Best Password Manager (2026): Cloud, Offline or Self-Hosted

One master password, a unique password for everything else. Here's which type fits you, and the apps with a clean track record.

Updated

Why You Need a Password Manager

If you've ever run a password breach check and seen a match, you already know the problem. The password itself is rarely the real damage. Reuse is. When one site leaks, attackers try the same email and password on banks, email providers and shopping sites. This is called credential stuffing, and it works because most people reuse a handful of passwords everywhere.

A password manager fixes that. You remember one strong master password. The app generates a long, random, unique password for every account, stores it encrypted and fills it in for you. If one site gets breached, the leaked password opens exactly one account.

Not sure if you've been exposed? Check your email on the Email Breach Check and your most-used passwords on the Password Breach Check first. Those are the passwords to replace first in your new password manager.

Three Types of Password Manager

Every password manager does the same basic job. What differs is where your encrypted vault lives, and that decides how convenient it is and who you have to trust.

Cloud Offline Self-Hosted
Where the vault livesProvider's servers (encrypted)A file on your deviceYour own server or NAS
Sync across devicesAutomaticYou set it upAutomatic
BackupsHandled for youYour jobYour job
Who you trustThe providerOnly yourselfOnly yourself
Setup effortMinutesLow to mediumHigh
Best forMost peoplePrivacy-first usersTech-savvy users

1. Cloud Password Managers (Best for Most People)

Affiliate Disclosure: I independently review everything I recommend. When you buy through my links, I may earn a commission at no cost to you.

Your vault is encrypted on your device with your master password and only then uploaded to the provider's servers. This is called zero-knowledge encryption: the company stores your vault but can't read it. In return you get automatic sync between your computer, phone and browser, easy sharing with family and recovery if you lose a device.

The trade-off is that your encrypted vault sits on someone else's server. If that server is breached, your master password is what stands between the attacker and your accounts. A long, unique master password and two-factor authentication matter more here than anything else.

My three picks below are based on independent security audits, open-source code where available, and each company's security track record, including how they handled incidents.

1Password

Price: From about $3/month (14-day trial) Based in: Canada Open source: No

Price as of Oct 26, 2026.

1Password is the most polished option and a favorite with families and US businesses. Besides your master password, your vault is protected by a 128-bit Secret Key generated on your device, so a stolen vault can't be cracked by guessing the master password alone. Watchtower warns you about reused, weak and breached passwords, and Travel Mode hides chosen vaults when you cross a border.

Security track record: In 2023, attackers who breached Okta reached 1Password's internal Okta environment. 1Password investigated and found no customer data was accessed (BleepingComputer). There has never been a theft of customer vaults.

Pros

  • Secret Key adds a second layer to vault encryption
  • Very polished apps on every platform
  • Excellent family and sharing features
  • Clean security record for customer vaults

Cons

  • No free plan, only a 14-day trial
  • Not open source
Get1Password

Proton Pass

Price: Free (paid plans available) Based in: Switzerland Open source: Yes

Proton Pass comes from the team behind Proton Mail and Proton VPN. It's open source, based in Switzerland, and the free plan stores unlimited passwords on unlimited devices. Its standout feature is hide-my-email aliases: a unique forwarding address for every sign-up, so a breached site never gets your real email (10 aliases on the free plan). Pass Plus ($35.88/year, billed annually) adds unlimited email aliases, a built-in authenticator, dark web monitoring, vault sharing and emergency access.

Price as of Oct 26, 2026.

Security track record: Independent audits by Cure53 (2023) and Recurity Labs (2026) found no remotely exploitable vulnerabilities (CyberInsider). Researchers criticized one weakness: passwords could stay readable in the browser's memory after the vault was locked (report). That is a hardening issue rather than a breach, since an attacker would already need access to your computer. No customer vaults have ever been stolen.

