10 Best Open Source Password Managers in 2026

Almost everything you do online now sits behind a login, which makes your password manager the single most valuable piece of software you own. Store your vault in a closed-source service and you are taking a company’s word that your data is safe. Store it in an open source one and anyone can audit exactly how your secrets are encrypted — and, if you want, you can run the server yourself. In 2026 the open source field is genuinely strong: from offline single-file vaults to polished zero-knowledge clouds and enterprise-grade team platforms. Here are the ten best open source password managers you can trust with your credentials this year.

1. Bitwarden — The Cloud All-Rounder

Bitwarden is the closest thing the open source world has to a household name in password management. It syncs a single vault across every device — browser, desktop, mobile and CLI — while keeping the entire stack inspectable. The clients are released under GPLv3, and while parts of the server carry the source-available Bitwarden License, the community fork below exists precisely so purists can run a fully free backend.

• Generous free tier — unlimited passwords, notes and passkeys on unlimited devices at no cost, which almost no commercial manager matches.
• End-to-end encryption — AES-256 with Argon2id key derivation, plus biometric unlock on mobile and desktop.
• Self-hosting option — you can run the backend on your own hardware and keep your vault off Bitwarden’s cloud entirely.
• Everything included — built-in TOTP codes, passkeys, breach reports, secure sharing and emergency access.

If you want one app that “just works” for a whole household, this is the safest default. See the full Bitwarden listing in the directory.

2. KeePassXC — The Offline Purist

KeePassXC takes the opposite approach: there is no cloud, no account and no server. Your passwords live in a single encrypted .kdbx database file that never leaves your devices, and you decide how — or whether — to sync it. The project has been awarded an ANSSI Security Visa by the French national cybersecurity agency, which is rare for a desktop password manager.

• Fully local storage — one encrypted database file under your complete control, with nothing stored remotely.
• Choice of ciphers — AES-256, ChaCha20 and Twofish, all backed by Argon2 or Argon2id key derivation.
• Auto-Type — types credentials straight into any application, with dedicated browser extensions for form filling.
• Extras — hardware key support (YubiKey, OnlyKey), TOTP codes, SSH agent, and YubiKey challenge-response. Current release: 2.7.12.

KeePassXC is the recommendation for anyone who wants maximum control and zero third-party trust. See the KeePassXC listing.

3. Vaultwarden — The Lightweight Self-Hosted Server

Vaultwarden is an unofficial, Rust-written reimplementation of the Bitwarden server that is fully compatible with every official Bitwarden client. It is fast, tiny and happy on a Raspberry Pi, making self-hosting a Bitwarden-style vault genuinely practical instead of an enterprise project. Licensed AGPLv3.

• Tiny footprint — sips memory compared with the official server, and runs happily on low-power hardware.
• Full client compatibility — the official Bitwarden apps connect to it unchanged, including attachments and organisation sharing.
• Flexible database — SQLite, MySQL or PostgreSQL, so it scales from a hobby server to a family deployment.
• Truly open — no source-available components, AGPLv3 all the way down.

Pair it with the standard Bitwarden clients and you get cloud-manager convenience with self-hosted privacy. See the Vaultwarden listing.

4. Proton Pass — The Privacy-First Cloud

Proton Pass comes from the Swiss team behind Proton Mail and Proton VPN, and it applies the same zero-knowledge, end-to-end encrypted philosophy to passwords. The clients are GPLv3 and audited, and the free tier is unusually complete for a hosted service.

• Strong free plan — unlimited logins and devices, passkeys, a password generator and 10 hide-my-email aliases at no cost.
• Built-in email aliases — generate disposable addresses for sign-ups without a separate service, a genuine differentiator.
• Zero-knowledge encryption — not even Proton can read your vault, and the company is bound by Swiss privacy law.
• Growing ecosystem — browser, mobile and desktop apps, a command-line client, and dark-web breach monitoring on paid plans.

For a privacy-minded user who still wants hassle-free sync, Proton Pass is the best of both worlds. See the Proton Pass listing.

5. Passbolt — The Team and Enterprise Choice

Passbolt is built for sharing credentials inside teams and organisations rather than for managing one person’s logins. It is end-to-end encrypted using a public-private key architecture, and the whole product — even the paid edition — is open source, licensed AGPLv3 for the Community Edition.

• Secure sharing — granular, role-based access control over shared passwords, with full audit trails.
• GPG-based encryption — each user holds a key pair, so shared secrets are encrypted to the recipients, not to the server.
• Self-host or cloud — deploy on your own infrastructure via Docker or packages, or use the managed cloud.
• Browser, desktop and mobile apps — autofill and save directly in the browser, with passkey and security-key support.

