The best password managers

Bitwarden is the best password manager for most people in 2026. It publishes more independent security testing than any rival we scored, its apps are open source, the free plan syncs unlimited passwords across unlimited devices, and Premium costs $19.80 a year. Proton Pass is a close second, level with Bitwarden on everything we score except price, and the better pick if you want free email aliases or a recovery phrase you can keep on paper. If you are setting up a family and want one person able to restore a member who forgets their password, choose 1Password, which leads on family features but has no free plan and costs $71.88 a year for five people.

Prices for several of these tools changed in 2026, and three of the 12 AI answers we sampled in October 2026 still quoted old ones. The corrections are in what changed in 2026 below.

The best password managers, ranked

Bitwarden

Bitwarden ranks first because it publishes the most independent testing of any tool here, its code is open source, and its free plan has no device limit. Its audit page lists 2025 reports from Cure53 on the browser extension, desktop app, web vault and core app, from Palo Alto Networks' Unit 42 on the mobile apps, and a cryptography review by the Applied Cryptography Group at ETH Zurich that assumed a fully malicious server. New accounts derive their key with PBKDF2 at 600,000 iterations, with Argon2id as an option (Bitwarden's key derivation page).

That ETH Zurich work is also the main caveat. The researchers' USENIX Security 2026 paper describes 12 attacks on Bitwarden that work if an attacker controls Bitwarden's servers, several of which could recover passwords. Bitwarden, in its response to the study, says it was tested on ten attacks, which the researchers later split into 12, and that seven are resolved or in active remediation while three were accepted as design decisions. There is no public report of these attacks being used, and they assume a compromised vendor.

Bitwarden's weaker score is family features. A Bitwarden Families organizer cannot restore a member's account: admin account recovery is for Enterprise organizations only. Recovery scores full marks, but only if you prepare. Bitwarden cannot reset your master password, and there is no recovery code. Your routes back are a login passkey that unlocks your vault (in the web app and Chromium-based browser extensions), approval from another device you're still signed in on, or emergency access granted to a trusted contact on a paid plan. Set one of those up on day one.

Proton Pass

Proton Pass ranks second, 0.4 behind Bitwarden, and scores the same as Bitwarden on every criterion except price. If price doesn't matter to you, the two are level on our scores. Recurity Labs tested the Proton Pass browser extensions, desktop and mobile apps and command-line tool between January and April 2026, and Proton published the full report in May 2026 (Proton's audit announcement). The apps are open source, and Proton documents its vault encryption (AES-256-GCM item keys under a bcrypt-protected user key) in its security model.

Proton Pass takes "Best with email aliases" because it is the only tool we scored with its own email aliases on the free plan: 10 hide-my-email addresses, alongside unlimited logins and devices, passkeys and sharing with two people (Proton Pass pricing). NordPass's Email Masking, for comparison, needs Premium. Recovery is the other strength. You can regain your data with a 12-word recovery phrase, a recovery file, a trusted device or an old password (Proton's recovery guide), and Pass Plus adds emergency access for a trusted contact. A phrase on paper doesn't depend on keeping a device or a passkey, which Bitwarden's routes do.

What puts Proton Pass behind Bitwarden is the paid plan: Pass Plus costs $35.88 a year against Bitwarden Premium's $19.80.

Keeper

Keeper ranks third. It has strong recovery for a single person: a 24-word recovery phrase generated on your device, a reset confirmed with your face or fingerprint on a device you're signed in on, and emergency access for up to five contacts. It derives your key with PBKDF2 at 1,000,000 iterations and uses a FIPS 140-3 validated encryption module, both listed in its encryption model documentation. The FedRAMP authorization Keeper also lists covers its government product, not the consumer plans.

Keeper's Family plan is the most expensive we found, at $91.99 a year for five people, but its pricing page lists shared folders for Family, and you can send a record one time to someone outside the plan. Keeper's sharing page mentions shared folders only for business plans; we follow the pricing page, which lists what Family includes. Keeper Unlimited, for one person, is $42.99 a year. Keeper Free is limited to 10 records on one mobile device, with no sync or sharing (Keeper Free compared with the trial), so treat it as a trial that doesn't expire. Keeper's pentest reports go to enterprise customers on request, so individuals can't read them.

