# Password managers privacy ratings

Apps and services that store passwords. Hosted ones get automated tests.

**Our picks:** [Browserpass](https://privacyratings.com/password-managers/browserpass/): For people who want no password company at all. Every password is a GPG-encrypted file in a folder you control, synced with Git if you like, and Browserpass fills it into the browser. [Bitwarden](https://privacyratings.com/password-managers/bitwarden/): Syncs across desktop, mobile and browser apps and supports sharing with family or a team. End-to-end encrypted, audited every year, and it can be self-hosted.

| Name | Grade | Jurisdiction | Description |
| --- | --- | --- | --- |
| [Browserpass](https://privacyratings.com/password-managers/browserpass/) (our pick) | B (88/100) | Unknown | Browser extension for pass, the standard Unix password manager. Passwords stay in GPG-encrypted files on your own computer. |
| [Bitwarden](https://privacyratings.com/password-managers/bitwarden/) (our pick) | C (73/100) | United States (Five Eyes) | Open-source, end-to-end encrypted password manager with apps for Windows, macOS, Linux, Android, iOS, the web and browsers, and an option to self-host. |
| [KeePassium](https://privacyratings.com/password-managers/keepassium/) | A (100/100) | Luxembourg | Open source KeePass-compatible password manager for iOS and macOS from KeePassium Labs. It opens KDBX databases stored locally or in any Files app provider, with AutoFill, TOTP and YubiKey support. |
| [KeePassXC](https://privacyratings.com/password-managers/keepassxc/) | A (91/100) | Unknown | Open source, offline password manager for Windows, macOS and Linux that stores passwords in an encrypted KeePass (KDBX) database file. It includes browser integration, TOTP, SSH agent and YubiKey support, with no built-in cloud sync. |
| [KeePassDX](https://privacyratings.com/password-managers/keepassdx/) | B (88/100) | Unknown | Open source password and passkey manager for Android that stores data in encrypted KeePass (KDB and KDBX) database files. It supports autofill, TOTP and biometric unlock, with no built-in cloud service. |
| [Password Safe](https://privacyratings.com/password-managers/password-safe/) | B (88/100) | Unknown | Open source password manager originally designed by Bruce Schneier that keeps passwords in a Twofish-encrypted local database. Official builds exist for Windows and Linux, with YubiKey support and compatible third-party apps for macOS, Android and iOS. |
| [Strongbox](https://privacyratings.com/password-managers/strongbox/) | B (88/100) | United Kingdom (Five Eyes) | Open source password manager for iOS and macOS that works with KeePass (KDBX) and Password Safe databases stored locally, in iCloud or in other cloud storage. It supports AutoFill, TOTP, passkeys and YubiKey. |
| [Vaultwarden](https://privacyratings.com/password-managers/vaultwarden/) | B (88/100) | Unknown | Open source, lightweight server written in Rust that implements the Bitwarden client API for self-hosting. It works with the official Bitwarden apps and extensions and is not affiliated with Bitwarden. |
| [Proton Pass](https://privacyratings.com/password-managers/protonpass/) | B (80/100) | Switzerland | End-to-end encrypted password manager from Proton with apps for desktop, mobile and browsers, built-in email aliases and a TOTP authenticator. The apps are open source. |
| [AliasVault](https://privacyratings.com/password-managers/aliasvault/) | B (75/100) | Netherlands (Nine Eyes) | Open source, end-to-end encrypted password manager that also generates email aliases and identities and receives mail through its own email server. It can be used in the hosted cloud or self-hosted. |
| [PaperVault](https://privacyratings.com/password-managers/papervault/) | B (75/100) | Unknown | Encrypts secrets into a printable paper vault and splits the decryption key into several paper key cards with Shamir secret sharing. It runs in the browser, as a standalone offline app or from the command line. |
| [2of3 by Ente](https://privacyratings.com/password-managers/2of3-by-ente/) | C (73/100) | United States (Five Eyes) | Splits a recovery key, password or other secret into three cards with Shamir secret sharing, so that any two cards recover it. It runs entirely in the browser and includes an offline recovery page. |
| [LessPass](https://privacyratings.com/password-managers/lesspass/) | C (71/100) | Unknown | Stateless password manager that derives each site's password from the site name, login and a master password, so no vault is stored or synced. The hosted profile server is closed to new users, who can self-host one. |
| [Pass](https://privacyratings.com/password-managers/pass/) | C (69/100) | Unknown | Command-line password manager that stores each password as a GPG-encrypted file in a folder, with optional git for history and syncing. Many third-party clients and extensions exist. |
| [Padloc](https://privacyratings.com/password-managers/padloc/) | C (68/100) | Germany (Fourteen Eyes) | Open source, end-to-end encrypted password manager from MaKleSoft with desktop, mobile, browser and web apps, a hosted service and a self-hostable server. The code has had no updates in several years. |
