Password managers
Best Password Managers
Eight password managers compared on encryption, free plan, price, MFA, passkeys, recovery, sharing and audits - from official vendor documentation.
There is no single best password manager. There is a best one for you: the one that runs on all your devices, fits your budget, and that you will actually use for every account. Any reputable manager used that way is far safer than reusing passwords. NIST notes that password managers make stronger passwords more likely, especially when they come with a generator [1].
This guide compares eight popular options side by side. It does not rank them. Instead, it shows the facts you need to choose, and who each one suits.
How this comparison works
Every fact below comes from the vendor's own website, help center, security white paper or official code repository. We did not use review sites, and we did not test the apps ourselves. All pages were checked on 6 October 2026.
Some rules we followed:
- If a vendor does not publish something, we say so. "Not published" means we could not find it on the vendor's official pages. It does not mean the feature is missing or weak.
- Prices are snapshots. They are the cheapest paid personal plan as shown on the official pricing page, in US dollars. Prices change, vary by region and are often promotional. Where the page did not show a readable price, we link to it instead of guessing.
- We are not paid by any vendor. This site has no affiliate links and no ads.
If you first want to know whether a password manager is a good idea at all, read are password managers safe?.
What to look for
A password manager stores all your passwords in an encrypted vault. You unlock it with one master password (or a device unlock). These are the points that matter most:
- Encryption model. The vault should be encrypted on your device before it is synced. In a zero-knowledge design, the company never has the key, so it cannot read your passwords.
- Key derivation. The function that turns your master password into the encryption key, such as PBKDF2, Argon2 or bcrypt. These functions are deliberately slow, which makes guessing the master password expensive.
- Account MFA. A second factor on the manager account itself. Security keys resist phishing best. See what two-factor authentication is.
- Passkeys. Can the manager store passkeys for your other accounts? Can you sign in to the manager with one?
- Recovery. In most zero-knowledge designs, the vendor cannot reset a forgotten master password. Check what recovery options exist before you need them.
- Import and export. Can you move in from your browser, and move out again later?
- Sharing. Sending one password to a person, or sharing a vault with a family.
- Open source and audits. Public code and published independent audits let outsiders check the vendor's claims.
At a glance
Plans and price
| Manager | Free plan | Cheapest paid personal plan (as shown 2026-10-06) | Open source |
|---|---|---|---|
| Bitwarden | Yes - unlimited passwords and devices [3] | Premium, $1.65/month billed annually [3] | Yes - all products [2] |
| 1Password | No - 14-day trial [6] | Individual, $2.99/month billed yearly (promotional; regular $3.99) [6] | Main apps: no [7] |
| Proton Pass | Yes - unlimited logins and devices [9] | Pass Plus - see the official pricing page [9] | Apps: yes (GPL-3.0) [10] |
| Dashlane | No - 14-day trial [12] | Premium, billed annually - see the official pricing page [12] | Parts of the client code are public [13] |
| Keeper | Yes - on one device [16] | Keeper Unlimited, billed annually - see the official pricing page [16] | Client apps: not published as open source |
| NordPass | Yes - one active session on one device [19] | Premium, $1.99/month on a 1-year plan (promotional, excluding VAT) [19] | Not published |
| Apple Passwords | Free, built in [21] | - | Not published |
| Google Password Manager | Free, built in [23] | - | Chrome's password manager code is in Chromium [24] |
Encryption
All eight encrypt saved passwords. The table shows what each vendor states about how.
| Manager | Encryption on your device | Cipher | Key derivation |
|---|---|---|---|
| Bitwarden | Yes, zero-knowledge [2] | AES-CBC 256-bit with HMAC [2] | PBKDF2-SHA256, 600,000 iterations by default, or Argon2id [2] |
| 1Password | Yes, end-to-end [5] | AES-GCM 256-bit [5] | PBKDF2-HMAC-SHA256, 650,000 iterations, plus a 128-bit Secret Key [5] |
| Proton Pass | Yes, end-to-end [8] | AES-GCM 256-bit [8] | bcrypt [8] |
| Dashlane | Yes, zero-knowledge [11] | AES-256-CBC with HMAC [11] | Argon2d [11] |
| Keeper | Yes, zero-knowledge [14] | AES-GCM 256-bit [14] | PBKDF2-HMAC-SHA256, 1,000,000 iterations [14] |
| NordPass | Yes, zero-knowledge [18] | XChaCha20 [18] | Argon2id [18] |
| Apple Passwords | End-to-end encrypted by default in iCloud [20] | Not published | Not published |
| Google Password Manager | Optional on-device encryption [22] | Not published | Not published |
Higher iteration counts are not directly comparable across functions. PBKDF2, Argon2 and bcrypt work differently, so "1,000,000" is not automatically stronger than Argon2. What matters more is your master password: a long, random one, such as a six-word passphrase, protects you even if an encrypted vault is stolen.
