I've never really used a password manager and usually disable it whenever I set up a browser. I'm now thinking of finally using one across both Android and Windows.

I've been looking at Bitwarden and Google Password Manager, and both seem good. Google has impressed me with its ecosystem integration and compatibility so far, so I'm also considering sticking with it. I don't mind Google collecting some data, as complete privacy is difficult to achieve anyway, and I'm comfortable with the features it offers.

Which password manager would you recommend for someone starting out? Should I go with Google Password Manager for convenience or Bitwarden for more flexibility and features? If neither is the best option, are there any better alternatives?

My main requirement is to use the same password manager on both Android and Windows, with good syncing, autofill, and overall compatibility.

Also, do Google Password Manager and Bitwarden work well across different browsers, including Chrome, Edge, Brave, Firefox, and other popular browsers? I currently use Edge on both Android and Windows, but it has a few minor issues that affect my experience, so I might switch browsers in the future. I'd prefer a password manager that isn't tied to just one browser.

I'm open to both free and paid options.

I need a self-hosted password manager that is cross OS compatible (iOS 27, Ubuntu 26 for Firefox/Helium).

Good UI is must. I want to leave Bitwarden because it keeps getting worse with UI, lock session often. Slightly inconvenient compared to Chrome inbuilt pass manager.

I want something as sleek as Inbuilt Password manager of Browser. Or may be I will use Firefox sync 😂 as last option.

TIA the community, How is this product vetted for security - and how is the Author's credentials verified?

I mean, I am seeing many people recommending it.

• But there are no clear security audit reports on it, or it is not clearly visible. Which EU trust center vetted this? Sorry, I might have missed it.
• Maintained by one person, who committed 500,000+ (Previously this was 850k) lines alone within the last year. Other contributors are less than 100 lines of code committed.
• No clear indication of importing passkeys from other services.
• From my previous search on this product under password managers, people never asked or verified how it was audited. They just recommend it.
• UX seems workable, and workflow as well in initial testing. But again, this needs to be vetted.

This goes same for bramble, same behavior as the above points. So can i ask about this or have to take word about it de-facto?

I am not equipped nor capable to inspect their codebase at this moment.

Thanks fellow redditors.

Edit: This is not a post to undermine any of the product mentioned. but password manager is a security thing, and it should have proper contributors, security certifications, standards, code of conduct, clear and visible guidelines, detailed documentation and so on.

Здравствуйте я забыл пароль от своего iphone 6 и не могу разблокировать в током момент как я могу его прошить или в каком сайте я могу его прошить но есть одно но в мойом айфоне стоит айклауд и я забыл от него пароль и логин ещё я не хочу чтобы мой айфон при прошивке не взлетел с имени кто знает можете помочь

I’d love to hear your thoughts on Zoho Vault from those who have tried it or evaluated it as a password manager.

Zoho Vault offers a generous free plan and affordable paid plans. But pricing is only one part of choosing a password manager, and I’m interested in how it holds up in actual use.

A few things I’d love your perspective on:

• How does it compare with other password managers?
• How do you rate its security, reliability, and ease of use?
• How well does it work across devices and browsers?
• Does its free plan offer enough value, and are the paid plans competitive for the features provided?
• What features or improvements are missing?
• If you tried it and switched to another product, what made you switch?

Full disclosure: I work for Zoho. I’m looking for candid feedback from the community, not an opportunity to pitch the product. Critical feedback is just as welcome as positive feedback. Thank you!

I've been desperately trying to find alternative to Bitwarden for the pase few month every since their link to private equity, I've tried multiple options but there just doesn't seem to be any sane, focused choice at the moment?

• Bitwarden - Garbage app quality, slow product iteration, clunky experience, private equity, open source license contoversy
• 1Password - Questionable political ideology through financial support, lesser focus for individual user, beautiful app but clunky experience
• Proton Pass - Unverifiable background, questionable marketing for a privacy-focused company, heavy push on ecosystem so less focus on the core of password manager
• KeePass - ZERO consistent and polished app, especially for Windows and browser autofill (I do NOT want to use AutoType)
• Apple Passwords - Do I even need to describe it
• AliasVault - Too early in development, none of the clients are polished enough for me to take it seriously

Am I missing something or is there really no choice and I have to pick my poison? I've been very happy with Proton lately switching from Bitwarden, but the ecosystem binding is really bothering me.