Pros

  • Free plan with unlimited passwords and devices
  • Built-in email aliases protect your real address
  • Open source, independently audited, Swiss jurisdiction

Cons

  • Younger product with fewer advanced features
  • Only 10 email aliases on the free plan
GetProton Pass

Also solid: NordPass. From the makers of NordVPN, with a free plan and no known breach of customer vaults. The free plan keeps you signed in on only one device at a time, so Bitwarden or Proton Pass is the better free choice.

Cloud Password Managers I Don't Recommend

LastPass — stolen vaults (2022). Attackers stole encrypted customer vaults in 2022. Anyone with a weak master password was left exposed, and later cryptocurrency thefts have been linked to cracked LastPass vaults. If you still use LastPass, move to another manager and change your most important passwords, not just the master password (background).

Dashlane — vaults stolen after a two-factor bypass (2026). In June 2026, attackers defeated Dashlane's two-factor mechanism and downloaded the encrypted vaults of about 20 customers. The vaults are still protected by each user's master password, but it's the kind of incident the best options above haven't had (TechCrunch).

2. Offline Password Managers (Most Control)

An offline password manager keeps all your passwords in a single encrypted file on your own device. The app never connects to a company server, so there's no cloud vault to breach and nobody else to trust. Most offline apps use the open KeePass database format (.kdbx), so the same file opens in different apps on your computer and phone.

The catch is that convenience is your job. To use the same passwords on your phone, you sync the file yourself, for example with Syncthing, iCloud Drive or Dropbox (the file stays encrypted). And you need backups: lose the file without a backup and every password is gone.

KeePassXC (Computer)

Price: Free Platforms: Windows, Mac, Linux Open source: Yes

KeePassXC is a free, open-source, community-built app for Windows, Mac and Linux. It stores your vault in a local KeePass file, fills passwords in your browser through the KeePassXC-Browser extension, and can also generate two-factor codes and unlock with a hardware key such as a YubiKey.

Security track record: No security incidents. A disputed 2024 report (CVE-2024-33901) showed passwords could be recovered from a memory dump, which requires an attacker who already controls your computer; the developers consider it unavoidable for this kind of app. Don't confuse KeePassXC with the original KeePass, which had a separate master-password memory flaw in 2023 that did not affect KeePassXC.

Pros

  • Completely free and open source
  • No account, no cloud, no company to trust
  • Hardware key support for unlocking

Cons

  • Sync and backups are up to you
  • No official mobile app (use one of the apps below)
GetKeePassXC

KeePassDX (Android) and KeePassium (iPhone)

Price: Free (paid extras available) Platforms: Android / iPhone and iPad Open source: Yes

No single offline app covers both phone platforms, so pick the one for your phone. Both open the same KeePass file you use in KeePassXC and fill passwords into apps and websites.

  • KeePassDX (Android): free and open source, available on Google Play and F-Droid. No security incidents.
  • KeePassium (iPhone and iPad): open source and audited by Cure53 in 2024. The audit's main finding was that the app didn't enforce a strong unlock passcode, so choose a strong one yourself. No security incidents. Core features are free; some extras need a paid upgrade.

Pros

  • Same encrypted file as on your computer
  • Open source, no account needed

Cons

  • You keep the file in sync between devices
  • Setup takes longer than a cloud app
GetKeePassDX GetKeePassium

Strongbox — changed hands. Strongbox was a popular KeePass app for iPhone and Mac, and there's no sign it has been compromised. But it was sold, and privacy communities stopped recommending it after the change of ownership (Privacy Guides discussion). With KeePassium available, I don't see a reason to take that uncertainty on.

3. Self-Hosted Password Managers (For Tech-Savvy Users)

Self-hosting gives you the convenience of a cloud password manager with the vault on hardware you control: a home server, a NAS or a small rented server. You get automatic sync across all your devices, but you're also the one responsible for keeping that server updated, backed up and locked down.

Vaultwarden

Price: Free Runs on: Docker, NAS, Raspberry Pi Open source: Yes

Vaultwarden is an unofficial, lightweight server that is compatible with Bitwarden. You run the server, and keep using the official Bitwarden apps and browser extensions on all your devices. It runs comfortably on a NAS or a Raspberry Pi, where the official Bitwarden server needs far more resources.

