# AliasVault privacy rating

Open source, end-to-end encrypted password manager that also generates email aliases and identities and receives mail through its own email server. It can be used in the hosted cloud or self-hosted.

## Summary

AliasVault scores 75 out of 100 (grade B) on the password managers criteria. It meets 7 of 11 criteria: open source, no trackers or telemetry, no ads or data sales, TLS configuration, end-to-end encrypted vault, local or self-hosted option and full export. It partly meets security headers. It does not meet independent audit, transparency report and tells users about requests. It is based in the Netherlands: Nine Eyes member; EU member (GDPR). Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B.

- Website: https://www.aliasvault.com
- Source code: https://github.com/aliasvault/aliasvault
- License: AGPL-3.0
- Jurisdiction: Netherlands. Nine Eyes member. EU member (GDPR).
- Home page trackers: none found
- Category: [Password managers](https://privacyratings.com/password-managers/)
- Grade: B (75/100)

## Criteria

| Criterion | Answer | Note | Evidence |
| --- | --- | --- | --- |
| Open source | Yes | AGPL-3.0. | https://github.com/aliasvault/aliasvault/blob/main/LICENSE.md |
| No trackers or telemetry | Yes | No third-party trackers. The website's self-hosted Plausible analytics are cookieless and aggregate-only. | https://www.aliasvault.com/privacy-policy |
| No ads or data sales | Yes | Funded by its founders, community support and planned paid plans, with no ads or data sales. | https://www.aliasvault.com/pricing |
| Independent audit | No | No independent audit is published. |  |
| Transparency report | No | No transparency report or government request policy is published. |  |
| Tells users about requests | No | No published policy on notifying users about data requests. |  |
| TLS configuration | Yes | Grade A+ | https://www.ssllabs.com/ssltest/analyze.html?d=www.aliasvault.com&hideResults=on |
| Security headers | Partial | Grade B (75/100+) | https://developer.mozilla.org/en-US/observatory/analyze?host=www.aliasvault.com |
| Modern web standards | Not tested yet | Not tested yet. |  |
| End-to-end encrypted vault | Yes | Vault data, including received emails, is end-to-end encrypted with the master password, which is never sent to the server. | https://www.aliasvault.com/privacy-policy |
| Local or self-hosted option | Yes | The server can be self-hosted with Docker. | https://docs.aliasvault.com/installation/ |
| Full export | Yes | Full vault export and import are available. | https://www.aliasvault.com/roadmap |

Source: https://privacyratings.com/password-managers/aliasvault/
Edit: https://github.com/privacyratings/privacyratings.com/edit/main/ratings/password-managers/aliasvault.md