The best password managers in 2026

Short answer

Bitwarden is the best password manager for most people in 2026, because it is the only product that combines a dated public audit history, an EU hosting region, official self-hosting and a free plan with no device limit, at EUR 1.52 per month for Premium. Proton Pass wins if you want Swiss jurisdiction and unlimited email aliases. 1Password wins if the apps have to be good enough that your family actually uses them. KeePassXC wins if you want no vendor server at all.

How we ranked these password managers

Eight criteria, in this order of weight.

Encryption and the zero-knowledge model. Everyone here claims zero knowledge. What separates them is the key derivation function and whether the vendor documents it. Bitwarden defaults to PBKDF2-SHA256 with 600,000 iterations and offers Argon2id at 32 MiB, 6 iterations and 4 threads. Keeper runs PBKDF2 at 1,000,000 iterations. Dashlane uses Argon2d with 3 iterations and 32 MB of memory. NordPass uses XChaCha20 with Argon2. 1Password uses PBKDF2-HMAC-SHA256 plus the thing nobody else has: two-secret key derivation, where a 128-bit Secret Key stored on your devices is combined with your account password.

Independent audits, with dates. A vendor saying "audited" is marketing. A vendor publishing which firm, which year and which component is evidence. Bitwarden publishes a per-year list: Cure53 in 2018, 2020, 2021, 2022, 2023 and 2025, plus IOActive on clients and SDKs in 2024, Mandiant on mobile, Unit 42 by Palo Alto Networks, Fracture Labs on web and network, and the Applied Cryptography Group at ETH Zurich on the cryptography itself. Proton published the full Cure53 report from its May and June 2023 assessment. Keeper documents quarterly penetration testing by NCC Group and CyberTest. Dashlane's security page names no firm and no year, and NordPass has no dated audit page at all.

Self-hosting. Only Bitwarden offers an official self-hosted server, on Enterprise. KeePassXC sidesteps the question by having no server. Vaultwarden, the lightweight unofficial Bitwarden-compatible server many people run, is third-party software Bitwarden does not support.

Passkey support. All eight store passkeys. What matters is whether you can also unlock the manager itself with a passkey, which Bitwarden and 1Password support, and whether passkeys work on the free tier, which Proton Pass allows.

EU or Swiss hosting. Bitwarden lets you pick the EU region at signup. Keeper lets an organisation pin its tenant to the EU. Proton is under Swiss jurisdiction, a different and in some ways stronger claim. The other four make no comparable public commitment.

Family and team pricing, breach history, and whether the price is readable at all. The first is detailed below. The second is not "has this vendor ever had an incident", which is meaningless, but "did customer vaults leave the building, and what did the vendor do next". The third cost two vendors here real points, because they publish no list prices on their own pricing pages.

1. Bitwarden: the best password manager for most people

EUR 1.52 per month for Premium, EUR 3.67 for Families with six people, EUR 3.68 per user for Teams, converted from the USD prices on Bitwarden's pricing page at 1 USD = 0.92 EUR.

The free plan is the honest one in this market: unlimited passwords, unlimited devices, and sharing with one other person. Nothing is gated to force an upgrade except file attachments, the built-in authenticator and vault health reports.

It ranks first because of the audit page. Bitwarden lists every third-party assessment by firm, year and component, and the 2025 round included ETH Zurich's Applied Cryptography Group reviewing the cryptography rather than just the app surface. Add SOC 2 Type 2, SOC 3, ISO 27001, the EU region and an official self-hosted server, and no competitor matches the combination at any price.

2. Proton Pass: best if you want Swiss jurisdiction

EUR 4.59 per month at the renewal rate, converted from USD 4.99. Read that sentence twice, because Proton advertises USD 1.99 and that is a first-year price.

What you get for it is unusual. Unlimited hide-my-email aliases change how you sign up for services: every site gets its own address, so a leak at one vendor cannot be correlated with your real inbox. Proton Pass clients are open source, the Cure53 report from 2023 is published in full, and the data sits under Swiss law rather than EU or US law.

The free plan is the second-best free plan here: unlimited logins, unlimited devices, passkeys included and ten aliases.

3. 1Password: best apps, no free plan

EUR 3.67 per month for Individual and EUR 5.51 for Families with five people, at list price, converted from USD 3.99 and USD 5.99. New customers see 25 percent off for the first year, which is why the price you remember is probably not the price you pay in year two.

The cryptography argument is real. With two-secret key derivation, an attacker who dumps 1Password's servers still needs the 128-bit Secret Key that only exists on your devices. That is precisely the attack that hurt LastPass customers.

Against that: no free plan, no self-hosting, no EU-only hosting commitment, and a Teams Starter Pack that is excellent value at EUR 2.29 per user but requires ten seats minimum. A five-person company pays the EUR 8.27 Business rate instead.

In October 2023, 1Password disclosed that its Okta tenant had been compromised through a stolen session cookie belonging to an IT employee. Its investigation concluded that no 1Password user data was accessed. That is a reminder that a password manager company is itself a target.

4. KeePassXC: best if you want no vendor server

Free, GPLv3, and version 2.8.0 shipped on 21 October 2026, so this is not an abandoned project.

KeePassXC is a local KDBX 4 database with AES-256 or ChaCha20 and Argon2 key derivation. There is no account, no subscription, no telemetry and no central vault for anyone to steal. The honest cost is that you build the sync yourself with Nextcloud, Syncthing, iCloud Drive or a USB stick, the official apps are desktop only, and on phones you rely on third-party clients such as KeePassDX or Strongbox. Lose your key file with no backup and the data is gone for good.

