Best Password Managers in 2026

A maintained reference. Updated when providers change pricing, release audit results, or something significant happens to their security architecture. For setup instructions, see How to Set Up Bitwarden.

Quick Pick

Not sure where to start? Three scenarios:

For most people → Bitwarden
Open source, independently audited, AES-256 with Argon2id support, FIDO2/WebAuthn free on all plans. The January 2026 price increase took it from $9.99/year to $19.80/year, still the best value on this list by a wide margin. Free tier is genuinely unlimited (passwords, devices, sync).

Best polished experience → 1Password
Closed source but heavily audited. Travel Mode is a unique feature with real use cases, removes selected vaults from your devices at a toggle, useful at border crossings. No free tier. March 2026 price increase brought it to $47.88/year individual. Passkey support via FIDO Alliance's Credential Exchange Protocol (CXP) launches in 2026.

Best for families with no technical overhead → NordPass
Cheapest family plan on this list at $2.58/month for up to 6 users. XChaCha20 encryption, uncommon choice, stronger on mobile than AES. Third-party audit by Cure53, SOC 2 Type 2 certified. From the same company as NordVPN (Nord Security), which is worth knowing.

Enterprise/government compliance → Keeper
The only password manager with FedRAMP authorization. If you're in a regulated industry or government context, this is the one, not because the technology is superior, but because the certifications are there. Individual pricing is $34.99/year.

Quick Comparison

Prices current as of March 2026. NordPass promotional rate, verify at checkout.

Security Architecture

The columns that determine what an attacker (or law enforcement with a subpoena) would get if the provider's servers were compromised. Zero-knowledge means the provider's servers store only encrypted data, they cannot read your vault. A subpoena returns an encrypted blob, not your passwords.

Note on the ETH Zurich research (February 2026): Researchers from ETH Zurich's Applied Cryptography Group demonstrated attacks on Bitwarden, LastPass, and Dashlane under the assumption the provider's server had been compromised and was behaving maliciously. Bitwarden responded that it has never been breached. Dashlane patched legacy cryptography in November 2025. The research is meaningful context for threat models involving state-level adversaries, not for typical users.

1Password's Secret Key: The two-secret-key model (master password + 128-bit Secret Key stored only on your devices) means that even a server-side breach can't be decrypted without the device-side key. The tradeoff: if you lose both your master password and your Emergency Kit, there is no recovery path.

Features

On emergency access: Bitwarden's contact-based emergency access (Premium feature) is the most operationally useful. You designate a trusted contact; they request access; you have a configurable wait period to reject it; if you don't respond, they get in. It's built for the scenario where you're actually incapacitated. 1Password's Emergency Kit is a printed document, useful for estate planning, not for a medical emergency.

Business and Sharing

Pricing Detail

Full pricing by plan. All USD unless noted.

Always verify pricing at the provider's checkout page before subscribing, promotional rates and renewal rates differ significantly.

Platform Coverage

Dashlane's desktop app was retired in January 2022. All desktop access now routes through the browser extension. If you need a native app on Linux or prefer to work outside a browser, Dashlane isn't the right choice.

Provider Verdicts

Bitwarden

The default recommendation for most people. The argument for it isn't complicated: open source (you can read the code, independent researchers can find problems), annually audited, AES-256 with optional Argon2id KDF (better resistance to GPU cracking than PBKDF2 alone), FIDO2/WebAuthn hardware key support on free accounts, passkey storage, genuine emergency access for paid subscribers, and a self-hosting option via Vaultwarden for users who want full control.

The ETH Zurich February 2026 research finding is worth understanding without catastrophizing it. The attack scenario requires the Bitwarden server itself to be compromised and actively serving malicious responses to clients. That's not the threat model of 99% of users, it's relevant to people who should be self-hosting anyway. Bitwarden's response was straightforward: no breach has ever occurred, and they view third-party research as valuable input. That's the right posture.

FIDO2 hardware key support moved to all plans, including free, as part of the January 2026 premium plan overhaul. Previously locked to paid plans. That's a meaningful change, hardware key 2FA is the most phishing-resistant option available, and it now costs nothing to use with Bitwarden.

For a full setup walkthrough, see How to Set Up Bitwarden.

Best for: Everyone who doesn't have a specific reason to use something else.