For Google, the help pages describe on-device encryption as an option you turn on, and they do not state how passwords are encrypted without it [22]. Apple lists passwords among the data that is end-to-end encrypted in iCloud by default [20].
Account protection and passkeys
| Manager | Second factor for the manager account | Stores passkeys | Sign in to the manager with a passkey |
|---|---|---|---|
| Bitwarden | Authenticator app, FIDO2 security key, email; Duo and YubiKey OTP on Premium [4] | Yes | Yes, in Chromium browsers and the web app [4] |
| 1Password | Authenticator app, security key [7] | Yes | Public beta for new Individual accounts [7] |
| Proton Pass | Authenticator app, FIDO2 security key [10] | Yes, on every plan | No [10] |
| Dashlane | Authenticator app; email codes on new devices; security key not supported as a second factor [13] | Yes | No - passwordless login uses a PIN and biometrics or a security key instead [13] |
| Keeper | FIDO2 security key, authenticator app, biometrics [15] | Yes | Not published |
| NordPass | Authenticator app, security key [19] | Yes, but they cannot be exported [19] | Not published |
| Apple Passwords | Apple Account two-factor authentication; optional security keys [21] | Yes, synced through iCloud Keychain | - |
| Google Password Manager | Google 2-Step Verification, including passkeys and security keys [23] | Yes, synced across your Google Account | - |
Platforms
| Manager | Windows | macOS | Linux | iOS | Android | Browser extensions | Web app |
|---|---|---|---|---|---|---|---|
| Bitwarden | Yes | Yes | Yes | Yes | Yes | Yes | Yes [3] |
| 1Password | Yes | Yes | Yes | Yes | Yes | Yes | Not verified [6] |
| Proton Pass | Yes | Yes | Yes | Yes | Yes | Yes | Yes [9] |
| Dashlane | Extension only | Yes | Extension only | Yes | Yes | Yes | Yes [12] |
| Keeper | Yes | Yes | Yes | Yes | Yes | Yes | Yes [16] |
| NordPass | Yes | Yes | Yes | Yes | Yes | Yes | Yes [19] |
| Apple Passwords | Via iCloud for Windows | Yes | No | Yes | No | Chrome and Edge on Windows; some browsers on Mac | Not published [21] |
| Google Password Manager | In Chrome | In Chrome | In Chrome | Chrome as AutoFill provider | Yes | Built into Chrome | Yes [23] |
Recovery, sharing, export and audits
| Manager | If you forget the master password | Sharing | Export | Independent audits and certifications |
|---|---|---|---|---|
| Bitwarden | It cannot be reset; a hint, emergency access (Premium) or sign-in from another device [3] | Organizations and collections; a free organization has 2 users [30] | JSON, CSV, password-protected encrypted JSON [3] | 2025: Cure53, ETH Zurich; SOC 2 Type 2, ISO 27001 [4] |
| 1Password | Emergency Kit with the Secret Key, a recovery code, or a family organizer [5] | Item links (also to people without 1Password), shared vaults [25] | 1PUX and CSV, both unencrypted [25] | Pentest reports in its Trust Center since November 2025; SOC 2 Type 2, ISO 27001 [7] |
| Proton Pass | A 12-word recovery phrase, a recovery file or a signed-in device; emergency access on Pass Plus [31] | Shared vaults and links on Pass Plus [9] | Encrypted PGP file, ZIP, CSV [9] | Recurity Labs, January-April 2026 [10] |
| Dashlane | It cannot be reset; an account recovery key [13] | On paid plans; links to non-users expire after one view or 24 hours [26] | CSV (unencrypted), encrypted DASH file [26] | Yearly SOC 2 Type II audits and penetration tests; ISO 27001 [13] |
| Keeper | A 24-word recovery phrase made on your device; support cannot help if both are lost [17] | Records and shared folders with permissions; One-Time Share to non-users [17] | CSV, JSON, PDF, encrypted KeePass (KDBX) [27] | SOC 2, ISO 27001, FedRAMP High; quarterly NCC Group tests [15] |
| NordPass | A Recovery Code; emergency access on Premium [19] | Premium only; with permissions and expiry [28] | CSV [28] | Cure53 (desktop app and extension); ISO 27001, SOC 2 Type 2 [18] |
| Apple Passwords | Apple Account recovery; with Advanced Data Protection, a recovery contact or recovery key [20] | Groups of contacts [21] | CSV, unencrypted [21] | Not published for Passwords |
| Google Password Manager | Google Account recovery; with on-device encryption, losing the key can mean losing the saved passwords [22] | Your Google family group only [23] | CSV; on Android also to another password manager [29] | Not published for Password Manager |
"Not published" means we found nothing on the vendor's official pages, not that the product was never audited.
