Enpass ships a password manager that never holds your vault. Instead of syncing to Enpass servers, the app writes an encrypted database into whatever cloud storage you already use — Google Drive, Dropbox, iCloud, OneDrive, Box, NextCloud, plain WebDAV — or keeps it entirely on the device with no cloud at all. That removes the single most valuable target in this category, a central store of encrypted vaults. What it costs you is a second unlock factor: the vault opens on a Master Password and nothing else.

Security

The vault is a SQLite database encrypted through SQLCipher, an open-source extension built on OpenSSL’s libcrypto, using AES-256 in CBC mode. The Vault Key is derived from the Master Password — and, optionally, a keyfile — with PBKDF2-HMAC-SHA512 at 320,000 iterations. Every database is initialized with its own random 16-byte salt written into the first bytes of the file, so the same password on two databases produces two different keys. PBKDF2 is not memory-hard the way Argon2 is, which hands a GPU-equipped attacker better economics per dollar, but 320,000 iterations of SHA-512 still imposes real cost on each guess.

The Master Password is never transmitted and never stored in any reversible form. The consequence is the one you would expect: on a personal plan there is no recovery path. Enpass cannot reset it, because Enpass holds no record of it — forget it and the vault is gone. (Business customers get an optional admin-assisted PKI recovery flow through the Enpass Hub server component, but that is a business-tier feature and does not apply to a personal subscription.)

The optional keyfile is the one way to add a second factor to the vault itself: a 32-byte file generated by a cryptographically secure random number generator, which must be present alongside the Master Password before the database will decrypt. This is a manual setting the user has to enable and manage — it is not a secret issued automatically at signup, and in practice most people never turn it on.

What Enpass does not have is an account-level second factor for unlocking the app — no TOTP, no hardware security key. Enpass’s own materials describe a “multi-factor” story instead: an attacker would need to work out which cloud service you chose, obtain that account’s credentials, clear that provider’s own multi-factor authentication, and then still know your Master Password. That chain is a genuine obstacle against one specific attack — someone hunting for vaults in bulk has no central store to raid — but it is protection borrowed from Google or Dropbox, not a second factor on the vault. If your Master Password leaks and someone has your encrypted file, nothing inside Enpass stops the decryption.

Quick unlock through Face ID, Touch ID, a fingerprint sensor or a PIN sits on top of the Master Password rather than replacing it: the password is kept obfuscated in the operating system’s own secure store — iOS Keychain, Android Keystore, a TPM behind Windows Hello, the macOS Secure Enclave — and released only after a successful biometric check. Five consecutive failed biometric attempts on iOS wipe the stored copy out of the Keychain and force manual entry of the Master Password.

The browser extensions talk to the desktop app over a local WebSocket secured by an SRP-6a handshake that establishes a per-session shared key, and pairing is manual — you type a code from the app into the extension. Autofill respects same-origin policy, and Enpass does not run fill scripts automatically on page load; it surfaces matching credentials and fills only after you pick one. Local Wi-Fi sync follows similar logic, running a small WebDAV server peer-to-peer with mDNS discovery, a self-signed certificate and a time-based verification code to blunt man-in-the-middle attempts.

One disclosed vulnerability belongs in this section. In August 2025, researcher Marek Tóth presented “DOM-based Extension Clickjacking” at DEF CON 33 — a technique that makes a password manager extension’s injected UI invisible on a malicious page so that a user’s ordinary click silently triggers autofill and exfiltration. Tóth tested eleven managers, Enpass among them, and all eleven were vulnerable in their default configuration. Vendors were notified privately in April 2025 with public disclosure set for August; Enpass shipped a fix in version 6.11.6 on 13 August 2025, the same month the research went public, while several other major managers still had no patch out at that point. This was never a compromise of stored vaults — it required a user to visit and click on an attacker-controlled page — and it has been fixed.