5. Apple Passwords: free, and enough for an all-Apple household

The standalone Passwords app arrived with iOS 18, iPadOS 18, macOS Sequoia and visionOS 2. It stores passwords, passkeys, verification codes and Wi-Fi credentials, syncs through iCloud Keychain, and supports shared groups for a family.

It is free, it is already installed, and for a household that would otherwise keep passwords in a note it is a large improvement. The limits are hard, though: no Linux client, no native Windows app (only the iCloud Passwords extension for Chrome and Edge through iCloud for Windows), no admin console, no team vaults, and no independent third-party audit of the app published by Apple.

6. Keeper: best for FedRAMP and regulated buyers

EUR 3.30 per month, converted from USD 42.99 per year for Keeper Unlimited, per Keeper's own knowledge base.

If your procurement form has a line for FedRAMP High, GovRAMP High or a FIPS 140-3 validated cryptographic module, Keeper is the answer and the rest of this list is not. PBKDF2 at 1,000,000 iterations, record-level encryption, SOC 2 Type 2 held for over a decade, ISO 27001, 27017 and 27018, quarterly penetration tests, and a tenant you can pin to the EU.

For a household, none of that applies and the price is twice Bitwarden's. The business tier prices are not readable on the pricing page, so budget for a sales conversation.

7. NordPass: cheap, with a free tier that is not usable

EUR 1.23 per month on a multi-year promotional term, per NordPass' own plans page, renewing higher.

The engineering is fine. XChaCha20 with Argon2 is a defensible modern choice, and the apps are fast and tidy. Two things hold it back. The free plan allows one active device at a time, so it cannot be recommended as a free password manager at all. And NordPass does not publish a dated audit report page the way Bitwarden and Proton do, which means the audit claim rests on secondary reporting rather than a document you can read yourself.

8. Dashlane: good cryptography, unreadable prices

Price on request, because Dashlane's own pricing pages render no prices.

The cryptography is modern: AES-256-CBC with HMAC, Argon2d at 3 iterations and 32 MB of memory, and AWS Nitro Enclaves isolating sensitive operations. The product has also moved upmarket into credential-risk detection and phishing defence, which is a reasonable strategy.

It still finishes last, for two reasons that are about transparency rather than engineering. A buyer cannot compare Dashlane on price, because the numbers are not on the page. And its security page names no auditing firm and no audit year, while four competitors name both.

What the LastPass breach actually proved

LastPass is not in this ranking, and it belongs in the article anyway, because it is the reason the criteria above are weighted the way they are.

In August 2022 an attacker stole credentials from a LastPass engineer and took source code and internal secrets. In a second, connected intrusion running from August to October 2022, the attacker used keys from a DevOps engineer's home machine to copy backups of customer vault data. LastPass disclosed on 22 December 2022 that customer vault data had been copied, including unencrypted fields such as site URLs alongside the encrypted usernames and passwords. Stolen vaults were later linked in public reporting to cryptocurrency thefts from people who had stored wallet seeds in them.

Three lessons, and all three are in the scoring above.

First, the server-side copy is the realistic threat, not someone guessing your master password. That is why 1Password's two-secret key derivation and Bitwarden's 600,000-iteration default matter: both raise the cost of an offline attack on a stolen vault.

Second, metadata is not harmless. The unencrypted URL fields told attackers exactly which vaults were worth attacking.

Third, a vendor's incident behaviour is part of the product. Compare the December 2022 drip-feed with 1Password's October 2023 disclosure, which named the vector, scoped the damage and listed the countermeasures.

For the full threat model, including what a password manager cannot protect you from, read are password managers safe.

Which password manager is hosted in the EU or Switzerland?

Three credible answers.

1Password, Dashlane, NordPass and Apple Passwords make no comparable public region commitment. For an EU company with a GDPR data-processing register to maintain, that is a real procurement difference, not a theoretical one.

What does a password manager cost for a family?

For six people, per month, converted at 1 USD = 0.92 EUR:

Bitwarden Families at EUR 0.61 per person per month is the clear value answer. If everyone in the household is on Apple hardware and nobody touches Windows or Linux, Apple Passwords at zero is a defensible choice, and switching later is an export away.

What does a password manager cost for a team of five?

This is where the ranking flips, because minimum seat counts bite.

• Bitwarden Teams: EUR 3.68 per user per month, no minimum. Five people, EUR 18.40 a month.
• Proton Pass Essentials: EUR 1.83 per user per month, three-seat minimum. Five people, EUR 9.15 a month.
• 1Password Business: EUR 8.27 per user per month. Five people, EUR 41.35 a month. The EUR 2.29 Teams Starter Pack needs ten seats, so a team of five cannot use it.
• Keeper Business Starter: covers 5 to 10 users, price on request.
• Dashlane: price on request.

For five people who want an EU region, Proton Pass Essentials is the cheapest credible option and Bitwarden Teams is the one with the audit trail. 1Password Business is more than four times the Proton price, and you are paying for interface quality and the two-secret key model.

How do you switch password managers without losing anything?

Export, import, verify, then delete. Export the old vault to CSV, import it, then compare the item count in both vaults before you trust the new one, because importers silently drop entries with unusual characters. Delete the export file afterwards, it is a plaintext copy of every credential you own. Then close the old account and rotate what matters: email, bank, domain registrar, cloud provider, the manager itself.

If you are weighing the two most-compared options specifically, we put them head to head in 1Password vs Bitwarden, and the full Bitwarden profile with every pricing tier is at Bitwarden.

Vendors: if you publish a password manager and we have a fact wrong, or your pricing changed since 11 November 2026, send us the primary source through get listed and we will correct the page with a dated note.