Password manager privacy ratings

Apps and services that store passwords. Hosted ones get automated tests.

26 password managers are rated against 12 public criteria, and 26 have enough evidence for a letter grade. Our picks are Browserpass or Bitwarden. Of the 16 with a known jurisdiction, 10 are based in a Five Eyes country, and 13 in the wider Fourteen Eyes.

Open-source password managers only · Criteria for this category · Suggest an addition · Markdown

Password managers privacy ratings, sorted by pick and then by grade
Name	Grade	Score	Data	Jurisdiction	Open source	No trackers or telemetry	No ads or data sales	Independent audit	Transparency report	Tells users about requests	End-to-end encrypted vault	Local or self-hosted option	Full export	TLS configuration	Security headers	Modern web standards
Browserpass Our pick Browser extension for pass, the standard Unix password manager. Passwords stay in GPG-encrypted files on your own computer.	Grade B	88	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Bitwarden Our pick Open-source, end-to-end encrypted password manager with apps for Windows, macOS, Linux, Android, iOS, the web and browsers, and an option to self-host.	Grade C	73	100%	United States Five Eyes	Yes	No	Yes	Yes	No	No	Yes	Yes	Yes	Yes	Yes	Not tested yet
KeePassium Open source KeePass-compatible password manager for iOS and macOS from KeePassium Labs. It opens KDBX databases stored locally or in any Files app provider, with AutoFill, TOTP and YubiKey support.	Grade A	100	100%	Luxembourg Outside Eyes	Yes	Yes	Yes	Yes	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
KeePassXC Open source, offline password manager for Windows, macOS and Linux that stores passwords in an encrypted KeePass (KDBX) database file. It includes browser integration, TOTP, SSH agent and YubiKey support, with no built-in cloud sync.	Grade A	91	100%	–	Yes	Partial	Yes	Yes	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
KeePassDX Open source password and passkey manager for Android that stores data in encrypted KeePass (KDB and KDBX) database files. It supports autofill, TOTP and biometric unlock, with no built-in cloud service.	Grade B	88	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Password Safe Open source password manager originally designed by Bruce Schneier that keeps passwords in a Twofish-encrypted local database. Official builds exist for Windows and Linux, with YubiKey support and compatible third-party apps for macOS, Android and iOS.	Grade B	88	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Strongbox Open source password manager for iOS and macOS that works with KeePass (KDBX) and Password Safe databases stored locally, in iCloud or in other cloud storage. It supports AutoFill, TOTP, passkeys and YubiKey.	Grade B	88	100%	United Kingdom Five Eyes	Yes	Yes	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Vaultwarden Open source, lightweight server written in Rust that implements the Bitwarden client API for self-hosting. It works with the official Bitwarden apps and extensions and is not affiliated with Bitwarden.	Grade B	88	100%	–	Yes	Yes	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Proton Pass End-to-end encrypted password manager from Proton with apps for desktop, mobile and browsers, built-in email aliases and a TOTP authenticator. The apps are open source.	Grade B	80	100%	Switzerland Outside Eyes	Partial	Partial	Yes	Yes	Yes	Yes	Yes	Partial	Yes	Yes	Partial	Not tested yet
AliasVault Open source, end-to-end encrypted password manager that also generates email aliases and identities and receives mail through its own email server. It can be used in the hosted cloud or self-hosted.	Grade B	75	100%	Netherlands Nine Eyes	Yes	Yes	Yes	No	No	No	Yes	Yes	Yes	Yes	Partial	Not tested yet
PaperVault Encrypts secrets into a printable paper vault and splits the decryption key into several paper key cards with Shamir secret sharing. It runs in the browser, as a standalone offline app or from the command line.	Grade B	75	100%	–	Yes	Yes	Yes	No	No	No	Yes	Yes	Yes	Yes	Partial	Not tested yet
2of3 by Ente Splits a recovery key, password or other secret into three cards with Shamir secret sharing, so that any two cards recover it. It runs entirely in the browser and includes an offline recovery page.	Grade C	73	100%	United States Five Eyes	Yes	Yes	Yes	No	No	No	Yes	Yes	Yes	Yes	No	Not tested yet
LessPass Stateless password manager that derives each site's password from the site name, login and a master password, so no vault is stored or synced. The hosted profile server is closed to new users, who can self-host one.	Grade C	71	100%	–	Yes	Yes	Yes	No	No	No	Yes	Yes	Not applicable	Yes	No	Not tested yet