If your problem is “the whole team keeps sharing passwords in chat”, Passbolt is the fix. See the Passbolt listing.

6. KeePassDX — The Android Companion

KeePassDX is the Android client for the KeePass world. It opens standard .kdbx databases (versions 1 to 4), so it pairs perfectly with KeePassXC on the desktop, and it requires no internet connection at all. Licensed GPLv3, with no ads and no tracking.

• Local-first — reads and writes KeePass-format files stored wherever you keep them, including synced folders.
• Secure autofill — fills forms through its own protected keyboard, with biometric and user-verification unlock.
• Modern features — passkeys, TOTP one-time codes, attachment support and a password generator.
• Material design — one of the most polished KeePass clients on any mobile platform.

Install it from F-Droid or the Play Store and point it at the same database you use on your desktop.

7. Password Safe — The Schneier Classic

Password Safe is the grandfather of the genre, originally designed by renowned security technologist Bruce Schneier and still actively maintained more than two decades later. It stores everything in a single encrypted .psafe3 file unlocked by one master password, and it has been downloaded millions of times.

• Battle-tested — a long track record and a simple, well-understood security model.
• Cross-platform — official builds for Windows, Linux and macOS (releases 1.26.0 as of October 2026).
• Auto-type and YubiKey support — plus cloud-sync-friendly local databases.
• Permissive licensing — released under the Artistic License 2.0.

It is a dependable, no-frills choice for users who value longevity and simplicity over bells and whistles. See pwsafe.org.

8. LessPass — The Stateless Generator

LessPass does not store your passwords at all. Instead it derives them deterministically from a master password, the site name, your login and a counter — so the same inputs always produce the same result. There is no vault to sync, back up or breach, which makes it a genuinely different proposition.

• Nothing to store — your passwords are computed on demand, so there is no database to lose or leak.
• Deterministic — the same master password and settings regenerate any password on any device.
• Everywhere — web app, browser extension, CLI and mobile apps, all GPLv3.
• Self-hostable — run your own LessPass server if you prefer not to use the public one.

It is not for everyone — you must remember or store your master password and any custom counter — but as a stateless generator it is unique.

9. gopass — The Developer CLI

gopass is a command-line password manager built for developers and power users. It keeps secrets as files encrypted with GPG and version-controlled with Git, so your password store gets the same history, branching and sync you already use for code. Licensed MIT.

• Git-backed — every change is a commit, giving you a full audit trail and easy multi-device sync.
• GPG encryption — secrets are encrypted with the battle-tested GnuPG toolchain.
• Team-friendly — multiple stores, user management and secure secret sharing for teams and families.
• Extensible — a browser bridge, a Git credential helper and an integrated Have I Been Pwned checker.

If your passwords already live in the terminal, gopass is the natural fit. See gopass.pw.

10. Password Store (pass) — The Unix Original

Password Store — simply pass — is the standard Unix password manager written by Jason A. Donenfeld (of WireGuard fame). It is a short shell script that stores each password in a GPG-encrypted file inside a Git repository. It is minimal, transparent and endlessly scriptable, licensed GPL-2.0.

• Radically simple — a few thousand lines of shell you can read in one sitting.
• GPG + Git — encryption from GnuPG, versioning and sync from Git, composed exactly how Unix intends.
• Scriptable — pipe it into build scripts, CI jobs and editors; many other tools (including gopass) build on it.
• Battle-tested — the de facto choice for command-line users for over a decade.

Learn more at passwordstore.org.

How to Choose

There is no single best answer — it depends on how much trust you want to place in someone else.

• Want zero cloud and full control? KeePassXC on the desktop with KeePassDX on Android.
• Want sync with no effort? Bitwarden or Proton Pass on their free tiers.
• Want sync but on your own server? Vaultwarden behind the official Bitwarden clients.
• Sharing passwords as a team? Passbolt is purpose-built for it.
• Living in the terminal? gopass or pass.

Already torn between the big three hosted options? Our Bitwarden vs KeePassXC vs Proton Pass face-off compares the big three hosted options head-to-head. And if you are evaluating the wider category, our roundup of open source security tools covers everything from firewalls to vulnerability scanners.

Two projects worth a mention for completeness: Padloc, an elegantly designed AGPLv3 manager for individuals and teams, and Buttercup, a once-popular cross-platform vault — but both have seen little upstream activity recently, so treat them as watch-list rather than first choices in 2026.

Looking for more tools? Browse the full directory of free and open source software — and if you know of an open source password manager we have missed, submit a tool and we will take a look.