The eight managers
Bitwarden
Bitwarden publishes the source code for all its products on GitHub [2]. Its free plan includes unlimited passwords, unlimited devices, passkeys and two-step login; Premium adds vault health reports, a built-in authenticator, file attachments and emergency access [3]. You can export to JSON, CSV or a password-protected encrypted JSON file. Bitwarden cannot reset your master password. Recovery options include a hint, emergency access on Premium, and signing in with another device [3]. Its 2025 audits include Cure53 and ETH Zurich's Applied Cryptography Group, and it holds SOC 2 Type 2 and ISO 27001 [4].
Good fit if you want a capable free plan, every major platform, or open-source code.
1Password
1Password combines your account password with a 128-bit Secret Key that is stored only on your devices. A stolen vault therefore cannot be attacked with the password alone [5]. There is no permanent free plan [6]. Recovery relies on the Emergency Kit (a document with your Secret Key), a recovery code, or a family organizer who can help you back in [5]. You can share an item with a link, even with people who do not use 1Password. Its Watchtower feature flags breached, reused and weak passwords [7]. Since November 2025, its penetration test reports are published in its Trust Center; it holds SOC 2 Type 2 and ISO 27001 [7].
Good fit if you will pay for a polished app and like the extra protection of the Secret Key.
Proton Pass
Proton Pass encrypts every field, including usernames and web addresses, with AES-GCM [8]. The free plan includes unlimited logins and devices, passkeys and 10 hide-my-email aliases; Pass Plus adds unlimited aliases, an authenticator, sharing, dark web monitoring and emergency access [9]. You can export an encrypted PGP file as well as CSV [9]. You cannot sign in to Proton Pass with a passkey yet [10]. Its apps are open source, and Recurity Labs audited them between January and April 2026 [10].
Good fit if you want a generous free plan, open-source apps and email aliases.
Dashlane
Dashlane no longer offers a free plan; personal plans are billed annually after a 14-day trial [12]. It has no native Windows or Linux app; you use its browser extension or web app there [12]. Dashlane cannot reset your master password; it offers an account recovery key instead [13]. Its Dark Web Monitoring covers up to five email addresses on all plans [13]. It reports annual SOC 2 Type II audits, ISO 27001 certification and yearly penetration tests [13].
Good fit if you mostly work in the browser and want breach monitoring built in.
Keeper
Keeper derives your key with 1,000,000 PBKDF2 iterations and encrypts records with AES-GCM [14]. It lists SOC 2, ISO 27001 and FedRAMP High authorization, and quarterly penetration tests by NCC Group [15]. Recovery uses a 24-word recovery phrase created on your device; if you lose both it and your master password, Keeper support cannot help [17]. You can share a record with someone who has no Keeper account using One-Time Share [17]. BreachWatch dark web monitoring is sold as an add-on [16].
Good fit if formal certifications matter to you, or you want fine-grained sharing.
NordPass
NordPass uses XChaCha20 encryption and Argon2id [18]. The free plan works on one device at a time and leaves out password health, the breach scanner and sharing [19]. Recovery uses a Recovery Code, and Premium adds emergency access for a trusted person [19]. Its desktop app and browser extension have been audited by Cure53; it lists ISO 27001 and SOC 2 Type 2 [18]. Passkeys can be stored and shared, but not exported to another manager [19].