I ran this because I kept seeing people complain about it and couldn't find anyone who'd actually tested it, so I wanted to see for myself. Did it all at the start of October. Made accounts on Codeberg, Hacker News, Todoist, Wikipedia and PythonAnywhere, changed the password once per manager per site, pasted the new password instead of using the generator, then checked if the vault ended up with the new one.

• 1Password: 5/5
• Bitwarden: 4/5, missed Wikipedia
• Proton Pass: 2/5, missed Codeberg, Wikipedia and PythonAnywhere

In all 4 misses there was no save or update prompt at all. Wikipedia's change form, where you verify first and then type the new one twice, beat everything except 1Password. Every time Proton Pass missed, it filled the old password on the next sign in and the site rejected it.

What surprised me: Codeberg's form is set up properly and Proton Pass still missed it. And Bitwarden's "Ask to update existing login" setting didn't kick in on Wikipedia.

It's a small test, just me, five sites, one run each, and these extensions update all the time so results might already be different.

If you change a password, copy the new one before you hit submit, then open the vault entry after and check the last edited time actually changed.

Full disclosure, I'm building a password change extension (Rekey) and tested it too. It got 4/5 and also missed Wikipedia. Full write-up and method here: https://getrekey.com/research/password-changed-vault-not-updated

I’ve been building LocalGateKeys, a password manager with no account and no server. Your vault lives on your device, encrypted with Argon2id and AES-256-GCM. Nothing gets uploaded.

What it does right now on Windows:

• Fills logins in Edge through a browser extension
• Fills login windows in Windows desktop apps
• Unlocks with your master password, Windows Hello or a local webcam check
• Gives you a recovery phrase in case you forget your master password
• Makes encrypted backups you can restore anywhere
• Imports from other password managers
• Two-factor (TOTP) codes
• Device sync. Sync runs over your home Wi-Fi (you pair with a QR code) or through encrypted files in a cloud folder you pick. The cloud provider only ever sees encrypted data.

Website: https://localgatekeys.app
Microsoft Store: https://apps.microsoft.com/detail/9PNWCNLQ6597
iPhone beta (TestFlight): https://testflight.apple.com/join/kuJPuSbx
Android: coming soon
Source: https://github.com/LocalGateKeys/LocalGateKeys

Hey everyone, I think a one-and-done list like this is long overdue for this subreddit. I tried to compile as much as I could into one post and am currently working on one for B2C. I hope you all could get some use out of it!
This is everything, and I mean EVERYTHING, you need to know about B2B password managers.

SUMMARY TABLE

1. BITWARDEN

• Price: Teams $4/user/mo, Enterprise $6/user/mo, billed annually, excl. tax. No seat minimum stated. Secrets Manager sold separately at $6 (Teams) / $12 (Enterprise) per user/mo.
• Deployment: cloud or full self-host. Docker (Linux/Windows, standard, manual, offline, Lite), Helm/Kubernetes, AWS EKS, Azure AKS, OpenShift.
• Data residency: US or EU. Cloud runs on Microsoft Azure.
• SSO: Enterprise plan only. SAML 2.0 and OpenID Connect are both exclusive to the Enterprise organization plan, so Teams at $4/user/mo has no SSO at all.
• Directory sync / SCIM: SCIM and Directory Connector on both Teams and Enterprise.
• Audit log: event logs on Teams and Enterprise.
• Certifications: SOC 2 Type II, SOC 3 (2026 report published), ISO 27001. HIPAA compliance with annual third-party audit (a claim, not a certification). GDPR plus EU SCCs, CCPA/CPRA, Data Privacy Framework. FedRAMP not held, "actively pursuing Class D (High)". No certificate numbers, issuing bodies or validity dates published.
• Machine secrets: API on both tiers. Separate Secrets Manager product.
• MSP / multi-tenant: yes. Provider Portal, one Organization plus vault per client, role-based access per client, SCIM and Directory Connector across clients, no seat minimums, NFR licences for internal use at volume.
• Breach history: none known.