RoboForm

RoboForm ranks fourth, a tenth of a point ahead of 1Password, which is effectively a tie; RoboForm's cheap renewals and recovery options balance 1Password's family features. Premium renews at $29.88 a year and Family at $47.75 a year for five people (RoboForm pricing); any first-year discount for new customers shows only at checkout. If you forget your master password, you can recover through two-factor authentication or the mobile app's biometric recovery if you set them up beforehand, and a trusted contact can request emergency access.

RoboForm's security evidence is thinner than Bitwarden's, Proton Pass's or Keeper's. Secfault Security pentested the Windows, Mac, iPhone and Android apps, the extensions and the web portal in August and September 2024, retested the fixes up to February 2025, and RoboForm publishes a three-page summary, not the findings. Its security page names PBKDF2 SHA-256 without an iteration count. On Linux, RoboForm is only a browser extension, and the free plan works on a single device.

1Password

1Password ranks fifth, a tenth of a point behind RoboForm, which is effectively a tie. Many review sites and AI assistants put 1Password first, usually for the polish of its apps and its autofill. We can't measure those without using the apps ourselves, so we don't score them. On what documents can show, 1Password loses points on price (no free plan, and $47.88 a year after a new customer's first year), on recovery (no emergency access) and on publishing fewer independent audits than Bitwarden or Proton Pass.

1Password has the best family features of any tool here, which is why it takes "Best for families". A family organizer can restore a member's access when they forget their password, the household can share vaults, and you can share an item by expiring link "with anyone, even if they don't use 1Password". Its 128-bit Secret Key, which is never sent to 1Password, means a copy of your vault taken from 1Password's servers cannot be attacked by guessing your password alone.

There is no free plan, and from March 2026 renewals rose to $47.88 a year for one person and $71.88 for a family of five (MobileSyrup on the increase; current figures on 1Password's pricing page). The $2.99 and $4.49 monthly prices many answers quote are first-year promotions for new customers. There is no emergency access feature: your routes back are a recovery code, if you generated one, or a family organizer. The most recent independent report 1Password publishes openly is from 2020; newer pentests are available through its Trust Center on request. The full version of the ETH Zurich study reports six malicious-server attacks on 1Password, which 1Password, in its response, says reflect limitations it already documents, including no way for users to verify other users' public keys.

The 1Password vs Bitwarden comparison settles that choice criterion by criterion.

NordPass

NordPass ranks sixth. It has native apps on every platform we checked, Linux included (NordPass's supported systems), and full marks on recovery: a 24-symbol recovery code, a way to make a new code by unlocking a signed-in app with your face or fingerprint (NordPass's guide), and emergency access that is granted automatically after seven days unless you decline.

The only independent audit we could find is Cure53's, announced in March 2020. The free plan allows one active session, so signing in on your phone signs you out on your laptop (NordPass plan comparison). Shared folders are a business feature, so a family shares item by item. NordPass's site refused our automated checks, so the prices above come from PanicVault's September 2026 listing; PanicVault sells a competing password manager. Check the price at checkout.

Apple Passwords

Apple Passwords ranks seventh and is the right answer if everyone in your home uses an iPhone, iPad or Mac. It is free, and Apple lists passwords and Keychain as end-to-end encrypted under standard data protection. Recovery through Apple's servers can't be guessed at forever: the hardware security modules that guard the escrow record destroy it after 10 failed attempts. Shared groups let separate Apple Accounts share passwords and passkeys. Apple publishes no independent audit of Passwords.

Apple Passwords falls down on reach. There is no Android or Linux app; on Windows it works through iCloud for Windows and an extension for Chrome, Edge or Firefox. And if you are planning for someone to inherit your accounts, Apple's Legacy Contact cannot access passwords or passkeys stored in iCloud Keychain.

LastPass

LastPass ranks eighth, and the score is mostly the breach. In 2022 attackers copied a backup of customer vault data. The UK Information Commissioner's Office fined LastPass £1.2 million in December 2025 over that breach, which it says affected up to 1.6 million UK users; it found no evidence that the attackers could decrypt customer passwords. A stolen vault can still be attacked offline for as long as the attacker likes, so passwords behind a short or reused master password remain at risk. LastPass now uses at least 600,000 PBKDF2 rounds for new accounts, but older accounts that never updated may run fewer.

LastPass's recovery options (mobile biometric recovery, a recovery code saved in browsers you used, and emergency access on Premium) score well, and Premium at $36 a year is fair. If you stayed with LastPass after 2022, first change the passwords of your most valuable accounts, because a new master password doesn't protect the copy already taken; then set a long, unique master password. If you're choosing today, pick Bitwarden or Proton Pass instead.

