PrivacyPick

Best Password Managers 2026

11 password managers reviewed and ranked by our team. We check the encryption model, open-source status, independent audits, breach history, and renewal pricing — then rate them honestly.

What do these filters mean?

Open Source: the full client source is publicly available and independently auditable — not just a partially-open core with proprietary components on top

Free Tier: a genuinely usable free plan exists — either with no functional limits for personal use, or with a cap that still covers everyday single-user use; not a time-limited trial

Passkey Support: the manager can store and autofill passkeys for the sites you log into — not merely use a passkey to unlock the manager itself

Self-Hostable: you can keep the vault off the vendor's cloud — either by running the sync server yourself, or because the manager stores a local file with no cloud sync at all

Enpass logo

Enpass

6.8
out of 10

Local vault, no cloud sync

Local-OnlyLimited Free TierBring-Your-Own-CloudZero PossessionOffline-First
Read ReviewVisit Site →

The password-manager rating rubric

Every password manager is scored out of 10 against five weighted categories. The core question is whether the vendor can be kept out of your vault, and whether that is provable.

Security — 30%Privacy & Trust — 25%Features — 20%Usability & Platforms — 15%Price & Value — 10%
  • Security — 30%

    Encryption algorithm, key derivation and iteration count, whether zero-knowledge is provable, any second secret beyond the master password, and how disclosed vulnerabilities are handled.

  • Privacy & Trust — 25%

    Open-source status and build reproducibility, independent audits and whether the reports are public, breach history and the response to it, ownership, and telemetry.

  • Features — 20%

    Email aliases, passkey storage, secure sharing, family organisation, emergency access, autofill quality, breach and password-health reports, and import/export.

  • Usability & Platforms — 15%

    The learning curve for a non-technical user, quality of the desktop, mobile and extension apps, autofill reliability, platform coverage, and offline access.

  • Price & Value — 10%

    Judged on the renewal price of the individual plan, with the free tier and family plan as modifiers.

Reading the scores

A password manager only earns its place if the company running it cannot open your vault. That property — zero-knowledge, or end-to-end encryption — is worth only as much as the evidence for it, which is why the Security and Privacy & Trust categories together carry more than half the weight. What counts as evidence: an independent audit with a report you can read, client code that outsiders can inspect, and an encryption design spelled out in detail — the algorithm, how your master password becomes a key, how many iterations stand between a guess and your data. "Encrypted" on a homepage is where the question starts, not where it ends.

A breach somewhere in a manager's past does not rule it out. The things that move the score are how large it was, how straight the disclosure was, and what the vendor changed afterward — a company that hardened its key derivation and closed the exact hole can rank above one that has simply never been probed. Ownership and acquisition history, the free and family tiers, and how the apps behave under daily use all feed in too. Some background on why a manager is worth running at all is in this explainer.

Hosting model is the other real decision. A cloud-sync manager keeps an encrypted copy on the vendor's servers, so the vault reaches every device on its own. A local-only manager keeps it as a file you hold, with no server involved — harder for a server breach to touch, but sync and backups become your job. Neither is safer in the abstract; the Self-Hostable filter above picks out the ones that stay off a vendor cloud. Each review carries its own per-category Our Ratingtable, set relative to the rest of the field.

Is the browser's built-in manager enough?

For some people it genuinely is. A standalone manager pulls ahead on use across different browsers and ecosystems, on secure sharing, and on storing more than logins — and most make you set a separate master password rather than riding on whatever account you are already signed into. The trade-off is laid out in this piece.

How much does open source matter here?

It lets outsiders confirm the client behaves the way the documentation says, so we count it in a manager's favour — but it does not settle things by itself. A closed manager with a long, repeatedly published audit record can still earn trust, and an open one only benefits from being open if people actually look. The Open Source filter is there if it is non-negotiable for you.