Best Password Managers in 2026: Free, Open-Source and Self-Hosted Options

For most people, the best password manager on this list is Bitwarden: open-source code, a free personal plan and an official option to self-host. KeePassXC suits anyone who wants an encrypted file on their own device and no cloud account. Proton Pass and Apple Passwords are the easy hosted routes, and Passbolt is built for teams.

The list is organised by where your vault lives: hosted and synced, a local file you control, or a server you run yourself. There is also a section for readers leaving LastPass or 1Password. Security statements here are the vendors' own, as published on their sites. Enlisted has not audited or tested any of these products.

How we picked the best password managers

Each pick does the core job of a password manager: storing logins in an encrypted vault and filling them in. Enlisted prioritised tools with a free plan or free licence, published code where it exists, and, for open-source projects, recent commits on GitHub. Licences are quoted as listed, and where a project's own site says more, the table notes it.

Open source means the code can be read; it does not prove the product is secure. Where a vendor claims audits or zero-knowledge encryption, this guide says so and attributes the claim. Read the vendor's security page before you move your accounts. The method is explained in how Enlisted ranks tools.

Cloud-synced, local vault or self-hosted: which is right for you?

Where the vault lives decides who does the work and who you have to trust.

• Cloud-synced. The vendor runs servers and syncs your encrypted vault across devices. It is the easiest setup, and you rely on the vendor's encryption design and operations. Bitwarden's hosted service, Proton Pass and Apple Passwords work this way.
• Local vault. The vault is an encrypted file on your device, with no vendor account. You choose how to sync it between devices, for example through a file-sync service (see the Dropbox alternatives guide), and you are responsible for backups. KeePassXC, KeePassDX and Strongbox are built this way.
• Self-hosted. You run the server yourself, which keeps data on your own hardware. You are also responsible for updates, HTTPS and backups. Vaultwarden, Passbolt's Community Edition and AliasVault are options.

Why people look for LastPass and 1Password alternatives

Enlisted lists both as closed-source, hosted-only products. LastPass and 1Password are commercial password managers with paid plans for individuals, families and businesses; Enlisted records no free plan for either, though LastPass offers free trials. LastPass says its zero-knowledge model keeps data private even from LastPass itself.

Common reasons to look elsewhere are wanting a free tier, code you can inspect, or a vault stored locally or on your own server. See the full lists on the LastPass alternatives and 1Password alternatives pages.

Best cloud-synced password managers

1. Bitwarden: best all-round free and open-source password manager

Bitwarden is an open-source password manager with a hosted service, a free personal plan and an official server you can run yourself with Docker. Where LastPass and 1Password are closed and hosted, Bitwarden publishes its code and lets you choose between its cloud and your own infrastructure. Enlisted's listing tracks the server repository; the web vault, browser extensions, desktop app and CLI have their own entry.

Bitwarden's security page says the entire codebase is on GitHub under two licences, the AGPL v3.0 and the Bitwarden License v1.0, and that it regularly commissions third-party security audits. It also says it takes a zero-knowledge approach, meaning every item in your vault is encrypted. Those are the vendor's claims. See the Bitwarden entry for live development activity.

• Best for: individuals, families and small teams that want an open-source manager with a free tier and the option to self-host later.
• Watch out for: the code is under two licences, so read them before you self-host or redistribute, and paid plans add family and team features.

2. Proton Pass: best free hosted option with built-in email aliases

Proton Pass is a password manager from Proton that stores passwords, passkeys and 2FA codes and creates hide-my-email aliases. Its site lists a free plan with unlimited logins and devices, passkey support and a limited number of aliases, plus apps for Windows, macOS, Linux, Android and iOS, browser extensions and a web app.

Proton describes the product as open source, end-to-end encrypted with a zero-knowledge design, and independently audited. Enlisted marks the main listing as proprietary, while the Android app has its own open-source listing under GPL-3.0. Proton's Proton Pass page has the details, and Enlisted's Proton Pass entry has the listing.

• Best for: people who want a free hosted manager that also hides their email address from sites.
• Watch out for: Proton's plan comparison lists the built-in 2FA authenticator under Pass Plus, so check which features the free plan includes.

3. Apple Passwords: best built-in option for Apple-only households

Apple Passwords is the built-in Apple app for storing passwords, passkeys and verification codes, synced across a user's Apple devices through iCloud Keychain. It flags weak or compromised passwords, lets you share credentials with a person or a group, shows a history of changes and supports import and export, with browser extensions available.

It comes with Apple's operating systems rather than as a separate purchase, so there is nothing to install on a new iPhone or Mac. See the Apple Passwords listing for more detail.

• Best for: households that use only Apple devices and want a manager with no extra setup.
• Watch out for: it is closed source and designed around Apple's ecosystem, so check Apple's support pages before relying on it elsewhere.

Best local-vault password managers

4. KeePassXC: best offline password manager for desktops

KeePassXC is an open-source password manager for Windows, macOS and Linux that stores usernames, passwords, URLs, attachments and notes in an encrypted file that works offline. It began as a community port of KeePass and can generate passwords or easy-to-remember passphrases. The project's site says the source code is under the GPLv3 license and that no data is stored on remote servers, and topics mention YubiKey support.

Because there is no vendor account, the file can live anywhere, including cloud storage you sync yourself. Enlisted lists the licence as Other, so rely on the project's own statement. More at the KeePassXC page and keepassxc.org.

