Start with Identity
Subscribe
Tools

Top 7 Open-Source Password Managers

The best open-source password managers in 2026, from Bitwarden and Vaultwarden to KeePassXC, Passbolt, Psono, Padloc, and Proton Pass, compared on licensing, self-hosting, and team credential sharing.

By SWI Community TeamUpdated 2026-08-2914 min read
Key takeaways
  • Open-source password managers let you audit the cryptography and, in most cases, self-host the vault, which matters because a password manager is the single most concentrated credential store an organization owns.
  • The leading open-source options in 2026 are Bitwarden, Vaultwarden, KeePassXC, Passbolt, Psono, Padloc, and Proton Pass.
  • Choose by operating model: Bitwarden or Proton Pass for a managed service with open clients, Vaultwarden or Passbolt for lightweight self-hosting, KeePassXC for a fully offline vault file, and Passbolt or Psono when team credential sharing and audit are the requirement.

A password manager is the most concentrated credential store an organization owns, which makes the ability to read its source, audit its cryptography, and in most cases run it yourself more than an ideological preference. Open-source password managers give you all three. The category has also matured well past "free alternative": Bitwarden and Proton Pass compete directly with commercial suites, Passbolt is built specifically for team credential sharing, and KeePassXC remains the reference for people who want no network dependency at all.

Licensing is where this category gets misread, so this guide states it precisely for each tool. "Open source" covers everything from GPL clients with an AGPL server to community reimplementations with no vendor behind them, and the differences matter for compliance and for who fixes a vulnerability. For the wider discipline see our secrets management fundamentals, which covers the application-credential side of the same problem, and the password management vendor category for commercial options.

Evaluation Criteria

We assessed each tool against the following dimensions:

  • License, and whether it is OSI-approved or source-available
  • Deployment, managed service, self-hosted, or local vault file
  • Team features, sharing, groups, role separation, and audit trail
  • Cryptography and audits, published design and third-party review
  • Passkey and MFA support, including what the vault itself is protected by
  • Operational burden, what self-hosting actually costs in effort
  • Ecosystem, clients, browser support, and integrations

The Top 7 Open-Source Password Managers

1. Bitwarden

Best For: Organizations that want a credible commercial-grade password manager with source they can read and the option to self-host.

Overview

Bitwarden is the most complete open-source option and the one most likely to survive a procurement review. Clients across browser, desktop, mobile, and CLI are GPL-3.0; the server is AGPL-3.0. It offers a managed cloud, a self-hosted deployment, organization-level sharing with collections and groups, and enterprise features including SSO integration and policy enforcement. Passkey storage and use are supported, and the company publishes third-party security assessments.

Key Features

  • GPL-3.0 clients and AGPL-3.0 server, with a self-hostable deployment
  • Organizations, collections, and groups for team credential sharing
  • Enterprise SSO integration, policy enforcement, and event logs
  • Passkey storage and use, plus TOTP generation
  • Published third-party security audits

License GPL-3.0 (clients) and AGPL-3.0 (server). Some enterprise features in the server repository fall under the separate Bitwarden License and need a commercial agreement for production use.

Pros

  • The most complete feature set in the open-source category
  • Managed and self-hosted options from the same codebase
  • Real enterprise controls, not just a personal vault

Cons

  • The license split between AGPL and the Bitwarden License needs reading before you deploy
  • Self-hosting the official server is resource-hungry compared with Vaultwarden
  • Some capabilities are gated behind paid tiers

2. Vaultwarden

Best For: Small teams and home labs self-hosting on modest hardware, using the official Bitwarden clients.

Overview

Vaultwarden is an unofficial reimplementation of the Bitwarden server API in Rust, relicensed from GPLv3 to AGPLv3 to match the upstream server. It speaks the same API, so official Bitwarden clients work against it unchanged, and it runs comfortably in a container on hardware where the official server would struggle. It is community-maintained with no company behind it, which is the trade you are making.

Key Features

  • Bitwarden-compatible API, works with official clients
  • Very low resource footprint, single container deployment
  • Organizations and sharing without a paid tier
  • Active community maintenance and frequent releases

License AGPL-3.0, relicensed from GPLv3 to close commercial-use gaps.

