Best Open-Source Password Managers (2026): 10 Tools Compared

Your passwords are the keys to your email, your website, your bank and your customers' details, so it's natural to wonder who built the tool holding them. Open-source password managers publish their code, which means other people can read it, check it and, in some cases, run it on their own server. That doesn't make any of them magic, but it gives you more to look at before you hand over your logins.

Here's a list of ten open-source password managers, in no particular order, sorted alphabetically. Two are familiar names and the rest are smaller or more specialised. I've taken every description from each tool's own website or project page, so check the current details on each before you move your logins across. If you're setting up new logins at the same time, my free password generator can make long, random ones in your browser.

Open-source password managers at a glance

In the free plan column, Yes means the tool's own site or project page describes it as free software or lists a free option you can use. Some also sell extra features, and some need you to run your own server, so read what the free route covers before you rely on it.

Tool	Type	Good for	Free plan
Bitwarden	Open-source vault	Personal and team password storage	Yes
KeePassDX	Android vault app	KeePass files on an Android phone	Yes
KeePassXC	Desktop vault	Local, offline password storage	Yes
KeeWeb	Desktop and web vault	Opening KeePass files in a friendly app	Yes
Padloc	Open-source vault	Passwords, notes and shared vaults	Yes
Passbolt	Team vault	Self-hosted sharing for teams	Yes
Passky	Lightweight vault	A simple, unfussy password manager	Yes
Proton Pass	Open-source vault	Passwords with hide-email aliases	Yes
Psono	Self-hosted team vault	A vault run on your own server	Yes
Vaultwarden	Self-hosted server	A lightweight self-hosted server	Yes

Ten open-source password managers for small teams and individuals

Bitwarden

Best for: Owners who want a well-known open-source vault with apps and browser add-ons for most devices.

KeePassDX

Best for: Android users who keep a KeePass database file and want to open and edit it on their phone.

KeePassXC

Best for: People who prefer a local database file on their own computer rather than a cloud account.

KeeWeb

Best for: Anyone with a KeePass file who'd like a tidier interface on desktop or in the browser.

Padloc

Best for: Individuals and small teams who want an open-source vault with notes and sharing in one app.

Passbolt

Best for: Technical teams who want to host their own shared vault and keep full control of the data.

Passky

Best for: People who want something small and uncluttered, with the option to host their own server.

Proton Pass

Best for: Owners already using privacy-minded email who want passwords, passkeys and aliases in one place.

Psono

Best for: Small companies with someone technical who can run their own server for shared logins.

Vaultwarden

Best for: Confident self-hosters who want a small server that is compatible with another well-known vault's apps.

What open source does and doesn't tell you

Open source means the code is public. It doesn't mean the software has been checked by anyone, and it doesn't promise that it's safe. It's one signal among several.

• Active updates. Look at how recently the project was updated and whether problems are fixed in the open.
• Independent reviews. Some makers publish the results of outside security reviews. Read what was covered and when.
• Licence. The licence tells you what you can do with the code, such as running it yourself for your business.
• Who maintains it. A company, a foundation and a single volunteer all carry different risks.
• Backup of your own data. Make sure you can export your vault in a standard format whenever you like.

Hosted, local or self-hosted: which suits your business?

Hosted tools are run by the maker, so you sign in and get on. A local vault is a file on your own computer or phone, which keeps things private but leaves syncing and backups to you. Self-hosted tools run on a server you manage, which gives you control and also gives you the job of updates, backups and security.

If nobody in your team enjoys server work, a hosted or local option is usually kinder to your time. Self-hosting suits someone technical who'll keep it patched. My guide to recovering a hacked Instagram account is a reminder of what a weak password can lead to.

Moving your logins to a new password manager

1. Export your logins from your current tool in a standard file, and keep that file somewhere safe and temporary.
2. Import them into the new manager and check a handful of important logins work.
3. Set a long main password you've never used elsewhere, and write the recovery details down in a safe place.
4. Turn on a second sign-in step for the vault itself.
5. Delete the export file securely once everything is in place.
6. Change the passwords on your most important accounts while you're there.

Never share your main password or any recovery code with anyone. This page is general information, not security or legal advice, so check each tool's own guidance and your own obligations. My privacy audit for an X account is a good example of a quick review you can run on any account.

Questions to ask before you pick an open-source password manager

• Where is my vault stored, and who can reach it?
• Can I export everything in a standard format?
• What happens if I forget my main password?
• How does sharing work for a team, and who controls access?
• Who looks after updates, and how are problems reported?
• Does the free route cover the devices I use?

Why a smaller open-source password manager can be a smart pick

Smaller projects often stay focused on one job, such as local files or team sharing. Many are quick to respond to questions, and some let you host the whole thing yourself. The trade-off is that you'll want to check how active the project is, how backups work and what happens if the maker stops. Try a few harmless logins first.

Do you make a password manager or credential vault? Tool makers can ask to be considered for a featured place on this list.

Trying out your shortlist of open-source password managers

Choose two and import a small set of low-risk logins into each. Practise exporting, restoring and sharing before you move anything important. Compare how clearly each explains backups and recovery, then keep the one that fits how you work.

Frequently asked questions

What is an open-source password manager?

It's a password manager whose code is published so others can read and check it. Some are run for you by the maker, while others you install yourself.

Are open-source password managers safer?

Not automatically. Public code can be reviewed, but that only helps if people do review it and the project is kept up to date. Check how the maker handles updates and outside reviews.

Can I run a password manager on my own server?

Some can be self-hosted, which gives you control but also the job of updates and backups. If that sounds like a chore, a hosted or local option may suit you better.

What if I forget my main password?

That depends on the tool. Many can't recover your vault without your main password or a recovery code, so write the recovery details down and keep them safe.

Can I move my logins between password managers?

Usually yes. Most tools can export and import standard files, but check each one and delete the export file once you're done.

Is it safe to share passwords with my team?

Use the tool's sharing features rather than email or chat, and limit access to the people who need it. Check each tool's guidance for your own situation.