2. 1PASSWORD

• Price: Teams Starter Pack $2.49/user/mo billed yearly, or $2.99/user/mo monthly. 10 users minimum, 20 users maximum. Business $8.99/user/mo billed yearly, or $10.99/user/mo monthly, 1 user minimum. 14-day free trial, no card required.
• Deployment: cloud only. No self-hosting.
• Data residency: chosen at signup: US (1password.com), Canada (1password.ca), EU (1password.eu). Region sets billing currency and hosting location. Cannot be switched. Moving means creating a new account and manually copying every vault, and files cannot be copied across regions.
• SSO: Okta, Entra ID, OneLogin, Duo listed on Business.
• Directory sync / SCIM: provisioning for users and groups via Azure AD, Google Workspace, Okta, OneLogin, Rippling, JumpCloud. The term SCIM is not used on the pricing page.
• RBAC: custom policies and access monitoring listed. Tier allocation not visible on the page.
• Audit log: custom business reports covering usage and account activity.
• Certifications: ISO/IEC 27001:2022, 27017:2015, 27018:2019, 27701:2019, SOC 2 Type 2. Annual penetration tests, reports on the Trust Center. HackerOne bug bounty. No certificate numbers or validity dates on the assessments page. Certificates themselves are published at 1password.com/resources/iso27001.
• Machine secrets: CLI, SDKs, CI/CD and infrastructure-as-code integrations. A REST API is not described on the pricing page.
• MSP / multi-tenant: yes. Enterprise Password Manager MSP Edition, launched in beta May 2024. Single MSP console to open and configure client instances, each opening in its own browser tab. Technician permissions set through groups and scoped to client-level actions. Existing direct or reseller client accounts can be migrated into the MSP account. Currently provisions Business plans only, with other plans under evaluation. Consumption-based per-user billing, no licence minimums, consolidated invoice per period, exportable to CSV, per-client seat usage and forecast. 14-day free trial, and clients onboarded during it are free. No white-label or co-branding mentioned. No PSA or RMM integration mentioned.
• Breach history: 29 September 2023, suspicious activity detected in 1Password's own Okta instance (used for employee-facing apps), traced to the Okta support system breach. Confirmed 20 and 25 October 2023. 1Password states no user data was accessed and no other sensitive systems were compromised.

3. PASSWORK

• Price: Standard $3.00/user/mo, Advanced $4.50/user/mo, both billed annually. A lifetime one-time payment also exists, priced by quote, which they put at up to 50% less than long-term subscription. 1-month free trial, no free version.
• Deployment: self-hosted. PHP plus MongoDB on Windows or Linux, with or without Docker.
• Apps: native desktop apps for Windows, macOS and Linux since February 2026, alongside browser extensions and mobile.
• Data residency: wherever you host it. Vendor is Passwork Europe S.L., Barcelona.
• SSO: SAML SSO. On the Advanced tier alongside LDAP mapping, clustering and failover support.
• Directory sync / SCIM: LDAP, Active Directory, Entra ID sync.
• RBAC: role-based access control with custom roles, vault/folder/group permissions, predefined vault admins.
• Audit log: per-entry action history. Forwards to Windows Event Log, Syslog and SIEM.
• Certifications: ISO/IEC 27001:2022. Certificate CERT-001724, issued by MSECB, valid to 6 May 2028. HackerOne tested. GDPR, NIS2 and ENS alignment.
• Machine secrets: REST API, Python connector, CLI, Docker/Kubernetes.
• MSP / multi-tenant: yes. Partner/reseller model, wholesale per-user pricing with volume tiers, white-label or co-branded, custom domain per client, isolated database and audit trail per client, MSP portal with one-click provisioning, PSA/RMM integration via REST API.
• Security dashboard: flags weak passwords, credentials not rotated in 180+ days, and credentials accessed by users whose access has since been revoked.
• Breach history: none known.