Pass Command-line password manager that stores each password as a GPG-encrypted file in a folder, with optional git for history and syncing. Many third-party clients and extensions exist.	Grade C	69	100%	–	Yes	No	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Padloc Open source, end-to-end encrypted password manager from MaKleSoft with desktop, mobile, browser and web apps, a hosted service and a self-hostable server. The code has had no updates in several years.	Grade C	68	100%	Germany Fourteen Eyes	Yes	No	Yes	Partial	No	No	Yes	Yes	Yes	Yes	Yes	Not tested yet
Passbolt Open source password manager for teams built on OpenPGP end-to-end encryption, with browser extensions, mobile and desktop apps. It can be self-hosted or used as a hosted cloud service.	Grade C	66	100%	Luxembourg Outside Eyes	Partial	No	Yes	Yes	No	No	Yes	Yes	Yes	Yes	Yes	Not tested yet
Apple Passwords Apple's password manager, built into iOS, iPadOS and macOS as the Passwords app and synced through iCloud Keychain. It stores passwords, passkeys and verification codes, with an iCloud app for Windows.	Grade C	64	100%	United States Five Eyes	No	Partial	Yes	No	Yes	Yes	Yes	Partial	Partial	Yes	Yes	Not tested yet
KeePass Offline, open source password manager for Windows that stores passwords in an encrypted local database file. It has no built-in cloud sync, and community ports exist for other platforms.	Grade C	63	100%	–	Yes	No	No	Partial	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
Psono Open source password manager for teams and companies from esaqa GmbH, with a web client, browser extensions and mobile apps. Vaults are encrypted on the client, and the server can be self-hosted or used as the psono.pw hosted service.	Grade D	55	100%	Germany Fourteen Eyes	Partial	No	Yes	No	No	No	Yes	Yes	Partial	Yes	Yes	Not tested yet
Enpass Closed source password manager from Enpass Technologies that stores encrypted vaults on the device and syncs them through the user's own cloud storage, such as iCloud, Dropbox, Google Drive, OneDrive or WebDAV.	Grade D	50	100%	United States Five Eyes	No	No	Yes	No	Not applicable	Not applicable	Yes	Yes	Yes	Not applicable	Not applicable	Not applicable
1Password Closed source password manager from AgileBits with end-to-end encrypted sync across desktop, mobile, browser and command-line apps.	Grade D	45	100%	Canada Five Eyes	No	No	Partial	Partial	Partial	Yes	Yes	Partial	Yes	Partial	No	Not tested yet
Dashlane Password manager from Dashlane with browser extensions and mobile apps, end-to-end encrypted sync, passkey support and dark web monitoring. The mobile app source code is published under a non-commercial license.	Grade D	45	100%	United States Five Eyes	Partial	No	Partial	No	No	No	Yes	Partial	Yes	Yes	Partial	Not tested yet
Keeper Closed source password manager from Keeper Security with apps for desktop, mobile and browsers. Records are encrypted on the device with per-record keys, and the company also sells secrets and privileged access management for businesses.	Grade D	45	100%	United States Five Eyes	No	No	Yes	No	No	No	Yes	Partial	Yes	Yes	Yes	Not tested yet
LastPass Closed source password manager from LastPass US LP with browser extensions, desktop and mobile apps. Vaults are encrypted on the device, and a past breach exposed copies of customer vault backups that also held unencrypted website URLs.	Grade D	45	100%	United States Five Eyes	No	No	Partial	No	Partial	Yes	Yes	Partial	Partial	Yes	Partial	Not tested yet
NordPass Closed source password manager from Nord Security, the company behind NordVPN, with desktop, mobile and browser apps. Vaults are encrypted on the device with XChaCha20 and synced through NordPass servers.	Grade D	45	100%	–	No	No	Yes	Partial	No	No	Yes	Partial	Yes	Yes	No	Not tested yet
Google Password Manager Password manager built into Chrome, Android and the Google account that saves and syncs passwords and passkeys. Passwords are readable by Google unless on-device encryption is turned on.	Grade F	27	100%	United States Five Eyes	No	No	No	No	Yes	Yes	No	Partial	Partial	Partial	Partial	Not tested yet

Questions

What is the most private option among password managers?

Our picks are Browserpass or Bitwarden. For people who want no password company at all. Every password is a GPG-encrypted file in a folder you control, synced with Git if you like, and Browserpass fills it into the browser. Syncs across desktop, mobile and browser apps and supports sharing with family or a team. End-to-end encrypted, audited every year, and it can be self-hosted.

How are password managers rated?

Each entry answers 12 questions: open source, no trackers or telemetry, no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, security headers, modern web standards, end-to-end encrypted vault, local or self-hosted option and full export. Answers need links to evidence. See the full criteria.

Does jurisdiction matter?

Jurisdiction decides which laws can compel a provider to hand over data. Each entry shows its country and whether it is in the Five, Nine or Fourteen Eyes. The data a provider can hand over depends mostly on what it stores and who holds the keys. Read about jurisdictions and the CLOUD Act.