1Password

The premium, closed-source option. "Closed source" is not automatically a disqualifier. 1Password has accumulated more than 24 independent security audits and publishes the results through its Trust Center. The audit density is higher than most open-source projects. The SOC 2 Type 2 and ISO 27001 certifications are management-process attestations, but the Cure53 penetration tests are technical.

Two genuinely unique things. First, the two-secret-key model, your master password plus a 128-bit Secret Key stored only on your devices. A server breach without the device-side key is useless. The tradeoff is that recovery without your Emergency Kit is impossible. Second, Travel Mode, toggle it on before a border crossing, and any vault you haven't marked "safe for travel" disappears from all your devices. The vault isn't deleted; it's removed from device storage until you toggle it off. No other password manager does this. For anyone crossing borders where device searches are a real concern, this is not a gimmick.

The March 2026 price increase is real: individual plan went from $35.88/year to $47.88/year. Still defensible for the feature set and audit history, but it's no longer competitive on price with Bitwarden.

No free tier. No self-hosting option. No contact-based emergency access.

Best for: Users who want maximum audit history, the Travel Mode feature, and are willing to pay the premium for a polished closed-source product.

NordPass

The cheapest family plan on this list. Six users at $2.58/month. The encryption choice (XChaCha20 with Argon2 key derivation) is technically sound. XChaCha20 performs better than AES-256 on devices without hardware AES acceleration, which means every mobile device you own. The Cure53 2020 audit found nine vulnerabilities; all were patched during the audit period. SOC 2 Type 2 and ISO 27001 certifications followed.

What you're trading away: NordPass has the thinnest public audit record here. One Cure53 audit from 2020, plus certifications. No annual pentest cadence like 1Password, no open-source codebase like Bitwarden. The latest listed security work is SOC 2/ISO from 2023-2024.

The Nord Security parentage (same company as NordVPN) is worth knowing. Not a red flag (Nord has a reasonable track record) but it's a larger corporate structure than Bitwarden's independent company model.

No emergency access feature. No self-hosting.

Best for: Budget-conscious users, especially families. The encryption and zero-knowledge architecture are legitimate even if the audit trail is thinner.

Dashlane

The hardest one to recommend without caveats, and the price doesn't justify them. $59.99/year for browser-extension-only access. The desktop app died in 2022. The free plan died in September 2025. What you get is a clean interface, dark web monitoring, an integrated VPN (useful to some, irrelevant to others), and ISO 27001 certification.

The ETH Zurich February 2026 research found six compromise-scenario vulnerabilities in Dashlane. To its credit, Dashlane moved fastest on patches, legacy cryptographic downgrades were removed and the browser extension was patched in November 2025. That's a better response than doing nothing.

What Dashlane doesn't have: a public Cure53-style technical pentest, an open-source codebase, a family plan, or a self-hosting option. At $59.99/year (the highest individual price on this list) you're paying for a polished interface and brand recognition.

Best for: Existing Dashlane users who are satisfied and have no reason to switch. For new users, Bitwarden or 1Password are better options at lower prices.

Keeper

The compliance specialist. SOC 2, ISO 27001, FedRAMP, StateRAMP, if your organization operates in federal or regulated environments, Keeper is the practical choice because those certifications are prerequisites, not nice-to-haves. Individual pricing ($34.99/year) is reasonable. The interface is clean across all platforms including a native Linux app.

Outside the enterprise/government use case, the case for Keeper over Bitwarden is harder to make. The encryption is AES-256 with PBKDF2, functional, but not differentiated. The audit record is certification-heavy (ISO, SOC 2) rather than technical-pentest-heavy. There's no open-source client, no self-hosting option, and breach alerts require a paid BreachWatch add-on.

Best for: Government agencies, regulated industries, and organizations that specifically require FedRAMP authorization. For personal use, the other options offer more per dollar.

Proton Pass

The most generous free tier on this list, and it is not close. Unlimited logins, unlimited devices, unlimited passkeys, two vaults and ten email aliases at no cost. Most providers here gate device sync behind a subscription; Proton does not. Paid is $2.99/month billed annually, and if you already pay for Proton Unlimited it is included alongside Mail, VPN, Drive and Calendar.