4. KEEPER

• Price: Business Starter $2/user/mo (5 to 10 seats). Business $4/user/mo (min 10). Enterprise $6/user/mo (min 10). Privileged Access Manager min 5 seats, quote only.
• Deployment: cloud.
• Data residency: 6 regions: US, Europe, Australia, US GovCloud, Canada, Japan.
• SSO: SSO Connect, federated login via Entra ID, Okta, Google Workspace.
• Directory sync / SCIM: SCIM provisioning on Enterprise. AD/LDAP sync not mentioned on the enterprise page.
• RBAC: granular role-based enforcement policies, delegated administration, role-based sharing policies.
• Audit log: reporting and alerts on 200+ event types. Pushes to SIEMs including Splunk, LogRhythm, Microsoft Sentinel. Compliance Reports are a paid add-on.
• Certifications: FedRAMP High, GovRAMP High, ISO 27001/27017/27018, SOC 2, FIPS 140-3, HIPAA, FINRA, ITAR. Certificate numbers and dates aren’t published.
• Machine secrets: Commander SDK, Keeper Secrets Manager SDKs, APIs, command line.
• MSP / multi-tenant: yes. Password Manager for MSPs, Privileged Access Manager for MSPs, MSP Partner Program.
• Breach history: no breach of Keeper systems known. December 2017, Google researcher Tavis Ormandy disclosed a flaw in a Keeper browser add-on that Microsoft had bundled with Windows 10, which let any malicious website steal passwords. Keeper patched within 24 hours. A nearly identical flaw had been reported to Keeper in 2016. Keeper then sued Ars Technica and reporter Dan Goodin for defamation, Ars filed an anti-SLAPP countersuit, and the case was dismissed on 30 March 2018.

5. DASHLANE

• Price: Credential Protection $4.00/user/mo (min 2 users). Password Management $8.00/user/mo (min 2 users). Enterprise custom, unlimited users.
• Deployment: cloud only.
• Data residency: EU by default. Professional teams can instead be placed in Dashlane's US East AWS region. Covers encrypted vault data, vault backups, encrypted shared items and encrypted audit logs. Choosing US requires contacting sales before the team is created, and self-serve signup offers no choice. Region cannot be changed after team creation and there is no migration path. Caveat: enabling "Allow sharing outside the company" removes US residency status for shared data. Dashlane's own article does not name a specific EU location, so "Dublin / eu-west-1" is not supported by their documentation.
• SSO: SAML login via identity provider. Featured integrations: Google Workspace, Entra ID, Okta, Duo.
• Directory sync / SCIM: automated user provisioning and offboarding. SCIM not named on the business page.
• Audit log: detailed activity logs and reporting on policy compliance and credential usage. I couldn’t confirm export format, SIEM forwarding or retention.
• Certifications: ISO/IEC 27001:2022. Dashlane's own post of 22 January 2024 claims it was the first major credential manager to meet the 2022 revision. No certificate number, auditor or date published, and the post points to trust.dashlane.com.
• MSP / multi-tenant: reseller programme only, no MSP product. The Global Partner Program (reseller programme document dated July 2025) runs a points-based tiered model across Core, Preferred and Strategic tiers, with rising incentives, NFR licences, a partner portal, a dedicated channel sales manager at Strategic, and quarterly business reviews. No multi-tenant client management, no per-client separation and no MSP console are described anywhere in the programme document.
• Breach history: May to June 2026. Attacker brute-forced the API endpoints used for device registration, submitting every possible numeric combination before short-lived 2FA tokens expired, and registered new devices on some accounts. Fewer than 20 personal-plan accounts accessed. Copies of encrypted vaults were downloaded. They remain encrypted and need the user's master password, so weak master passwords are exposed to offline cracking. Dashlane says it found no evidence its internal systems were compromised. Acknowledged 31 May 2026, advisory updated 4 June 2026. Business customers not mentioned in coverage.

