access, SSH keys and secrets for scripts.
6. Migration. Bitwarden and Passbolt import 1Password exports directly.

Which one to choose

Bitwarden is the closest overall match: apps on every platform, passkeys, Send for sharing files and text, organizations for families and businesses, a free plan in its cloud and an official self-hosted server. If you want to host it yourself on modest hardware, Vaultwarden runs the same Bitwarden apps from a single container. For a company that shares many credentials across teams, Passbolt encrypts every shared secret for each recipient with OpenPGP and can be self-hosted or used in its EU cloud. If the main reason to leave is that 1Password no longer offers local vaults, KeePassXC keeps everything in one encrypted file with no account, paired with a KeePass app on your phone. Developers who live in the terminal can also look at gopass. See the password manager guide for how these models differ.