best 9 password managers

client and server are both published on github, which means the zero-knowledge claim is checkable rather than promised. the audit record backs it: cure53 repeatedly from 2018, insight risk, mandiant on mobile in 2024, ioactive on the clients, unit 42 in 2025, fracture labs, and an eth zurich applied cryptography review in 2025 that tested the core crypto against a scenario where bitwarden's own server is malicious. all downloadable.

it is also the cheapest paid tier in the ranking at $19.80 a year, with a free tier that stores unlimited items across unlimited devices — a genuinely usable product rather than a trial. self-hosting is supported through docker, kubernetes or an offline deployment for anyone who wants the server under their own control.

one thing to change on day one: the default key derivation is pbkdf2 at 600,000 iterations, and argon2id is available but opt-in. the default is defensible and the upgrade is better, and a product this security-forward leaving the stronger option switched off is the one real criticism here.

there is no keepassxc server. the vault is an encrypted file on your machine, aes-256 in the kdbx format with chacha20 and twofish also available, and nothing is transmitted anywhere because there is nowhere to transmit it to. the lastpass incident — cloud backups exfiltrated from a vendor — cannot happen here in principle.

it is free under gplv3 with no tiers, no upsells and no account. version 2.7.9 holds a cspn security certification from anssi, france's national cybersecurity agency, which is a meaningful independent assessment even if the dedicated audit-history page returned a 404 when we looked.

the cost is real. you supply the sync — dropbox, icloud, webdav, your own server — and keepassxc's guarantees stop at the file, so multi-device security becomes as good as whatever you picked. mobile is third-party rather than first-party, and we could not confirm current passkey support from the pages available.

recurity labs, an iso 27001-certified german firm, audited the desktop and mobile apps, browser extensions and cli between january and april 2026. it found no remote exploits and no encryption bypasses, one medium-severity android flaw that proton fixed on retest, and some low-severity cli issues. a 2026 audit is the most recent in this ranking.

the clients are published under gplv3, which is stronger copyleft than most, and the architecture uses per-item keys wrapped by vault keys derived client-side. hide-my-email aliases are included, which is a real privacy feature rather than a checkbox.

the server is closed, so unlike bitwarden the end-to-end claim cannot be verified against the running backend — it rests on trusting proton. the free tier is also more restrictive than it first appears: unlimited logins and ten aliases, but zero vault sharing at all. and proton's pricing page returns placeholder values to anything that isn't a browser, so the figures above come from proton's own announcement rather than the page you'd buy from.

the dual-key model is the real differentiator. a master password you choose plus a 128-bit secret key stored on your devices are combined, so a stolen server-side vault is not brute-forceable against a weak password alone. authentication uses srp, so the password never crosses the wire. it is the strongest answer here to exactly what went wrong at lastpass.

the compliance record is the deepest of the mainstream options — soc 2 type 2 plus iso 27001, 27017, 27018 and 27701 — and the older independent security evaluators reports from 2020 remain downloadable.

two marks against. as of november 2025 the annual pentest reports moved to a trust center access model rather than public pdfs, so the most recent findings are gated behind a request; that is a step backwards on the axis this ranking cares about most. and there is no free tier at all, just a 14-day trial, which is unusual at this price.

the certification list is genuinely unmatched here: soc 2 type 2 claimed for over a decade, iso 27001, 27017 and 27018, fedramp high, govramp high, and fips 140-3 validation under certificate #4743. for public-sector and regulated buyers that combination closes the decision on its own.

the cryptography is modern too — aes-256 with elliptic curve, record- and folder-level keys generated client-side, and kyber hybrid key encapsulation added for post-quantum resistance, which nobody else in this ranking has shipped.

what's missing is evidence. keeper names ncc group and cybertest as quarterly pentesters but links no report, no date and no summary, so every claim on the security page is an assertion. the source is closed on both ends, its own description of it being 'privately held in github enterprise' rather underlines the point, and the pricing page wouldn't render a number for us either.

the secfault security pentest summary from 2025 sits as a pdf on roboform's own site, with a version number and a date. after reading keeper's and lastpass's security pages, which assert audits without linking any, that alone moves roboform up several places.

the fundamentals are sound: aes-256 with pbkdf2-sha256, decryption stated to happen only on device, a bug bounty following cisa standards, passkey management, and a local-only mode that keeps data off roboform's servers entirely for anyone who wants it. at $29.88 a year it undercuts everything except bitwarden.

the limits are scope. one pentest, published in 2025, with no earlier history found and none of the soc 2 or iso certifications the enterprise-focused entries carry. the free tier is single-device. and the advertised monthly price differs between sources, which usually means a promotional rate that renews higher.

cure53 audited nordpass in 2023, 2024 and 2025, covering cryptography, source review and the desktop, browser and mobile clients, with no critical findings reported. an annual cadence from a respected firm is meaningful, and more than most closed-source rivals manage.

it is also the only entry here using xchacha20 rather than aes-256, a defensible modern choice, with encryption and decryption client-side and no vendor access to the master password claimed.

the objections are structural. neither client nor server is open, so cure53's reports are the only window. the free tier is limited to a single device, which for a password manager is close to unusable. and nord's pricing pattern — aggressive introductory rates renewing toward a considerably higher list price — is documented in its own terms and worth budgeting for. for the record, the 2018 nordvpn server incident involved a different product and predates nordpass entirely.

the most recent security document we could find under dashlane's name is its own security principles and architecture whitepaper, dated 2020. that is a design document written by the vendor, not an independent assessment, and in a ranking where bitwarden publishes an audit a year and roboform publishes a downloadable pentest, its absence is the defining fact.

the architecture itself is credible on paper — aes-256-cbc-hmac applied locally before transmission, zero-knowledge claimed, and aws nitro enclaves used for confidential computing at the enterprise tier, which is a genuinely interesting approach nobody else here takes.

two changes make it harder to recommend. the free plan was discontinued on 16 september 2025, removing what had been one of the few real free tiers in the category, leaving a 14-day trial. and the pricing page renders client-side and returned blank placeholders across three attempts, so we cannot tell you what it costs from dashlane's own page.

the sequence, from lastpass's own disclosures. on 25 august 2022 it reported that a compromised developer account had exposed portions of source code and technical information, stating there was no evidence customer data or encrypted vaults were involved. on 22 december it disclosed that the intruder had used that access to reach a third-party cloud storage service and exfiltrate backups containing customer account metadata in the clear — names, billing addresses, email addresses, phone numbers — along with vault copies in which website urls were unencrypted and usernames, passwords and notes remained aes-256 encrypted behind each user's master password.

the unencrypted urls are the part that still matters. even with passwords intact, an attacker holding a vault knows precisely which services a person uses, which is a targeting list. a separate 2015 incident exposed email addresses, password reminders, per-user salts and authentication hashes, and prompted a mass master-password reset.

to its credit, the disclosure detail is the best in this ranking — dated, specific, and explicit about what was and wasn't encrypted. its current security page cites iso 27001, soc 2 type ii, soc 3 and bsi c5 but names no auditor and links no report, and the pricing page renders from javascript templates that returned nothing readable.