6. NORDPASS

• Price (per user/mo): 2-year: Teams $1.79, Business $3.59, Enterprise $5.39. 1-year: $1.99 / $3.99 / $5.99. Monthly: $2.49 / $5.99 / $7.99. Teams is a 10-user pack. Business and Enterprise from 5 seats.
• Deployment: cloud only. No self-hosting mentioned on the business plans page.
• Data residency: US or EU data centre, chosen at purchase or at business free-trial signup. Cannot be migrated later. Moving means exporting items and creating a new organisation in the other data centre with support's help. Accounts created without following the invitation email land in the US data centre and must be deleted and re-invited before they can join an EU organisation. No documented region choice for personal accounts. Nord Security is Lithuania-based (EU).
• SSO: Teams includes SSO with Google Workspace. Enterprise adds Entra ID, MS ADFS, Okta.
• Directory sync / SCIM: Enterprise: user and group provisioning via Entra ID and Okta. The terms SCIM and directory sync are not used.
• RBAC: role-based policies on Business, RBAC on Enterprise.
• Audit log: Activity Log and Activity Log API listed.
• Certifications: ISO/IEC 27001:2017 for NordPass Business, per NordPass's own blog dated 24 October 2024. Note this is the older revision, and 27001:2022 is current. No auditor, certificate number or certification date published.
• Machine secrets: Activity Log API only, so far as the page shows.
• MSP / multi-tenant: yes. Multi-tenant MSP Admin Panel for managing client environments from one place, with a separate MSP Panel for the partner's own organisation and a Business Admin Panel for onboarded clients. Consumption-based pricing. NFR licences for internal use, 24/7 technical support, 14-day client trials. Distribution through Ingram, Pax8, Exertis Cloud, Bluechip and Gridheart. Integration categories listed include IAM, user and group provisioning, professional services automation, automated security and compliance, and SIEM. No named PSA or RMM products, RMM not mentioned at all. No white-label mentioned. Per-client isolation mechanism not explained.
• Breach history: no NordPass breach found.

7. LASTPASS

• Price: Teams $4/user/mo billed annually, capped at 50 users. Business $7/user/mo billed annually, no cap. A Business Max tier exists with unlimited SSO apps.
• Deployment: cloud only.
• Data residency: 6 regions: United States, Europe, Australia, Singapore, India, Canada. LastPass's Technical and Organizational Measures document describes them as "redundant, active-passive cloud regions" and says the region is chosen by the customer's data residency preference at account creation. No specific European country or city named. This is the widest regional choice of any of them.
• SSO: not included on Teams. Business limited to 3 apps. Business Max unlimited.
• Directory sync / SCIM: AD sync on Business (Microsoft Active Directory among others), not on Teams. SCIM not mentioned.
• Audit log: basic reporting on Teams, advanced on Business.
• Certifications: SOC 2 Type II, SOC 3, ISO 27001, BSI C5. LastPass’s own compliance page names only the first 3 and gives no revision years, dates or certificate numbers. A third-party directory also lists ISO 27701.
• Machine secrets: API not mentioned on the pricing page.
• MSP / multi-tenant: separate partner offering, not a listed plan.
• Breach history: August to December 2022. 8 to 11 Aug 2022: developer laptop compromised, 14 source code repositories, technical documentation and an encrypted SSE-C backup key taken. 12 Aug 2022: a DevOps engineer's personal computer compromised via an unpatched Plex server, and a keylogger captured the engineer's master password. 20 Aug: attacker extracted the engineer's Employee Business vault containing keys. 20 Aug to 16 Sept: attacker obtained the user database and several vault backups. 25 Aug: LastPass stated no evidence of customer data access. 15 Sept: LastPass and Mandiant said activity was limited to a 4-day window in August, and the ICO later said LastPass was unable to determine the extent. 15 and 22 Oct: GuardDuty alerts fired, SOC not informed until 2 Nov. 30 Nov: reported to the ICO. 15 Dec: AWS confirmed the attacker had downloaded a copy of the backup database. Taken in the clear: names, email addresses, billing addresses, partial card numbers, website URLs. Vaults taken encrypted under users' master passwords. ICO found over 1 million UK data subjects affected.

8. PSONO

• Price: 4 tiers across 2 deployment models.
  • On-premise, Community Edition: $0, open source, unlimited users, basic support.
  • On-premise, Enterprise Edition free: $0 up to 10 users, complete feature set.
  • On-premise, Enterprise Edition paid: $3.00 per user per month, billed annually, minimum 25 users. Extended support optional.
  • SaaS, Community: $0, hosted free of charge, hosting and updates included, basic support.
  • SaaS, Business: $3.50 per user per month, billed annually, minimum 25 users. Extended support optional.
  • Note the gap between 10 free users and the 25-user paid minimum: a team of 15 pays for 25 seats.
• Deployment: both. Self-hosted server or Psono-hosted SaaS.
• Data residency: vendor is esaqa GmbH, Germany. I couldn’t find SaaS hosting region. Psono’s entity-model page covers datastores, secrets, shares and permissions, and says nothing about physical hosting location. Self-hosted deployments sit wherever the customer puts them.
• SSO: on-premise EE lists LDAP, SAML and OIDC. SaaS Business lists SAML and OIDC only, with no LDAP. Both free-up-to-10 and paid tiers carry SSO, so Psono is the only vendor here giving SSO away at no cost.
• Directory sync / SCIM: LDAP on self-hosted EE only.
• RBAC: policies and compliance enforcement listed on EE and SaaS Business.
• Audit log: audit logging on EE and SaaS Business, including the free-up-to-10 tier. Absent from Community Edition.
• Certifications: ISO 27001, confirmed via the esaqa GmbH trust centre at confirmed via the esaqa, announced 2 September 2025. Revision year, certificate number, issuing body and expiry are not published in the announcement.
• Gateway: SSH, RDP and VNC gateway included on EE and SaaS Business. No other vendor here offers session gateway access, which puts Psono closer to a PAM tool than a password manager at the paid tier.
• MSP / multi-tenant: no published MSP or partner programme found. Self-hosting means an MSP could stand up a separate instance per client, but that is a workaround the customer builds, not a vendor product. No MSP console, no consolidated billing, no partner tiers, no NFR licences.
• Breach history: none found.