Pros

  • Runs on almost anything, which makes self-hosting genuinely accessible
  • Unlocks organization features without a subscription
  • Uses the mature, audited Bitwarden clients

Cons

  • No vendor, no SLA, and no compliance certifications
  • You own patching for an internet-facing credential store
  • Not affiliated with Bitwarden, so upstream API changes are a maintenance risk

3. KeePassXC

Best For: Individuals and teams that want a vault file with no server, no account, and no network dependency.

Overview

KeePassXC is a community fork of KeePassX in the KeePass lineage, storing credentials in a local encrypted database file. There is no service to breach because there is no service. Sync, if you want it, is whatever file sync you already trust. It supports hardware key protection via YubiKey challenge-response, browser integration, and passkey storage in recent versions.

Key Features

  • Local KDBX vault file, no account and no cloud
  • YubiKey and hardware token support for database unlocking
  • Browser integration, TOTP, and SSH agent integration
  • Cross-platform desktop clients, with mobile handled by compatible apps

License GPL-2.0 or later (with portions GPL-3.0).

Pros

  • The smallest attack surface in the category: no server to compromise
  • Complete control of where the vault file lives
  • Mature, widely audited format with many compatible clients

Cons

  • Sharing and team management are do-it-yourself
  • Sync is your problem, including conflict resolution
  • No central policy, provisioning, or audit for an organization

4. Passbolt

Best For: Teams whose actual requirement is sharing credentials safely, with a record of who accessed what.

Overview

Passbolt is built around team credential sharing rather than personal vaults. It uses OpenPGP for end-to-end encryption, models permissions per credential and per group, and produces an audit trail of access. Self-hosted community edition is AGPL; a paid cloud and enterprise edition add directory sync, SSO, and reporting. For an organization trying to kill the shared spreadsheet of infrastructure passwords, this is the shape that fits.

Key Features

  • OpenPGP-based end-to-end encryption
  • Per-credential and per-group permission model
  • Access audit trail, which most personal-vault tools lack
  • LDAP and directory sync plus SSO in paid editions
  • Browser extension and CLI

License AGPL-3.0 for the community edition; enterprise features are commercially licensed.

Pros

  • Sharing and permissions are first-class rather than bolted on
  • Audit trail supports the access-review evidence auditors ask for
  • Straightforward self-hosting story

Cons

  • OpenPGP key handling adds onboarding friction for non-technical users
  • Directory sync, SSO, and reporting sit in paid editions
  • Smaller ecosystem than Bitwarden

5. Psono

Best For: Organizations that want self-hosted credential management with granular sharing and enterprise integration.

Overview

Psono is a self-hosted password manager aimed at teams, with client-side encryption, granular sharing, and an API for automation. The community edition is open source; enterprise features including LDAP and SAML integration, and management of the fleet, sit in the paid edition. It is less known than Bitwarden or Passbolt and worth a look specifically when you need API-driven credential access alongside human use.

Key Features

  • Client-side encryption with self-hosted server
  • Granular sharing, groups, and inheritance
  • REST API for automation and scripted access
  • LDAP and SAML integration in the enterprise edition
  • Browser extensions and CLI

License Open source community edition (server under a mix of Apache 2.0 components); enterprise features are commercially licensed.

Pros

  • Strong API story for automated credential retrieval
  • Granular sharing model suited to larger teams
  • Full self-hosting with no dependency on a vendor service

Cons

  • Smaller community than the leading options
  • Feature split between community and enterprise is significant
  • Documentation and ecosystem are thinner

6. Padloc

Best For: Small teams that want a clean, modern, self-hostable vault without enterprise complexity.

Overview

Padloc is a lightweight open-source password manager with end-to-end encryption, a simple organization model, and both hosted and self-hosted options. It is deliberately less feature-dense than Bitwarden, which is the point: it is approachable for teams that would otherwise not deploy a manager at all.

Key Features

  • End-to-end encrypted vaults with a simple sharing model
  • Self-hosted or hosted deployment
  • Cross-platform apps and browser extension
  • Straightforward organization and team vaults

License Open source (GPL-3.0).

Pros

  • Simple enough that adoption is realistic in small teams
  • Self-hosting is uncomplicated
  • Clean, modern interface

Cons

  • Fewer enterprise controls than Bitwarden or Passbolt
  • Smaller community and slower feature cadence
  • Limited directory integration

7. Proton Pass

Best For: Individuals and teams already in the Proton ecosystem who want open clients with a managed service.