Privacy & Trust

The architecture is the privacy argument. Because Enpass never receives, stores or touches vault data, there is no server-side pool of encrypted databases to be stolen, subpoenaed or mishandled. Enpass markets this as “zero possession” and draws a distinction with the zero-knowledge model most of this category uses, where the vendor does hold your encrypted data but cannot read it. The marketing framing is arguable; the architectural fact behind it is not. And the strongest version of it is the one Enpass mentions least: you can run the app with no cloud whatsoever, keeping the database on the device and syncing over your own Wi-Fi, in which case nothing ever leaves your hardware. Even the business-tier Hub holds only encrypted key material and metadata rather than vault contents, and an organization can self-host it.

Verifiability is where this gets thinner. Enpass is closed source — SQLCipher, the encryption library underneath, is open, but the client wrapped around it is not. And the credentials Enpass cites are process certifications rather than code review: SOC 2 Type II, ISO 27001:2022, GDPR compliance. Those attest that the company follows documented information-security procedures; they say nothing about whether the cryptography is implemented correctly. There is no public independent cryptographic audit or penetration-test report that an outsider can download and read. Several competitors publish exactly that, and against a closed-source client the absence matters more, not less.

Telemetry is restrained. The privacy notice states plainly that Enpass does not use analytics in its apps — no behavioral or usage tracking inside the client. The exception is crash reporting: when the app fails unexpectedly it generates a report automatically, without a per-incident consent prompt, containing the package name, app version, operating system and version, system language, device manufacturer and model, the date, and debug logs. No passwords or vault contents are included. The enpass.io marketing site runs Google Analytics and Clearbit, which is a fact about the website rather than the software.

The developer is Enpass Technologies Inc., listed as Enpass Technologies Private Limited in the App Store. On Trustpilot the company holds 4.1 out of 5 across 70 reviews on a claimed profile — a modest sample next to the most-reviewed names in this category.

Features

The generator produces either random strings or pronounceable passphrases built on Diceware methodology against a 14,996-word list. Strength estimation runs through Zxcvbn, the open entropy-scoring algorithm, alongside Enpass’s own calculation for Diceware output, and the app reports whichever of the two scores is lower — a conservative choice rather than a flattering one.

A TOTP generator is built in, so second-factor codes for other sites live in the same app as the credentials. Breach monitoring checks passwords against Have I Been Pwned using the k-Anonymity model: only the first five characters of the password’s SHA-1 hash are sent, the full hash never leaves the device, and the service cannot determine which password was checked. A password health dashboard audits the vault for weak entries.

Sharing is the weak spot. Individual users share single items through a Pre-Shared Key, which means the recipient’s access is only as revocable as the key you handed them — there is no way to withdraw it afterward. Enpass points business customers at Hub-based Vault Sharing for precisely that reason. There is also no email-alias generation anywhere in the product.

Passkey support is unusually forward for the category, though it applies to third-party sites rather than to unlocking Enpass itself. Enpass generates, stores and syncs site passkeys, and was among the first managers to implement key parts of WebAuthn Level 3 before the W3C formalized its recommendation — the PRF extension, which lets a passkey derive encryption keys rather than only authenticate, plus Related Origin Requests, Conditional Create/Get and the Signal API.

Usability & Platforms

Native apps cover Windows, macOS, Linux (Ubuntu 22.04 and newer), iOS 15.7 and newer, and Android 9.0 and newer, with extensions for Chrome and Firefox and a Safari extension listed on the App Store. Apple Watch and Wear OS are supported as companions rather than as real clients — they display only the items you flag by hand for the watch. There is no official command-line client, which will matter to anyone scripting credential access.

The sync choice is the part that distinguishes the daily experience. You pick the storage, and it can be an account you already pay for, a NextCloud instance you run, a WebDAV endpoint, local Wi-Fi between your own devices, or nothing at all. That flexibility carries an obligation most cloud managers spare you: the durability of your vault is now your problem. If your cloud account is closed or your only device dies with no sync configured, there is no vendor copy to fall back on.

Third-party reception sits in more modest territory than the category’s most-reviewed names — 70 Trustpilot reviews at 4.1 is a small, decent sample rather than a strong signal in either direction.

