~/tools/passwords
Password Managers
last updated 2026-08-02 · 4 recommendations · what changed
If you do exactly one thing from this entire site, do this. A password manager
gives every account a strong, unique password you never have to remember,
which means one leaked site can't unlock the rest of your life.
before you pick
Any manager on this page beats reusing passwords, including the one built into
your browser.
Don't agonize over the choice; the win is using one at all.
Pick, set a long memorable master passphrase, and turn on
2FA for the vault itself.
what actually matters
audits & track record
You're trusting this thing with everything. Open code is one route to that trust; relentless third-party audits and a clean history are another. Insist on at least one.
zero-knowledge encryption
The vault must be encrypted with your master password before it leaves your device. The provider should never be able to read it.
company trajectory
A vault is a decade-long relationship. Leadership changes, quiet edits to public commitments, and private-equity fingerprints matter as much as the cryptography.
export & escape
You should be able to export your vault to a standard format anytime. Lock-in on a password manager is lock-in on everything.
recommendations
1Password
the default pick
🇨🇦 canadaclosed sourceauditedpaid
1Password has the best UX in the category (polished, intentional, smoother
than anything else here) on top of a hardened, thoroughly audited
architecture. The "Secret Key" design means a stolen master password alone
can't decrypt your vault. The trade-off is real: closed source and
subscription-only is an ideological compromise, but an acceptable
one given the company's track record, and given what's been happening at the
alternative below.
good
- Genuinely best-in-class apps, autofill, and onboarding
- Secret Key adds real protection against server-side breaches
- Regular public audit reports and a strong security team
- Travel Mode hides chosen vaults at border crossings
mind the
- Closed source: trust is reputational + architectural, not fully auditable
- Prices rose in March 2026: about +33% Individual, +20% Families
- No free tier, subscription only
- No self-hosting option
Bitwarden
the open-source pick
🇺🇸 usaopen sourceauditedself-hostablefree tier
Bitwarden is still technically excellent: open source, audited yearly, a
genuinely usable free tier, and you can self-host it via Vaultwarden. The
hesitation was company-level, not technical. The longtime
CEO quietly moved to an advisory role with no announcement, replaced by an
executive whose background centers on mergers and acquisitions at
private-equity firms; the CFO changed just as quietly; and "Inclusion" and
"Transparency" briefly disappeared from the company's stated values in favor
of "Innovation" and "Trust". Founder Kyle Spearrin pushed back publicly,
calling the leadership changes unrelated to each other and the free-tier
wording change a marketing mix-up, and the company has held steady since: no
acquisition has followed, the "always free" tier is intact, and there's been
no further reshuffling. It's still worth watching, but nothing since has
borne out the worst-case reading.
good
- Still the gold standard for most people: mature, well-audited, and the easiest recommendation to make
- Fully open source with annual third-party audits
- Usable free tier: unlimited entries and devices
- Self-hosting via Vaultwarden decouples you from the company entirely
mind the
- Unannounced leadership changes and quietly edited public commitments
- New executive profile suggests an exit is being prepared
- Premium price roughly doubled (to ~$19.80/yr), its first price change in about a decade
- If an acquisition lands, re-evaluate immediately: export early, not late
KeePassXC
the local-only pick
local-firstopen sourceno accounttotpfree
KeePassXC has no cloud, no account, no company: your vault is a single
encrypted file on your own disk. Nothing leaves your machine unless
you move it. Even if you run 1Password or Bitwarden day to day, keep
a periodic KeePassXC export as a local encrypted backup: it keeps your
credentials independent of any single vendor's future, which is exactly the
risk the entries above are wrestling with.
good
- Zero trust in any third party: the file never leaves you
- Open standard (KDBX) readable by many apps, including KeePassDX on Android
- Built-in TOTP, passkey support, browser integration
- No business model to rot, no boardroom to watch
mind the
- You own sync, backups, and recovery: lose the file and master password, lose everything
- No official mobile app (third-party KeePass apps fill in)
- Less convenient for sharing credentials with family
Proton Pass
the ecosystem pick
🇨🇭 switzerlandpartially open sourcee2eealiasingfree tier
Proton Pass is part of the Proton suite, with open-source clients and
end-to-end encryption across the board. The standout feature is built-in
hidden-by-alias email aliasing: every login can get a
unique forwarding address generated right next to its password, no
separate alias service required. If
you're already on Proton Mail, Drive, or VPN, Pass slots into the same
account and billing with zero extra setup.
good
- Open-source apps across every platform
- Built-in email aliasing (hidden-by-alias) on top of password storage
- Integrates cleanly with the rest of the Proton ecosystem
- Usable free tier; cheap as an add-on to an existing Proton plan
mind the
- Younger product than 1Password or Bitwarden, smaller third-party audit history so far
- Most natural fit if you're already in the Proton ecosystem; less of a draw standalone
- No self-hosting option
Dashlane
the mainstream one, not a pick
🇺🇸 usazero-knowledgeclosed sourcepaid
Dashlane is a subscription password manager and digital wallet: autofill,
dark web monitoring, passkey support, and a bundled VPN (a rebranded
Hotspot Shield). It's on this page the way Telegram is on the
messengers page: popular enough that
you should know exactly where it stands, not because it beats the
picks above. Its record cuts both ways: the zero-knowledge vault design
held up under a real attack in May 2026, but that was still the company's
first confirmed customer-facing incident, and it doesn't publish the kind
of named-firm audit Bitwarden and 1Password do. Your contract sits with
Dashlane USA in New York or Dashlane SAS in Paris, depending on where
you're billed.
good
- Zero-knowledge architecture that held up under a real attack: stolen vaults stayed encrypted
- Client app source is published on GitHub for inspection (non-commercial license, server stays closed)
- Friends & Family covers 10 people, more than 1Password (5) or Bitwarden (6)
- Bundled VPN with Premium, unusual for the category
mind the
- No published named-firm audit; SOC 2 and ISO 27001 cover organizational controls, not the crypto
- May 2026 incident: unauthorized devices on fewer than 20 accounts, encrypted vaults downloaded
- No free plan since September 2025, and billing is annual-only
- You can't buy the password manager without also paying for the VPN bundle
at a glance
prices are ballpark annual rates; check the provider before you commit.
worth knowing
The master passphrase is the whole game. Make it long and
memorable: four or five random words beats P@ssw0rd2026! by miles.
Write it down and store the paper somewhere physically safe until it sticks.
Protect the vault with 2FA. A hardware key or TOTP app on the
manager itself means a phished master password still isn't enough. See
2FA & Hardware Keys.
Keep a vendor-proof backup. Export your vault to an encrypted
KeePassXC database every few months and store it locally. Companies get
acquired, policies change, accounts get locked; a local copy turns all of
those from emergencies into inconveniences.
Save the recovery kit. Most managers generate recovery codes or
an emergency sheet at signup. Print it. The most common way people lose a vault
isn't hackers, it's locking themselves out.
NordPass is worth knowing, not what this page steers you
toward. It's a mainstream, polished, commercial password manager,
a fine reference point if you're comparing options, and not a bad place to
land if you're already invested in the NordVPN ecosystem. But it's closed
source and leans more on marketing than the picks above, so it doesn't
make this page's recommendations.