Dashlane

Dashlane ranks last. Its free plan ended in September 2025, it raised prices from February 2026, and it no longer offers desktop apps or emergency access (Dashlane's plan comparison). From late May 2026, attackers brute-forced the six-digit codes Dashlane uses to add a new device and downloaded the encrypted vaults of fewer than 20 users. Opening those vaults still needs each user's master password, which Dashlane protects with Argon2, so a long, unique master password is what stands between those users and the attackers. Recovery is better than it looks: a recovery key and biometric recovery on Android and iOS can both reset a forgotten master password.

Dashlane's personal pricing page loads its prices by script and showed none to our check; Apple's US App Store lists Premium at $64.99 a year and reviewers list about $60 on the web.

What changed in 2026, and what many answers still get wrong

We asked four AI models (GPT, Claude, Gemini and Perplexity, through their APIs with web search on) three versions of this question in October 2026. Three of the 12 answers quoted out-of-date prices, and none mentioned Bitwarden's npm incident, Dashlane's 2026 attack or the ETH Zurich study. These are the facts most often missing or out of date:

• Bitwarden Premium is $19.80 a year, not $10, and Families is $47.88, not $40 (Bitwarden pricing).
• 1Password costs $47.88 a year for one person after a new customer's first year, not $35.88; Families is $71.88, not $59.88.
• Dashlane has no free plan. Answers describing a 25-password free tier are describing a plan that ended in September 2025.
• "Bitwarden has never been breached" is true for vault data, but incomplete. In April 2026 a malicious version of the Bitwarden command-line tool was available through npm for about 90 minutes; Bitwarden found no evidence that user vault data was accessed. The ETH Zurich study also shows what a compromised server could do to Bitwarden, LastPass, Dashlane and 1Password clients (the full version on IACR ePrint).

Which one should you choose?

• If you want one answer: Bitwarden. Start on the free plan; pay $19.80 a year if you want emergency access, file attachments or built-in two-factor codes.
• If being locked out is your biggest fear: Proton Pass. Save the recovery phrase on paper the day you sign up.
• If you're setting up a family with someone who will forget their password: 1Password Families, because an organizer can restore them. Bitwarden Families is $24 a year cheaper and covers six people, but its organizer can't restore a member; members would each have to name an emergency contact in advance.
• If every device in the house is Apple: Apple Passwords is free and already installed. Switch when someone gets an Android phone.
• If you use Linux daily: Bitwarden, Proton Pass, 1Password, Keeper and NordPass all have native Linux apps.
• If you're on LastPass or Dashlane: export your vault and move. Bitwarden imports from both; delete the export file afterward, because it isn't encrypted.

For what to check before you commit (recovery, export, introductory prices and passkey portability), read how to choose a password manager.

How we scored

We did not use these apps hands-on. In October 2026 we read each vendor's US pricing page, download pages, help center and security documentation, plus every audit report, breach notice and research paper cited above, and scored each tool against anchors written before scoring. Ease of use and autofill reliability are not scored: we found no independent test with a published method covering this field, and we won't score them from impressions. Two prices (NordPass and Dashlane) could not be read from the vendors' own pages and are marked as such. How we scored the best password managers lists every score with its source and the date we checked it, including the changes we made after a review before publishing.

Questions people ask

Is Bitwarden safe? Yes, by the evidence available: it publishes more independent audits than any rival, its code is public, and no incident has exposed users' vault data. In April 2026 a malicious version of its command-line tool was on npm for about 90 minutes, and Bitwarden found no evidence that vault data was accessed. The ETH Zurich findings apply only if Bitwarden's own servers are compromised, and Bitwarden says most are fixed or being fixed.

Is a free password manager good enough? Bitwarden's and Proton Pass's free plans are complete password managers with unlimited devices. Free plans from RoboForm, NordPass, LastPass and Keeper are limited to one device, one session, one device type or, for Keeper, 10 records on one phone.

Is Google Password Manager safe? It's convenient, and Google encrypts passkeys end to end (Google's passkey announcement). For passwords, end-to-end encryption is opt-in, so by default Google holds the key. If you use it, turn on on-device encryption; Google says it can't be removed once set up, and resetting it deletes your saved passwords.

Should I still use LastPass? We wouldn't start with it. A backup of vault data was stolen in 2022 and can still be attacked offline, so the safest move for existing users is new passwords for important accounts first, then a new, long master password, ideally in a different manager.