Open source password managers

Four ways to run a password manager

The tools in this category share a job but differ in where your vault lives and who can read it.

• Synced vault services. An account on a server stores your vault, encrypted on your device before upload, and syncs it to browser extensions, desktop and mobile apps. This is the model of 1Password, LastPass and Dashlane. Bitwarden offers it as a cloud service or a self-hosted server, Vaultwarden is a lighter community server for the same Bitwarden apps, and AliasVault adds email aliases with its own mail server.
• Team credential managers. Built around shared folders, roles, approvals and audit trails. Passbolt encrypts every shared secret separately for each recipient with OpenPGP on the client. Teampass is a PHP and MySQL application with per-user keys handled by the server, which it does not present as end-to-end encryption.
• Local KeePass files. No account and no server: the whole vault is one encrypted KDBX file that you sync yourself, through a cloud drive, a WebDAV server such as Nextcloud, or any folder you copy between devices. The format is shared, so you can mix apps: KeePassXC on the desktop, KeePassDX or Keepass2Android on Android, KeePassium on iPhone, iPad and Mac, KeeWeb in a browser, or AuthPass with one interface everywhere.
• Command-line stores. gopass keeps each secret as a GPG-encrypted file in a Git repository, which suits developers and automation more than family use.

What to check before you choose

1. The encryption model. Is data encrypted on your device so the server cannot read it, and what remains visible? gopass leaves secret names readable to anyone with the repository, and AliasVault’s whitepaper lists the metadata and incoming mail its server handles. We describe each model only as the project documents it.
2. Independent audits. Some projects publish recent third-party audits or penetration tests (Bitwarden, Passbolt, KeePassXC, KeePassium, Vaultwarden, and a 2020 test of KeeWeb); others document none, and AliasVault’s first audit is still being prepared. Check the dates as well as the names.
3. Recovery. In nearly every design a forgotten master password means lost data unless emergency access or administrator recovery was set up first. Decide how you will handle that before you move a family or a company.
4. Sync and hosting effort. The official Bitwarden server runs as several containers on x64 hardware with SQL Server, Vaultwarden is a single container, KeeWeb is a set of static files, and KeePass apps need no server at all.
5. Sharing and administration. Groups, roles, SSO, LDAP, directory sync and event logs matter for businesses, and they are often the paid part: Bitwarden’s enterprise modules, Passbolt Pro and the Teampass browser extension all require subscriptions.
6. Autofill and passkeys. Look at browser extensions, iOS and Android autofill, and whether passkeys can be stored. File-based apps differ widely here from one platform to the next.
7. Migration. Bitwarden, Passbolt and Teampass list importers for 1Password and LastPass exports, and Bitwarden and Passbolt also import from Dashlane. Most other tools accept CSV. Plan to delete exported plaintext files after the import.

Standards worth knowing

NIST’s digital identity guidelines (SP 800-63B, revision 4, 2025) support the use of these tools. They say services must allow password managers and autofill and should let users paste passwords, require at least 15 characters for passwords used on their own, and must not impose composition rules or force periodic changes unless there is evidence of compromise. In practice that favors long, random, unique passwords, which only a password manager makes manageable.

KDBX, the KeePass 2 file format, is the closest thing the category has to a portable standard: a file created in one KeePass app opens in the others, so you are not tied to a single developer.

What is not listed and why

We only list projects whose main repository is on GitHub under an OSI-approved license and that have been maintained in the last year. Strongbox, an iOS and macOS KeePass app, publishes its code under AGPL-3.0, but its developers state that the repository is not open source in the OSI sense because build files and assets are withheld, so it is not included. Psono develops primarily on GitLab, the original pass and KeePass are hosted outside GitHub, Buttercup’s desktop app was archived in 2025 and Padloc has had no commits since 2023. Within listed projects, Bitwarden keeps some enterprise code under its source-available Bitwarden License; its page explains which parts.