Price & Value

The free tier is permanent rather than a trial: up to 25 items in one vault, with every sync option available on every platform. That is a real ceiling — 25 items goes quickly — but nothing expires and no feature is withheld.

Premium costs $1.99 a month billed annually, or $23.99 a year for one user, which is among the lowest prices in this category. Family normally runs $3.99 a month ($47.99 a year) for up to six people with family management, currently discounted 25% for the first year to $2.99 a month ($35.99 for that year, then $47.99 annually). With no vault storage to pay for on Enpass’s side, the pricing lines up with the architecture, and once someone outgrows the free plan the upgrade is a small decision.

Pros and Cons

Enpass never stores vault data on its own servers — the encrypted database goes to your Google Drive, Dropbox, iCloud, OneDrive, Box, NextCloud or WebDAV, or nowhere at all
Fully offline operation is supported, with peer-to-peer Wi-Fi sync over a local WebDAV server protected by a self-signed certificate and a time-based verification code
AES-256 via SQLCipher with PBKDF2-HMAC-SHA512 at 320,000 iterations and a unique random salt per database
Optional 32-byte keyfile from a cryptographically secure generator adds a possession factor on top of the Master Password
The 2025 DOM-based extension clickjacking vulnerability was patched in 6.11.6 the same month the research went public, ahead of several other major managers
Breach monitoring uses the k-Anonymity model — only the first five characters of a password's SHA-1 hash ever leave the device
Early WebAuthn Level 3 passkey support including the PRF extension, Related Origin Requests, Conditional Create/Get and the Signal API
Premium renews at $23.99/year, among the lowest in this category, on top of a permanent 25-item free tier

No account-level TOTP or hardware-key second factor for unlocking the vault — the Master Password, plus an optional keyfile most users never enable, is the whole gate
Closed source, with no public independent cryptographic audit or penetration-test report available to outside review
SOC 2 Type II and ISO 27001:2022 certify security processes, not the correctness of the cryptography or the client code
No recovery whatsoever on personal plans — lose the Master Password and the vault is unrecoverable by design
Item sharing between individual users relies on a manually distributed Pre-Shared Key with no way to revoke access afterward
PBKDF2 is not memory-hard, giving GPU-based cracking better leverage than a memory-hard derivation function would
No email-alias generation and no official command-line client
Backup durability shifts entirely to the user — there is no vendor-side copy of the vault to restore from

Our Rating

Security7.0/10
AES-256 with PBKDF2-HMAC-SHA512 at 320,000 iterations, zero-possession architecture that keeps vault data off Enpass's own servers entirely, and an optional keyfile as a second unlock factor. Held back by the absence of PBKDF2 memory-hardness and, more significantly, no account-level TOTP or hardware-key second factor for unlocking the vault itself
Privacy & Trust6.5/10
Zero-possession architecture removes an entire class of centralized-breach risk that even zero-knowledge competitors carry, and the one disclosed 2025 browser-extension vulnerability was patched the same month it went public. Closed source with no public independent cryptographic audit or pentest report — only process certifications (SOC 2 Type II, ISO 27001:2022) that verify compliance procedures, not code or cryptography
Features6.0/10
Built-in TOTP generator, k-Anonymity breach monitoring, password health auditing, and early WebAuthn Level 3 passkey support cover the essentials. Missing email aliasing, and the item-sharing model for individual users relies on a manually-distributed Pre-Shared Key rather than revocable access control
Usability & Platforms7.0/10
Native apps across Windows, macOS, Linux, iOS and Android plus Chrome and Firefox extensions, with the flexibility to sync through almost any cloud storage a user already has, sync locally over Wi-Fi, or skip syncing entirely. No official CLI client, and third-party reception sits in more modest territory than the category's most-reviewed names
Price & Value8.5/10
A free tier with no time limit up to 25 items, and a Premium renewal at $23.99/year — among the lowest prices in this category — make the paid tier an easy add once someone outgrows the free plan

Overall6.8/10

Security 30% · Privacy & Trust 25% · Features 20% · Usability 15% · Price 10%

See our rating methodology →