• Best for: people who want a free, account-free vault on their own computer.
• Watch out for: there is no built-in sync or hosted service, so syncing and backing up the file is your job. It is a desktop app, so phones need a KeePass-compatible app such as KeePassDX or Strongbox.

5. KeePassDX: best KeePass-format password manager for Android

KeePassDX is a lightweight Android password and passkey manager that opens KeePass-format database files, so one vault can work across a desktop and a phone. It is a local manager: credentials live in a database locked with a master key, a keyfile or both. It adds biometric unlock, autofill, passkeys stored locally and one-time password support for HOTP and TOTP.

It supports kdb and kdbx files, is compatible with KeePass, KeePassXC and KeeWeb, and is released under GPL-3.0 and described as ad-free. See the KeePassDX page for release activity.

• Best for: Android users who keep a KeePassXC vault and want it on their phone.
• Watch out for: it is Android only, and syncing the database file between devices is up to you.

6. Strongbox: best KeePass-compatible app for iPhone and Mac

Strongbox is a native iOS and macOS password manager that opens KeePass and Password Safe databases, so your vault is not locked into a proprietary format. It supports KDB and KDBX versions 3.1 and 4 and YubiKey, and it uses encryption algorithms such as Twofish, ChaCha20 and AES. The source code is AGPL-3.0.

It fills the same role as KeePassDX on Apple devices. Open the Strongbox entry for its listing.

• Best for: Apple users who want a local, KeePass-compatible vault without a cloud account.
• Watch out for: the App Store app is supported through a subscription or lifetime licence, so it is not free in the way the source code is, and it is Apple only.

7. Enpass: best if you want a local vault synced through your own cloud

Enpass is a proprietary password manager that keeps the vault on your own devices instead of a vendor-run server. Enpass says you can sync through a cloud account you already own, such as iCloud, Google Drive, OneDrive, Dropbox, Box or Nextcloud, or stay fully offline, and that it never stores your data on its servers.

It sits between a local file manager and a hosted one: you keep the vault, and the app handles syncing. See the Enpass site for supported platforms and Enpass on Enlisted.

• Best for: people who want a conventional app but would rather not store their vault on the vendor's servers.
• Watch out for: it is closed source, and Enpass's free plan caps the number of items you can store, so check the limit against your vault.

Best self-hosted password managers

8. Vaultwarden: best lightweight self-hosted server for Bitwarden clients

Vaultwarden is an unofficial, Bitwarden-compatible server written in Rust, released under AGPL-3.0, that works with the official Bitwarden clients. It implements most of the Bitwarden Client API, including personal vaults, Send, attachments, organizations with shared collections, several kinds of multi-factor authentication including FIDO2 and YubiKey, emergency access and an admin backend. It is aimed at people who find the official server too heavy to run.

The project README is clear about its status: it is not associated with Bitwarden, Inc., you should report bugs to the Vaultwarden project rather than Bitwarden support, the web vault requires HTTPS, and regular backups are strongly recommended. See the Vaultwarden listing.

• Best for: homelab users, families and small teams who want Bitwarden clients on a small self-hosted server.
• Watch out for: it is a community reimplementation, not Bitwarden's own server, and you own HTTPS, updates and backups.

9. Passbolt: best open-source password manager for team sharing

Passbolt is an open-source password manager built for teams, with end-to-end encryption and a security model based on secret keys owned by each user. Teams can share credentials, audit access and apply policies, using browser extensions, mobile apps, a command-line tool or a desktop app. You can self-host the Community Edition or use the vendor's cloud.

The vendor says the product is audited several times a year and the findings are made public, again a claim you can check on passbolt.com. Compare team-focused options on the Passbolt entry.

• Best for: IT teams and small companies replacing spreadsheets of shared credentials.
• Watch out for: it is aimed at teams, so an individual may find its sharing model more than needed, and paid editions sit above the free Community Edition.

10. AliasVault: best open-source manager with built-in email aliases

AliasVault is an end-to-end encrypted password manager that also creates random email aliases for each site and includes its own email server. It describes itself as an independent, community-driven alternative to closed-source password managers, under AGPL-3.0. It offers a web app, browser extensions for Chrome, Firefox, Edge and Safari, and native iOS and Android apps, and its technology list includes Argon2id key derivation and the SRP authentication protocol.

You can use its cloud service or self-host it with Docker. Enlisted's data shows a free cloud tier with fair-use limits and a free self-hosted option. See the AliasVault page.

• Best for: privacy-focused users who want per-site email aliases and a password manager in one place.
• Watch out for: its releases are still numbered below 1.0 at the time of writing, so check its release notes and security documentation before moving critical accounts.

Other password managers worth knowing

Several hosted commercial managers appear in Enlisted's category but are paid or limited. Dashlane and Keeper are closed-source hosted products with paid plans, while NordPass and RoboForm offer a free tier alongside paid options. Compare them on the Dashlane alternatives and Keeper alternatives pages, or browse the full password management category.

How to choose the best password manager for you

Whichever you pick, protect the vault itself: use a long, unique master password, turn on two-factor authentication where the product offers it, and keep a backup of any file or server you manage yourself. Moving between managers is usually an export and an import, and Apple Passwords, for example, supports both.