Independent reviews of password managers based on zero-knowledge architecture, open-source code, and actual security practices—not affiliate commissions.
| Manager | Storage Type | Zero-Knowledge | Open Source | Price | Jurisdiction | Verdict | Details |
|---|---|---|---|---|---|---|---|
| Bitwarden | Cloud (self-hostable) | Yes | Yes | Free / $10/yr (Premium) | USA | Recommended | Visit Site |
| KeePassXC | Local only | Yes | Yes | Free | N/A (local software) | Recommended | Visit Site |
| Proton Pass | Cloud | Yes | Yes | Free / €4/mo (Pass Plus) | Switzerland | Recommended | Visit Site |
| 1Password | Cloud | Yes | No | $2.99/mo (Individual) | Canada | Conditional | Visit Site |
Zero-knowledge means the provider cannot decrypt your vault. Local storage means your vault never leaves your device unless you choose to sync it yourself.
Your vault should be encrypted before it leaves your device. The provider should have no technical ability to decrypt it. This means even if the provider is breached or compelled by authorities, your passwords remain secure.
Open-source password managers can be independently audited to verify the encryption is implemented correctly. Closed-source managers require you to trust the company's word — which is not good enough for something this critical.
Regular third-party audits verify the implementation matches the claims. Look for recent audits (within 2 years) from reputable security firms, with published results.
Cloud storage is convenient but introduces a central point of failure. The best managers offer either fully local storage (KeePassXC) or self-hosting (Bitwarden/Vaultwarden) for those who want complete control.
Password managers that rely on venture capital or have been acquired by larger companies carry long-term risk. Look for independently-run businesses or non-profits with transparent funding and a track record of prioritising security over growth.
Your password manager needs to work everywhere you log in — browser extensions, mobile apps, and desktop. Gaps in platform support encourage insecure workarounds like copying passwords manually.
LastPass suffered a significant breach in 2022 where encrypted vaults were stolen. While the encryption was theoretically sound, weak master passwords meant many vaults were at risk. LastPass is not recommended — the breach response was slow, communication was poor, and the company has changed ownership multiple times.
Chrome, Safari, and Firefox's built-in password managers are convenient but lack features like breach monitoring, secure notes, and cross-platform vaults. More importantly, your passwords are tied to your Google/Apple/Mozilla account — not independently encrypted.
A password manager is only as secure as your master password. Use a long, random passphrase (5-6 random words minimum). Write it down and store it physically somewhere secure. If you lose it, you lose your vault.
Password managers that have taken large VC investments face pressure to monetise user data or be sold to larger companies with different values. LastPass was sold to LogMeIn. Look for independently owned or non-profit options.
For most people: Bitwarden — free, open-source, and works everywhere.
For maximum privacy with no cloud: KeePassXC — your vault never leaves your device.
If you're already in the Proton ecosystem: Proton Pass integrates well.
Your master password protects everything. Use a passphrase — five or more random words strung together (e.g. "correct horse battery staple lamp"). It should be something you can memorise but never used anywhere else.
Write it down on paper and store it somewhere physically secure, like a fireproof safe. Losing your master password means losing your vault.
Most browsers and password managers let you export passwords as a CSV. Import these into your new manager, then go through and update weak or reused passwords.
Run the built-in security audit (Bitwarden calls it "Vault Health Reports") to identify duplicates and breached passwords first.
Enable 2FA on your password manager account itself using an authenticator app — not SMS. This means even if someone gets your master password, they can't access your vault without your second factor.
Store your 2FA backup codes physically, just like your master password.
Yes — the alternative is reusing passwords, which is far more dangerous. A zero-knowledge password manager with a strong master password is significantly more secure than trying to remember unique passwords. The single point of failure risk is real but manageable with a strong master password and 2FA.
With zero-knowledge managers, a breach exposes only encrypted data. If your master password is strong, the encrypted vault is practically uncrackable. The LastPass breach showed that weak master passwords are the real risk — not the encryption itself.
Browser managers are better than nothing, but a dedicated manager offers better security, cross-browser support, secure notes, and vault health reports. More importantly, browser managers tie your passwords to your Google or Apple account rather than independently encrypting them.
Store them in your manager even if you can't change them. The goal is to have them organised and available without reusing them elsewhere. For work accounts specifically, consider using a separate vault or collection to keep work and personal credentials separate.
It has a steeper learning curve than cloud managers, but is perfectly usable once set up. The main complexity is syncing across devices — you need to handle this yourself using something like Syncthing or by putting the database file in a cloud folder you control. For single-device use it's very straightforward.