Overview

Proton Pass is the password manager in Proton's privacy-focused suite, with open-source clients and end-to-end encryption. It supports passkeys, email aliasing through Proton's hide-my-email functionality, and integrates with the rest of the Proton account. It is a managed service rather than a self-hosting option, so the open-source element is client transparency rather than infrastructure control.

Key Features

  • Open-source clients with end-to-end encryption
  • Passkey support and integrated email aliasing
  • Swiss jurisdiction and a privacy-oriented operating model
  • Bundled with the wider Proton suite

License Open-source clients (GPL-3.0); the service itself is operated by Proton.

Pros

  • Genuinely good user experience with open clients
  • Email aliasing meaningfully reduces credential-stuffing exposure
  • Strong privacy positioning and jurisdiction

Cons

  • No self-hosting option, so infrastructure control is not on the table
  • Best value comes from committing to the wider Proton bundle
  • Team and enterprise controls are lighter than Bitwarden's

How to choose

Three questions settle most decisions.

Do you need to self-host? If yes, the real question is whether you can operate a credential store as tier-zero infrastructure with tested backups and prompt patching. Vaultwarden and Passbolt are the lightest paths; the official Bitwarden server is heavier but carries a vendor. If you cannot commit to that, a managed service is the safer answer even though it feels less controlled.

Is the problem personal vaults or team sharing? These are different products. KeePassXC and Padloc solve the first well. Passbolt and Psono are built for the second, with the permission model and audit trail that make access certification possible. Bitwarden covers both.

What protects the vault itself? Everything in this list is only as strong as the credential guarding it. Enforce phishing-resistant MFA on the vault account, prefer hardware key protection where the tool supports it, and treat the recovery path as the real attack surface, because it is.

One warning worth carrying from 2026: password managers are increasingly passkey custodians too. Unit 42 demonstrated in August 2026 that synced passkey private keys could be recovered from a browser credential manager on a compromised Windows endpoint, and the sync secret involved had no rotation mechanism. That does not argue against passkeys, but it does argue for keeping administrator and break-glass credentials on device-bound hardware rather than in any synced vault. See passkeys had a hard month.

The open-source identity landscape

This is one of a series covering open-source tooling across every identity category:

Frequently asked questions

What are the best open-source password managers in 2026?
The leading open-source password managers in 2026 are Bitwarden, Vaultwarden, KeePassXC, Passbolt, Psono, Padloc, and Proton Pass. Bitwarden is the most complete all-round option with GPL clients and an AGPL server, Vaultwarden is the lightweight Rust reimplementation of the Bitwarden server for self-hosting, KeePassXC is the offline-first choice with no cloud dependency, and Passbolt and Psono are built around team credential sharing with audit.
Is Bitwarden really open source?
Yes, with a nuance worth understanding. Bitwarden's client applications (browser extension, desktop, web vault, and CLI) are licensed GPL-3.0, and the server repository is AGPL-3.0. Some enterprise features in the server repository are covered by the separate Bitwarden License, which requires a commercial agreement for production use. For most self-hosting teams the AGPL server is sufficient, and the strong copyleft terms mean anyone offering Bitwarden as a service has obligations to meet.
What is the difference between Bitwarden and Vaultwarden?
Vaultwarden is an unofficial, community-built reimplementation of the Bitwarden server API in Rust, licensed AGPL-3.0 after relicensing from GPLv3. It is compatible with the official Bitwarden clients but runs on a fraction of the resources, which makes it popular for home labs and small teams self-hosting on modest hardware. It is not affiliated with Bitwarden, does not carry Bitwarden's compliance certifications, and you own its security updates.
Should a business self-host its password manager?
Only if you can operate it as tier-zero infrastructure. A password vault holds the credentials to everything else, so self-hosting means owning availability, backup and tested restore, patching, and the security of an internet-facing service. Teams that can do that get data control and cost savings. Teams that cannot are usually safer on a managed service, because a vault that is down during an incident, or breached because it went unpatched, is worse than a subscription.
Do open-source password managers support passkeys?
Increasingly yes. Bitwarden, Proton Pass, KeePassXC, and others support storing and using passkeys, which puts them in the same credential-custody position as platform password managers. That is worth noting after the August 2026 research in which Unit 42 recovered synced passkey private keys from a browser credential manager on Windows: a password manager that syncs passkeys becomes a custodian of key material with the blast radius that implies.
Last reviewed By SWI Community TeamSuggest a correctionHow we research

Related on Start with Identity

Independent editorial review, no sponsorship. See more in our articles and rankings.