Good fit if you want a simple app and plan to pay for Premium.
Apple Passwords
Apple Passwords is free and built into iPhone, iPad, Mac and Apple Vision Pro, with access on Windows through iCloud for Windows [21]. Passwords are end-to-end encrypted in iCloud by default [20]. You can share passwords and passkeys with a group of contacts. Import and export use CSV files, and an exported file is not encrypted [21]. It warns you about weak, reused and leaked passwords [21]. It does not run on Android or Linux.
Good fit if all your devices are Apple devices.
Google Password Manager
Google Password Manager is free and built into Chrome and Android, with a web view at passwords.google.com [23]. You can turn on on-device encryption so that only you hold the key; once set up, it cannot be removed [22]. Password Checkup flags compromised, reused and weak passwords [23]. Sharing is limited to your Google family group [23]. Import and export use CSV files.
Good fit if you use Chrome everywhere and an Android phone. Turn on on-device encryption and 2-Step Verification.
Which one should you choose?
Start from your devices and budget, not from a ranking:
- You only use Apple devices: Apple Passwords costs nothing and is already there.
- You use Chrome and Android: Google Password Manager is already there. Turn on on-device encryption.
- You mix platforms and want to pay nothing: Bitwarden or Proton Pass, both with free plans that work on every device.
- You want open-source code: Bitwarden or Proton Pass.
- You are happy to pay for extra features or support: 1Password, Dashlane, Keeper or NordPass, depending on the platforms and features above.
Whatever you choose, the setup matters more than the brand. A weak master password or a missing second factor undoes the encryption in the tables above.
After you choose
- Create a strong master password. A random six-word passphrase is long and easy to type. Read what a passphrase is for why it works.
- Turn on MFA for the manager account, ideally with a security key if the manager supports one.
- Set up recovery now: the emergency kit, recovery code or recovery phrase. Store it offline.
- Import your browser passwords, then delete them from the browser if you no longer want two copies.
- Replace weak and reused passwords with generated ones, starting with email and banking.
Frequently asked questions
What is the best free password manager?
Among the eight here, Bitwarden and Proton Pass have free plans with unlimited passwords and devices. Keeper's and NordPass's free plans work on one device. Apple Passwords and Google Password Manager are free but tied to their own platforms.
Are built-in password managers like Apple Passwords or Google Password Manager good enough?
For many people, yes - especially if all their devices use the same platform. Apple encrypts passwords end-to-end in iCloud by default. On Google, turn on on-device encryption. A standalone manager makes more sense if you mix Apple, Windows and Android.
Is an open-source password manager safer?
Not automatically. Public code lets independent people check it, which builds trust, but published audits and a good security record matter too. Closed-source managers can also be audited by outside firms.
Can I switch password managers later?
Yes. All eight can export your data, and most can import from the others. Exports in CSV are usually not encrypted, so delete the file as soon as the import is done. Passkeys are harder to move; NordPass, for example, cannot export them.
Why does this guide not name a winner?
Because the right choice depends on your devices, budget and needs. We report what each vendor documents and let you decide. We have no affiliate deals with any vendor.
How often is this comparison checked?
All facts were checked on 6 October 2026. Prices and features change often, so confirm them on the vendor's site before you buy.
References
- NIST, SP 800-63B Revision 4: Digital Identity Guidelines - Authentication and Authenticator Management, August 2025, https://pages.nist.gov/800-63-4/sp800-63b.html - sec. 3.1.1.2: verifiers allow password managers and autofill; password managers increase the likelihood of stronger passwords.
- Bitwarden, Bitwarden Security Whitepaper, accessed 2026-10-06, https://bitwarden.com/help/bitwarden-security-white-paper/ - end-to-end AES-CBC 256-bit with HMAC; PBKDF2-SHA256 600,000 iterations by default, Argon2id option; source code for all products on GitHub.
