Proton Pass
open-source clients under gplv3, a fresh 2026 audit, and a server you still have to take on faith.
a genuinely recent independent audit and copyleft clients put it third — the closed server is what keeps it from competing with the two above.
recurity labs, an iso 27001-certified german firm, audited the desktop and mobile apps, browser extensions and cli between january and april 2026. it found no remote exploits and no encryption bypasses, one medium-severity android flaw that proton fixed on retest, and some low-severity cli issues. a 2026 audit is the most recent in this ranking.
the clients are published under gplv3, which is stronger copyleft than most, and the architecture uses per-item keys wrapped by vault keys derived client-side. hide-my-email aliases are included, which is a real privacy feature rather than a checkbox.
the description above is ours, condensed from the ranking. pricing moves — check it on the vendor's own page before you rely on it.
- category
- password managers
- pricing
- ~$23.88/yr
- website
- proton.me
a genuinely recent independent audit and copyleft clients put it third — the closed server is what keeps it from competing with the two above.
we researched this category against vendors' own pricing pages and licence files. that is where this line comes from — not from the vendor, and not from anything they paid for.
more password managers
Bitwarden
we checked this$19.80/yrthe only one open source top to bottom, audited by a named firm every year since 2018, and the cheapest here.
KeePassXC
we checked thisfreefree, fully open, and the only one with no server at all — there is no vendor vault for anyone to steal.