Open-source Passwordstate alternatives

Vaultwarden is a Rust server that reimplements the Bitwarden Client API as an alternative to the official service, and it works with the official Bitwarden clients. It was formerly known as bitwarden_rs and is released under the AGPL-3.0 license. It is aimed at people who self-host and find the official server too heavy to run themselves.

The project implements most of the Bitwarden Client API, including personal vaults, Send, attachments, website icons and personal API keys, as well as organizations, with collections, shared passwords, member roles, groups, event logs and policies. Multi-factor authentication covers authenticator apps, email, FIDO2 WebAuthn, YubiKey and Duo, and emergency access is supported. An admin backend and a modified web vault client are included.

Vaultwarden is distributed as a Docker image and the code is on GitHub. The project is unofficial, and its maintainers ask users to report problems to them rather than to Bitwarden's official support channels. It suits individuals, families and small teams who want to host their own password manager while keeping the familiar Bitwarden apps and browser extensions.

Bitwarden is a password manager, and this repository contains its server side: the APIs, database and other core infrastructure that all Bitwarden client applications connect to. The code is written in C# on .NET Core with ASP.NET Core, and the database layer is written in T-SQL for SQL Server.

The server can be developed, built, run and deployed on Windows, macOS and Linux. For deployment, the project provides Docker containers along with PowerShell and Bash scripts that bootstrap an installation, and the images are published on GitHub Container Registry. The services include Admin, API, Billing, Events, Identity, Notifications, SCIM and SSO components.

Organizations that want to keep their vaults on their own infrastructure can follow the on-premise install guide in the Bitwarden help center, which requires Docker and Docker Compose. Bitwarden also runs managed cloud clusters in the US and EU. The repository lists its license as 'Other', so check the license files for the exact terms.

This repository holds the client applications of Bitwarden, the password manager, except for the mobile apps. It contains the web app, the browser extension, the desktop application and the command-line tool, which together are the interfaces people use to store and fill in their credentials.

The code is written mostly in TypeScript, with Angular for the web interfaces, Electron for the desktop app and Node.js for the CLI. Browser extensions cover Chrome, Firefox and Safari. The clients talk to the Bitwarden server, which lives in a separate repository and covers the API, database and Docker deployment, while the iOS and Android apps each have their own repositories.

The repository is published under a custom Bitwarden license rather than a standard SPDX identifier. Contribution guidance, build instructions and recommended tooling are kept in Bitwarden's contributing documentation, and the project welcomes security audits and reports through its issue tracker or private email for sensitive findings.

Gopass is a UNIX-style password manager aimed at teams. It can replace pass, the standard UNIX password manager, as a drop-in, and works the same across Linux, macOS, BSD and Windows, including across several devices, or entirely offline on an air-gapped computer.

By default, credentials get encrypted using GPG and tracked in git, which provides history and syncing through any git remote. The backends can be changed, with options such as age for encryption and fossil for storage. The primary interface is the command line, which suits CLI users and CI/CD systems, while a browser integration reduces the need to use it. It needs no network connection unless you want one, and most users pair it with gpg and git.

Gopass is written in Go and licensed under MIT. It is available from package managers including Homebrew, MacPorts, Fedora COPR, Arch, Alpine, FreeBSD and Windows, but the README warns not to install the package called gopass from the official Debian repositories, because that is an unrelated project. It suits developers and ops teams sharing secrets through git.

Passbolt is an open-source password manager built for teams. It lets organizations gather, structure and share passwords and other secrets, and its security model relies on secret keys owned by each user together with end-to-end encryption. The vendor says the product is audited several times a year and that the findings are made public.

The repository holds the JSON API of the Community Edition, written in PHP on CakePHP. Users work through clients: browser extensions, mobile apps, a command-line tool and a desktop app. Teams can share credentials and audit access, with policies aimed at power users. The README includes guidance for running the server natively on your own machine.

Passbolt Community Edition is licensed under AGPL-3.0. The vendor also offers paid Pro and cloud-hosted options, which suit organizations that prefer managed hosting or extra features. It fits teams, from small startups to larger IT departments, that want shared credential management they can host and inspect themselves.

Padloc is a password and secure data manager aimed at both individuals and teams who want an open-source alternative to closed commercial password managers. It emphasizes simplicity and security, built around end-to-end encryption so that stored data is protected even from the server operator.

The project is organized as several packages: a core logic library, web-based UI components, a backend server, a progressive web app client, a desktop app built with Electron, mobile apps built with Cordova, a cross-platform native app built with Tauri, and a browser extension, along with a localization package for translations. This split lets different front ends share the same core encryption and data logic.

Setting up a local instance for testing requires installing and configuring at least the server and a web client, which the README describes as quick to do, while guides for running a production deployment and building distributable desktop and mobile apps are still being written. Padloc is written in JavaScript and TypeScript and released under the AGPL-3.0 license, making it self-hostable.

sysPass is a self-hosted, web-based password manager written in PHP and designed for both business and personal use. It stores credentials centrally and lets teams share them according to permissions, which suits system administrators who manage many accounts for servers and services.

Security features include AES-256 encryption in CTR mode, RSA for sending passwords from forms, and two-factor authentication. Administration covers users, groups and profiles with up to 29 access levels, and logins can use MySQL, OpenLDAP or Active Directory authentication. Accounts can carry tags, custom fields, public links, history and favorites, and can be marked private.

Further functions include email and in-app activity notifications, an event log, a multilingual interface and a JSON-RPC API for integrations. sysPass is published under GPL-3.0, with installation documentation at doc.syspass.org and a Docker image on Docker Hub. It runs on your own PHP server and database.