- Bitwarden, Pricing and Download, accessed 2026-10-06, https://bitwarden.com/pricing/ and https://bitwarden.com/download/ - free plan features; Premium $1.65/month billed annually; platforms. Recovery: https://bitwarden.com/help/forgot-master-password/ ; export: https://bitwarden.com/help/export-your-data/
- Bitwarden, Is Bitwarden audited? and Two-step login, accessed 2026-10-06, https://bitwarden.com/help/is-bitwarden-audited/ and https://bitwarden.com/help/setup-two-step-login/ - 2025 audits (Cure53, ETH Zurich); SOC 2 Type 2, ISO 27001; 2FA methods. Passkey login: https://bitwarden.com/help/login-with-passkeys/
- 1Password, About 1Password security, accessed 2026-10-06, https://support.1password.com/1password-security/ - end-to-end AES-GCM-256; PBKDF2 650,000 iterations; Secret Key. Recovery: https://support.1password.com/forgot-account-password/
- 1Password, Pricing and Downloads, accessed 2026-10-06, https://1password.com/pricing/password-manager and https://1password.com/downloads - 14-day trial; Individual $2.99/month billed yearly (promotional), regular $3.99; platforms.
- 1Password, Security assessments, Two-factor authentication, Watchtower and Passkeys, accessed 2026-10-06, https://support.1password.com/security-assessments/ ; https://support.1password.com/two-factor-authentication/ ; https://support.1password.com/watchtower/ ; https://1password.com/product/passkeys - Trust Center pentest reports since November 2025; certifications; 2FA; passkey unlock in public beta. Main app code: https://github.com/1Password
- Proton, Proton Pass security model, April 2023, https://proton.me/blog/proton-pass-security-model - all fields end-to-end encrypted; 256-bit AES-GCM; bcrypt-derived key.
- Proton, Proton Pass plans explained, Pricing, Download and Export, accessed 2026-10-06, https://proton.me/support/proton-pass-plans-explained ; https://proton.me/pass/pricing ; https://proton.me/pass/download ; https://proton.me/support/pass-export - free plan; Pass Plus features; platforms; encrypted PGP export.
- Proton, Proton Pass 2026 audit, Passkeys and Two-factor authentication, accessed 2026-10-06, https://proton.me/business/blog/proton-pass-audit-2026 ; https://proton.me/pass/passkeys ; https://proton.me/support/two-factor-authentication-2fa - Recurity Labs audit, January-April 2026; no passkey login yet; 2FA methods. Code: https://github.com/protonpass
- Dashlane, Security, accessed 2026-10-06, https://www.dashlane.com/security - zero-knowledge; AES-256-CBC-HMAC; Argon2d.
- Dashlane, Compare Dashlane personal plans and Supported devices and browsers, accessed 2026-10-06, https://support.dashlane.com/hc/en-us/articles/360001166969-Compare-Dashlane-personal-plans ; https://support.dashlane.com/hc/en-us/articles/202625002-Supported-devices-and-browsers ; https://www.dashlane.com/pricing-personal - no free plan; annual billing; platforms.
- Dashlane, help center articles on 2FA, security keys, passkey login, account recovery, Dark Web Monitoring and compliance, accessed 2026-10-06, https://support.dashlane.com/hc/en-us/articles/12817084382738-Can-I-use-a-security-key-with-Dashlane-2FA ; https://support.dashlane.com/hc/en-us/articles/25056100142994-Can-I-use-a-passkey-to-log-in-to-Dashlane ; https://support.dashlane.com/hc/en-us/articles/11282971791634-Account-recovery-options-for-Dashlane ; https://support.dashlane.com/hc/en-us/articles/25624239534866-Dark-Web-Monitoring-notifications ; https://support.dashlane.com/hc/en-us/articles/32877605633042-9-Compliance-certifications - Code: https://github.com/Dashlane
- Keeper, Keeper Encryption Model, accessed 2026-10-06, https://docs.keeper.io/en/enterprise-guide/keeper-encryption-model - local encryption; AES-256-GCM; PBKDF2-HMAC-SHA256 with 1,000,000 iterations.
- Keeper, Security, accessed 2026-10-06, https://www.keepersecurity.com/security.html - 2FA methods; SOC 2, ISO 27001, FedRAMP High; quarterly NCC Group pentests.