9. PASSBOLT

• Price: Community free, self-hosted only, unlimited users, no enterprise features. Business/Pro €4.50 per user/mo ($4.90), 10-user minimum, discounts negotiable above 100 users, can be cloud-hosted. Enterprise custom quote, adds SLA, priority support, disaster recovery consulting, migration and hosting options.
• Deployment: self-hosted (Docker, Debian/Ubuntu, CentOS, Raspberry Pi) or cloud-hosted on EU servers.
• Data residency: EU-located servers for the hosted option. Vendor based in Luxembourg.
• SSO: Business and above: Entra ID, OpenID Connect, Ping One, Google Workspace.
• Directory sync / SCIM: LDAP/AD/SCIM on Business and above, for synchronisation and provisioning rather than authentication.
• Audit log: Business and above. Immutable log of credential events including who accessed a password, when, and from which device and IP. Not in Community.
• Certifications: SOC 2 Type II, first audited by Johanson Group LLP, completed February 2022, around 120 control tests, report available to customers under NDA. Renewed since, so the attestation is current. No ISO 27001, only stated groundwork toward 27001 and 27017. Also holds the ECSO "Security Made in Europe" label and the Luxembourg chamber of commerce "Made in Luxembourg" label. 6 Cure53 security audits during 2021 (audits, not certifications).
• Machine secrets: REST API confirmed. Operates over HTTPS, processes JSON payloads, language and framework agnostic.
• MSP / multi-tenant: yes. Dedicated instance per client, or multi-tenant (isolation mechanism not explained). Free admin seat per client. Partners buy at a tiered discount and set their own retail, keeping the margin plus 100% of hosting, implementation and support revenue. Commission recurs on renewals and grows with client usage. Free internal-use subscription, consolidated quarterly or annual billing, deal registration, dedicated partner manager at higher tiers. Partners handle 1st and 2nd line support, and Passbolt engineering handles 3rd line. White-label not yet available, with a co-branded offering and white-label plugin described as coming soon. Eligibility bar: service providers must pass a security review and hold ISO 27001 or at minimum SOC 2 Type II, which is the strictest partner requirement of any of them.
• Breach history: no breach of Passbolt systems found. Published CVEs include CVE-2024-33669 (browser extension), CVE-2024-33670 (API), CVE-2017-1000442. Open source since 2016.

10. KEEPASSXC

• Price: free. Released under GPLv3. Donation-funded.
• Deployment: local encrypted database file on the user's own device. No server component.
• Data residency: wherever the user puts the file.
• SSO: none.
• Directory sync / SCIM: none.
• RBAC: none.
• Audit log: none.
• Certifications: ANSSI Security Visa ANSSI-CSPN-2025/16, issued 17 November 2025 by the French National Cybersecurity Agency, valid to 17 November 2028. Scope is version 2.7.9 on Windows 10 only, so it certifies a specific build rather than an organisation's security management. Separately, an application security review by consultant Zaur Molotnikov on version 2.7.4, completed 19 January 2023. No organisational certification (no ISO 27001, no SOC 2), which is expected for a volunteer-maintained project with no company behind it.
• Machine secrets: CLI exists (keepassxc-cli). CI/CD integration not a product feature.
• MSP / multi-tenant: none.
• Breach history: no breach possible at vendor level (no servers).
• Note: sync is not built in. Teams place the database in a shared folder (Dropbox, Nextcloud) themselves. Maintained by the KeePassXC Team.