Keep it updated. Vaultwarden fixed a series of security vulnerabilities in 2026, mostly permission flaws in shared organizations plus one that allowed skipping two-factor authentication for some actions. Fixes ship quickly (release notes), but only help if you install them. If you won't check for updates regularly, use a cloud password manager instead.

Pros

  • Your vault never leaves hardware you control
  • Works with the official Bitwarden apps
  • Light enough for a NAS or Raspberry Pi

Cons

  • You handle updates, backups and server security
  • Unofficial project, not supported by Bitwarden
GetVaultwarden

Prefer the official route? Bitwarden also offers its own self-hosted server. It's heavier to run, but supported by Bitwarden itself.

Getting Started: 5 Steps

  1. Pick a long master password. Use a passphrase of four to six random words, for example harbor-velvet-crane-pickle-orbit. Never reuse it anywhere else.
  2. Turn on two-factor authentication for your password manager account (cloud and self-hosted).
  3. Save your recovery options right away: emergency kit, recovery code or a written copy of the master password kept somewhere physically safe. Most providers can't reset a forgotten master password.
  4. Import or add your passwords. Most apps import directly from Chrome, Safari, Firefox and other password managers.
  5. Replace your riskiest passwords first: email, banking and anything flagged by the Password Breach Check or Email Breach Check. Let the generator create a new unique password for each one.

The Verdict

For most people — Bitwarden: Free, open source, on every device. If you'd rather pay for the most polished experience, choose 1Password. If privacy and email aliases matter most, choose Proton Pass.

Want no cloud at all — KeePassXC on your computer, with KeePassDX (Android) or KeePassium (iPhone) on your phone. Just plan your syncing and backups.

Run your own server — Vaultwarden, if you're comfortable keeping a server updated.

Skip: LastPass and Dashlane, both of which have had customer vaults stolen.

Frequently Asked Questions

Is it safe to keep all my passwords in one app?
Yes, far safer than the alternative. Most people who don't use a password manager reuse a handful of passwords, so one breach unlocks many accounts. A good password manager encrypts your vault on your own device with your master password before anything is stored or synced, so even the company running it can't read your passwords. The real risks are a weak master password and no two-factor authentication, and both are in your hands.
What happens if my password manager gets hacked?
With a zero-knowledge password manager, attackers who steal vaults get encrypted files, not readable passwords. To open a vault they still have to guess its master password, which is practically impossible if it is long and unique and very possible if it is short or reused. That is what made the 2022 LastPass breach dangerous: stolen vaults protected by weak master passwords. A long passphrase and two-factor authentication are your protection.
What if I forget my master password?
With most zero-knowledge password managers, the company cannot reset it for you, because they never had it. Set up the recovery options your app offers before you need them: an emergency kit or recovery code (1Password, Proton Pass), emergency access for a trusted person (Bitwarden Premium), or a written copy of your master password kept somewhere physically safe. For offline apps like KeePassXC, a forgotten master password means the database is gone for good.
Is a free password manager good enough?
For most people, yes. Bitwarden's free plan and Proton Pass's free plan both store unlimited passwords and sync them across all your devices. Paid plans add extras such as a built-in authenticator, file storage, emergency access and family sharing, but the core job of generating, storing and filling unique passwords works on the free tiers.
Are browser password managers in Chrome or Safari good enough?
They are much better than reusing passwords, and both Google Password Manager and Apple Passwords now encrypt and sync your logins. Their limits are lock-in and reach: they work best inside one browser or one company's devices, and they are tied to the account you use for everything else. A dedicated password manager works across every browser and operating system and keeps your passwords separate from your Google or Apple account.
Should I choose a cloud or an offline password manager?
Choose a cloud password manager like Bitwarden, 1Password or Proton Pass if you want your passwords on every device with no setup. Choose an offline one like KeePassXC if you don't want your vault on anyone else's server and you are willing to handle syncing and backups yourself. Both are secure when used properly; the difference is convenience versus control.
On This Page