- Keeper, Personal and family pricing, Download and BreachWatch, accessed 2026-10-06, https://www.keepersecurity.com/pricing/personal-and-family.html ; https://www.keepersecurity.com/download.html ; https://www.keepersecurity.com/breachwatch.html ; free plan on one device: https://docs.keeper.io/user-guides/tips-and-tricks/personal-and-business-vaults.md
- Keeper, Reset your master password and Sharing, accessed 2026-10-06, https://docs.keeper.io/user-guides/troubleshooting/reset-your-master-password.md ; https://docs.keeper.io/en/user-guides/sharing - 24-word recovery phrase; One-Time Share.
- NordPass, Security, accessed 2026-10-06, https://nordpass.com/security/ - zero-knowledge; XChaCha20; Argon2id; Cure53 audit, certifications. Audit of desktop app and extension: https://nordpass.com/download/chrome/
- NordPass, Pricing and help center articles on Free vs Premium, MFA, passkeys and Recovery Code, accessed 2026-10-06, https://nordpass.com/pricing/ ; https://support.nordpass.com/hc/en-us/articles/360006700458-Premium-vs-Free-version-of-NordPass ; https://support.nordpass.com/hc/en-us/articles/360002770497-How-to-enable-Multi-Factor-Authentication-MFA ; https://support.nordpass.com/hc/en-us/articles/12984678202641-Passkeys-FAQs ; https://support.nordpass.com/hc/en-us/articles/360002445318-What-is-a-Recovery-Code ; https://support.nordpass.com/hc/en-us/articles/360013369457-Operating-Systems-that-support-NordPass
- Apple, iCloud data security overview, accessed 2026-10-06, https://support.apple.com/en-us/102651 - passwords in iCloud Keychain end-to-end encrypted with Standard Data Protection.
- Apple, Use the Passwords app and Passwords User Guide, accessed 2026-10-06, https://support.apple.com/en-us/120758 ; https://support.apple.com/guide/passwords/welcome/mac ; https://support.apple.com/en-us/102660 - devices; Windows via iCloud for Windows; group sharing; CSV import and export; recommendations; Apple Account 2FA.
- Google, On-device encryption, accessed 2026-10-06, https://support.google.com/accounts/answer/11350823 - optional on-device encryption; cannot be removed once set up.
- Google, Google Password Manager help pages, accessed 2026-10-06, https://support.google.com/accounts/answer/6197437 ; https://support.google.com/chrome/answer/13168025 ; https://support.google.com/accounts/answer/9457609 ; https://support.google.com/chrome/answer/95606 ; https://support.google.com/accounts/answer/185839 - platforms; passkeys; Password Checkup; family sharing; 2-Step Verification.
- Chromium, components/password_manager source tree, accessed 2026-10-06, https://chromium.googlesource.com/chromium/src/+/main/components/password_manager/
- 1Password, Export your data and Share items, accessed 2026-10-06, https://support.1password.com/export/ ; https://support.1password.com/share-items/ - 1PUX and CSV exports (unencrypted); item links, also to people without 1Password.
- Dashlane, Export your Dashlane data and Share with non-Dashlane users, accessed 2026-10-06, https://support.dashlane.com/hc/en-us/articles/202625092-Export-your-Dashlane-data ; https://support.dashlane.com/hc/en-us/articles/33650896504338-Share-with-non-Dashlane-users - CSV and encrypted DASH export; links expire after one view or 24 hours.
- Keeper, Vault export, accessed 2026-10-06, https://docs.keeper.io/en/user-guides/export-and-reports/vault-export - CSV, JSON, PDF and encrypted KeePass (KDBX).
- NordPass, How to export passwords from NordPass and How to share NordPass items on desktop devices, accessed 2026-10-06, https://support.nordpass.com/hc/en-us/articles/360007646477-How-to-export-passwords-from-NordPass ; https://support.nordpass.com/hc/en-us/articles/40567221760529-How-to-share-NordPass-items-on-desktop-devices - CSV export; sharing with permissions and expiry on paid plans.
- Google, Import or export passwords (Chrome help), accessed 2026-10-06, https://support.google.com/chrome/answer/13068232 - CSV export; on Android, export to another password manager app.
- Bitwarden, About organizations, accessed 2026-10-06, https://bitwarden.com/help/about-organizations/ - sharing through organizations and collections; a free organization is limited to 2 users.
- Proton, Recover encrypted data, accessed 2026-10-06, https://proton.me/support/recover-encrypted-messages-files - data recovery with a signed-in device, a recovery phrase or a recovery file.