The cryptography is current. AES-256-GCM with a key per item rather than one key per vault, so a single entry's key does not open the rest. Sharing runs over OpenPGP with Curve25519, key derivation is bcrypt with an account salt, and authentication uses a hardened SRP exchange. Proton argues bcrypt is the better choice than PBKDF2 here, which is a defensible position. Clients are open source under GPLv3.

The audit record is the most recent on this page. Cure53 audited the mobile apps, extensions and API in 2023, found a moderate number of issues, mostly low severity, and every one was resolved except a single medium-severity item that could not be fixed because of an Android platform limitation. Recurity Labs then audited the extensions, mobile and desktop apps and CLI between January and April 2026, publishing in May, and rated the posture “well above par” with no remote exploits and no encryption bypasses found. SOC 2 Type II followed in July 2025. Swiss jurisdiction, outside the Fourteen Eyes.

The caveat is the one that matters if you use the suite. Proton sells a bundle, and the bundle runs on one account. On Unlimited, your mail, VPN, files and vault all sit behind the same login, so a compromised Proton account is not a compromised password manager, it is a compromised identity. That concentration is the real argument against the bundle, even though each component is well built.

Two settings make it manageable, and neither is on by default. First, put a hardware key on the Proton account itself. It supports FIDO2 and allows up to four keys, and that account is the keystone, for the same reason your email is. Second, turn on two-password mode so your login password and the password that decrypts your data are separate, and set the Pass extra password so Proton Pass has an access password of its own. With both on, knowing your account password is not by itself enough to open the vault. That is the difference between one basket and one basket with a lock on it.

No self-hosting, and no Vaultwarden equivalent. Best for: anyone already in the Proton ecosystem, where Pass is effectively free and the encryption and audit record compete with anything here. If you are picking a standalone password manager and use no other Proton service, Bitwarden remains the better starting point, because it keeps the vault separate from your mail and it self-hosts.

Beyond Storage: Where Each Provider Actually Differentiates

The tables above compare the fundamentals, encryption, audits, price. Past the basics they stop being decisive, because every provider here stores passwords competently. What separates them is the work they do either side of storage: the tooling for people who need more than a vault.

1Password: developer and team workflows

This is 1Password's clearest lead, and it is not close. The desktop app ships a built-in SSH key template: generate a key, add the public half to GitHub with a click, and the built-in SSH agent handles authentication from then on. Private keys never sit in ~/.ssh as plaintext files.

The command line interface extends the same vault into a terminal. You unlock once, inject secrets into commands without them appearing in your shell history or environment, and can require biometric approval before a secret is released. For anyone who has pasted a credential into a deploy script, this is the feature that changes the workflow rather than just tidying it.

Team vaults let administrators set per-collection permissions, so a developer gets the deploy credentials and not the payroll ones. The integrations are the other half: masked email addresses through FastMail, virtual payment cards through Privacy.com for personal use and Brex for business payments. Those are genuinely useful, and no other provider on this list has an equivalent set.

The trade-off is the one already stated above, closed source, no self-hosting, no contact-based emergency access, and now the highest individual price here after the March 2026 increase.

Bitwarden: organisations and self-hosters

Bitwarden's enterprise feature set is the reason it wins organisation deployments that would otherwise default to a commercial vendor. SSO integration on Teams and above lets members authenticate through your identity provider. Directory sync via SCIM handles the part most teams get wrong: joiners and leavers are provisioned and deprovisioned automatically, so offboarding someone actually revokes their vault access instead of relying on someone remembering. Role-based access control and enterprise policies put the guardrails at the organisation level rather than the individual.

Then there is self-hosting. Bitwarden publishes its own self-hosted stack, and Vaultwarden is a widely used lightweight reimplementation. If you would rather the provider not exist in your threat model at all, this is the only mainstream option on this page that lets you remove it. See how to self-host Vaultwarden for the walkthrough.

Worth pairing with hardware keys. Bitwarden supports FIDO2/WebAuthn on free accounts, and setting up a YubiKey covers the registration steps for the services you care about most.

Keeper: regulated and infrastructure environments

Keeper's differentiation is not the vault, it is the products around it. Keeper Secrets Manager stores infrastructure credentials (API keys, certificates, service accounts) and injects them into machines and pipelines without a human handling them. Keeper Connection Manager adds privileged remote session management, so administrative access to servers is brokered and recorded rather than handed out as keys.