Notes:
On MSPs: 8 of the 10 have something for MSPs and they are not the same thing. Passwork, Bitwarden, Keeper, 1Password, NordPass and Passbolt all run real multi-tenant consoles. Dashlane has a reseller programme with no multi-tenancy at all, which is a meaningful gap for anyone shopping as an MSP. Psono has nothing published. KeePassXC has nothing by design. White-label separates the field further: Passwork offers white-label or co-branded today, Passbolt lists it as coming soon, and 1Password, NordPass and Bitwarden do not mention it. PSA/RMM integration is thinner than the marketing suggests, with Passwork and Keeper naming it and 1Password and NordPass naming no specific products.
On data residency (for cloud hosting): region lock-in is near-universal and nobody advertises it. 1Password, Dashlane and NordPass all make the region permanent at signup with no migration path, so a company that picks wrong rebuilds from an export. LastPass offers 6 regions, the most in the table.

Rapid fire: which password manager should your business use?
For the most affordable per-seat price with no seat cap → Passwork
For a team of 10 to 20 that wants it to just work → 1Password Teams Starter
For open source you can run on your own Kubernetes → Bitwarden
For US federal, defence or anything touching GovCloud → Keeper
For an MSP that needs its own branding on the product → Passwork
For under 10 users who still need SSO and audit logs → Psono
For a separate secrets manager for CI/CD alongside the human vault → Bitwarden
For credential access and SSH, RDP or VNC sessions in one tool → Psono
For EU compliance-ready audit logs like NIS2 and GDPR → Passwork
For open source with a current SOC 2 and EU hosting → Passbolt
For the widest choice of where your data physically sits → LastPass
For a self-hosted vault with a company behind it and audit logs your SIEM can read → Passwork
For never letting a vendor hold your vault at all → KeePassXC
For a company that just needs SSO on a budget and has 5 seats → NordPass Business
For SAML SSO without jumping to an enterprise tier → Passwork
For a 2-person operation that wants dark-web monitoring built in → Dashlane

Aaaaand we’re done! This took way longer than I’d like to admit haha.

I want to know if there's anyone using it.

It is made by well-known Tether company but the development seems to be paused for a while, also can someone explain what blind peering is?

目前有没有比较好的帐号密码管理工具呢？

我的场景是有很多个帐号 每个帐号对应不同的手机

而有些手机关联了很多帐号

我需要可以清晰查看关系图

Question about Form filling / Save All Entered Data(SAED) features of Password Managers:

Do any have this besides LastPass, for more than passwords / credit card info ?

Really miss this feature. Handy for filling in medical forms, applications, complaints, etc. Amazing time saver for people who must fill out forms a lot, like Social Workers, in healthcare...

I think LastPass still has it, but it became buggy and there's its reputation for the way its dealt with security issues...

https://youtube.com

As the title says, I'm very paranoid about storing my passwords in any app coz I'm worried what if they get breached, or keep a copy of or sell my data to other companies. Don't insult me for this please!

This is the criteria:

• I should be able to sync across devices safely.
• Possibly no data breaches in the past or shady partnerships.
• It has the feature to suggest strong passwords( optional but strongly want this )
• It has backup plan if something happens to the app or my device( optional but strongly needed )
• It's FOSS, or at least free without corporate slop.

Thanks in advance.

I'm very paranoid about storing my passwords in any app on my mobile phone(android) I'm worried what if they get breached, or keep a copy of or sell my data to other companies. I have few criteria's. please don't judge

• Possibly no data breaches for that mobile app in the past or shady partnerships.
• It has the feature to suggest strong passwords( optional but strongly want this )
• It has backup plan if something happens to the app or my device( optional but strongly needed )
• It's free to use completely
• It runs on my device(recommended, so tht even if any breach happens the data is safe in my device)

I have seen ppl suggesting bitwarden but i heard it had a lot of breach so i am not willing to use that.

Thanks in advance.

After digging into this a little.. it appears 1Password has raised the bar

Well done

Apparently "all the agents" are coming. Came across this for Muse

1Password for Muse

12 password managers, from Bitwarden and KeePassXC to the ones already on your phone have been "vibe voted" by 10 leading AI models. Almost all of them have agreed that Bitwrden & Proton Pass are the best options.