| [Passbolt](https://privacyratings.com/password-managers/passbolt/) | C (66/100) | Luxembourg | Open source password manager for teams built on OpenPGP end-to-end encryption, with browser extensions, mobile and desktop apps. It can be self-hosted or used as a hosted cloud service. |
| [Apple Passwords](https://privacyratings.com/password-managers/apple-passwords/) | C (64/100) | United States (Five Eyes) | Apple's password manager, built into iOS, iPadOS and macOS as the Passwords app and synced through iCloud Keychain. It stores passwords, passkeys and verification codes, with an iCloud app for Windows. |
| [KeePass](https://privacyratings.com/password-managers/keepass/) | C (63/100) | Unknown | Offline, open source password manager for Windows that stores passwords in an encrypted local database file. It has no built-in cloud sync, and community ports exist for other platforms. |
| [Psono](https://privacyratings.com/password-managers/psono/) | D (55/100) | Germany (Fourteen Eyes) | Open source password manager for teams and companies from esaqa GmbH, with a web client, browser extensions and mobile apps. Vaults are encrypted on the client, and the server can be self-hosted or used as the psono.pw hosted service. |
| [Enpass](https://privacyratings.com/password-managers/enpass/) | D (50/100) | United States (Five Eyes) | Closed source password manager from Enpass Technologies that stores encrypted vaults on the device and syncs them through the user's own cloud storage, such as iCloud, Dropbox, Google Drive, OneDrive or WebDAV. |
| [1Password](https://privacyratings.com/password-managers/1password/) | D (45/100) | Canada (Five Eyes) | Closed source password manager from AgileBits with end-to-end encrypted sync across desktop, mobile, browser and command-line apps. |
| [Dashlane](https://privacyratings.com/password-managers/dashlane/) | D (45/100) | United States (Five Eyes) | Password manager from Dashlane with browser extensions and mobile apps, end-to-end encrypted sync, passkey support and dark web monitoring. The mobile app source code is published under a non-commercial license. |
| [Keeper](https://privacyratings.com/password-managers/keeper/) | D (45/100) | United States (Five Eyes) | Closed source password manager from Keeper Security with apps for desktop, mobile and browsers. Records are encrypted on the device with per-record keys, and the company also sells secrets and privileged access management for businesses. |
| [LastPass](https://privacyratings.com/password-managers/lastpass/) | D (45/100) | United States (Five Eyes) | Closed source password manager from LastPass US LP with browser extensions, desktop and mobile apps. Vaults are encrypted on the device, and a past breach exposed copies of customer vault backups that also held unencrypted website URLs. |
| [NordPass](https://privacyratings.com/password-managers/nordpass/) | D (45/100) | Unknown | Closed source password manager from Nord Security, the company behind NordVPN, with desktop, mobile and browser apps. Vaults are encrypted on the device with XChaCha20 and synced through NordPass servers. |
| [Google Password Manager](https://privacyratings.com/password-managers/google-password-manager/) | F (30/100) | United States (Five Eyes) | Password manager built into Chrome, Android and the Google account that saves and syncs passwords and passkeys. Passwords are readable by Google unless on-device encryption is turned on. |

## Criteria

- **Open source** (weight 3): Is all the source code needed to run the product public?
- **No trackers or telemetry** (weight 3): Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default?
- **No ads or data sales** (weight 2): Is the product funded without advertising, ad targeting or selling user data?
- **Independent audit** (weight 2): Has an independent security or privacy audit been published within the last three years?
- **Transparency report** (weight 2): Does the provider regularly publish how many government and legal requests it receives and how it responds?
- **Tells users about requests** (weight 1): Does the provider promise to tell users about requests for their data, unless a court forbids it?
- **TLS configuration** (weight 2, automated): Does the website pass the Qualys SSL Labs test with a grade of A or better?
- **Security headers** (weight 1, automated): Does the website pass the Mozilla HTTP Observatory test with a grade of A or better?
- **Modern web standards** (weight 1, automated): Does the website score 90% or higher on the Internet.nl website test?
- **End-to-end encrypted vault** (weight 3): Is the vault encrypted on the device before it is synced, with a key the provider does not hold?
- **Local or self-hosted option** (weight 2): Can the vault be kept locally or on your own server?
- **Full export** (weight 1): Can every item be exported in an open format?

Source: https://privacyratings.com/password-managers/