That combination, plus FedRAMP and StateRAMP authorisation, is what makes Keeper the practical answer in government and regulated industry. The certifications are a procurement prerequisite, not a technical advantage, and outside that context the case for Keeper over Bitwarden gets thin, because the underlying encryption is conventional and the audit record is certification-heavy rather than pentest-heavy.

What Law Enforcement Gets

Zero-knowledge architecture is not primarily about marketing, it has a legal dimension. When a law enforcement agency serves a subpoena on Bitwarden, 1Password, or any of the others on this list, they receive whatever the provider is capable of handing over. In a properly implemented zero-knowledge architecture, that's encrypted vault data that the provider cannot decrypt. The keys exist only on your devices.

This works until it doesn't. A provider operating under a gag order in a jurisdiction that compels software modifications could, in theory, be forced to push a client update that exfiltrates the master password before hashing. Open-source clients are meaningfully more resistant to this because the code can be audited and reproducible builds can be verified. Closed-source clients require trusting that the binary matches what the audits covered.

For most people this is not a live threat. For people whose password manager contents could result in their prosecution or harm to others, these architectural differences matter.

Passkeys and Where Password Managers Are Going

The shift to passkeys is real and accelerating. Bitwarden reported a 550% jump in daily passkey creation in 2025. Every provider on this list now supports passkey storage. 1Password is implementing FIDO Alliance Credential Exchange Protocol (CXP) in 2026, which will allow passkeys to be moved between password managers without starting over.

The practical implication: your password manager choice today is also your passkey manager choice going forward. A provider that handles passkeys poorly (bad UX, limited platform support, no cross-device sync) will create friction as passkeys replace passwords for more services. On this dimension, Bitwarden and 1Password are the furthest ahead. For more on the passwordless shift, see passkey authentication and Going Passwordless in 2026.

Auditing Your Password Manager

Regardless of which provider you use, the vault itself needs regular maintenance, weak passwords, reused passwords, compromised credentials, and stale accounts that no longer exist. The tool is only as good as the hygiene habits around it. See How to Audit Your Password Manager for a structured process.

Why Browser-Based Managers Aren't the Default

Every major browser ships a built-in password manager, and every one of them is better than reusing Summer2024! across thirty sites. That is the honest case for them, and it is not nothing.

They are still not the default recommendation, for a reason that has little to do with security theatre: focus. A browser vendor's product is the browser. The password manager is a feature they maintain, not a product they compete on, and the roadmap reflects that. Historically they have been slow to add strong password generation, they tie you to one ecosystem, and the vault lives inside the same application that renders untrusted web content all day.

Dedicated managers have spent years building the things a browser never gets to: sharing and collections, contact-based emergency access, breach monitoring, tunable key derivation parameters, hardware key support, CLI and SSH agent integration, and self-hosting. If you want to know what happens to credentials kept in a browser profile specifically, that is covered in the dangers of storing passwords in your web browser.

The practical position: if you use a browser manager today, you are not in danger. If you are choosing one now, choose a dedicated manager, the migration is a single export and import, and it is the last time you will think about it.

Providers Not Included

• LastPass. Two major breaches in 2022, including one where threat actors exfiltrated encrypted vault data. The company's incident response was slow and the disclosure was incomplete. Not included.
• RoboForm. Legitimate product, thinner public audit trail. May be added in a future update.
• KeePass / KeePassXC. Open-source, local-only by default. Excellent for users who want zero cloud exposure, but out of scope for this cloud-sync comparison.
• LessPass. Stateless: passwords are derived from your master password, the site and a counter, and nothing is stored. No vault to breach, but rotating the master password changes every derived password, and you cannot store anything that is not a password. Genuinely useful for a narrow set of users.

Affiliate Disclosure

This page does not carry affiliate links. Bitwarden, 1Password, NordPass, Keeper, and Dashlane all have affiliate or referral programs, this explains why they appear in every "best password managers" roundup. All prices above link directly to the provider's pricing page or an independent source, not to an affiliate landing page.

Changelog

Last updated: 2 October 2026. To report a change (new audit, pricing update, incident) get in touch.