1Password seems to have been "demoted" due to its pricing.

KeePassXC being third shows that being open-source helps building trust (+ no fear of being discontinued). And that's very important with regards to tech that keeps all my "keys".

Personally - I switched to bitwarden ever since 1Password changed to a subscription model. I've been a happy user since then.

What's your password manager and do you agree with Bitwarden, Proton Pass & KeePassXC being the top 3 options?

p.s. here's the full voting session + comments from the models https://vibevoted.com/s/password-managers-2026-oct

I have Bitwarden and i am testing Proton Pass but does not support folders in free version so my passwords are messy and not organized.

Any free alternative that supports folders and unlimited passwords ?

Thanks.

Looking into getting a password manager but there are so many options out there. Bitwarden, 1Password, Dashlane, KeePass... it's overwhelming.

Which one do you personally use?

· Is the free version good enough, or is it worth paying for premium?

· How is the autofill experience on mobile (Android)?

· Any privacy or security concerns I should know about?

I'm not a tech expert, just looking for something secure, easy to set up, and not too expensive. What are your recommendations? Thanks!

Did you guys tried apple passwords on the windows iCloud app?
Mine is just not working and I’m wondering wether you guys had same experience?

I have noticed that both Edge and Vivaldi have a feature in their password manager features whereby one can force biometric authentication (via Windows Hello) before a password can be entered to a website.

Does this swing the balance back towards browser based password managers ?

Since you guys just asked me in my last 2 days post, I decided to give me your best recovery method for password manager and authenticator

Hi,

habe mir gerade Proton Pass (Free-Version) geholt, weil ich eigentlich mal alle meine Passwörter an einem Ort haben wollte. Ich muss in letzter Zeit nämlich ständig auf „Passwort vergessen“ klicken. xD

Aber irgendwie bin ich gerade etwas verwirrt und hinterfrage den Sinn von Passwortmanagern gerade ein bisschen.

Für Proton Pass habe ich ein eigenes Passwort und auch 2FA aktiviert. Alles cool soweit.

Wenn ich eingeloggt bin, sehe ich links meinen Tresor mit allen Seiten, die ich zum Testen angelegt habe. Das Problem ist: Ich kann einfach jede Seite anklicken, rechts auf das Auge drücken und schon wird mir das Passwort im Klartext angezeigt.

Da könnte doch jeder, der sich irgendwie in meinen Account hackt, einfach alle meine Passwörter ansehen. xD

WTF, warum? 😂

Okay, man könnte jetzt argumentieren, dass sich da nicht so schnell jemand reinhackt. Aber bei der Chrome-Erweiterung ist es doch genauso. Einfach eine Seite öffnen, schauen, ob Proton Pass einen Eintrag dafür hat, aufs Auge klicken und schon wird das Passwort im Klartext angezeigt.

Das heißt doch eigentlich, dass man die Chrome-Erweiterung niemals auf einem PC verwenden sollte, den auch andere Personen nutzen oder auf den andere Zugriff haben könnten.

Da wäre es doch fast schon fahrlässig, Proton Pass im Büro zu nutzen, wenn mehrere Personen Zugriff auf denselben Rechner haben könnten.

Da frage ich mich gerade ernsthaft, ob es nicht sogar sicherer wäre, meine Passwörter einfach in einer Textdatei auf dem Desktop zu speichern und vor und nach jedes Passwort drei Buchstaben zu schreiben, die ich beim Kopieren wieder weglasse. Welche Buchstaben das sind, weiß schließlich nur ich. 😂

Was übersehe ich hier? Wo liegt der eigentliche Sicherheitsvorteil eines Passwortmanagers, wenn die gespeicherten Passwörter jederzeit so einfach im Klartext angezeigt werden können?

I made a post about customer service because it had been a week without a response, I had even tried mod mail, so this was a last resort. They immediately replied, then immediately deleted the post and messaged me directly instead. Things got rolling after that. But I've seen this happen to others as well. Left a bad taste in my mouth. Is this common for any password manager sub run by the company?

EDIT: for clarity, not this sub, the sub for their product. I'm posting here because they censor posts. Searching in here looks like others have experienced the same.