Scoring sheet
How we scored the best password managers
Every score in The best password managers and 1Password vs Bitwarden comes from this sheet: the tools we considered, the scale for each criterion, and the evidence and date behind each score.
This page shows the working behind two pages: the best password managers and 1Password vs Bitwarden. Both use the criteria, weights and scores below, so 1Password and Bitwarden score the same on both pages.
Everything here comes from desk research: vendor pricing pages, help centers, security documentation, published audit reports, breach notices and one peer-reviewed study. We did not use any of these apps hands-on. The research was done on October 14, 2026, and the facts marked "re-checked October 16, 2026" were read again that day. Each score below has the source behind it.
The question and the reader
The question, in the reader's words: "What is the best password manager?" People also ask for the best password manager for a family and the best free password manager. We asked four AI models (GPT, Claude, Gemini and Perplexity, through their APIs with web search on) all three questions in October 2026, which gave 12 answers. Those answers and the review pages they cite helped build the field below.
The reader is one person or a household choosing a password manager for personal use, on a mix of devices. Families and people who want a free plan get the same winner for the same reasons, so they get awards on one page rather than separate pages.
Must-haves
A tool had to pass all three to be scored. These are filters, not criteria.
- Vault data is end-to-end encrypted by default: the company can't read it unless the user does something.
- Official apps sync one vault between a phone and a computer.
- It is sold to individuals or families, not only to companies.
The field
| Tool | Named in the 12 AI answers | Decision |
|---|---|---|
| 1Password | 12 | Scored |
| Bitwarden | 12 | Scored |
| Proton Pass | 8 | Scored |
| NordPass | 5 | Scored |
| KeePassXC | 5 | Not scored: desktop only (Windows, macOS, Linux), with no official phone app or sync service (keepassxc.org), so it fails must-have 2 |
| Dashlane | 4 | Scored |
| Apple Passwords | 4 | Scored |
| LastPass | 4 | Scored. Most answers say to avoid it; the score shows why |
| RoboForm | 3 | Scored |
| Google Password Manager | 2 | Not scored: end-to-end encryption of passwords (Google calls it on-device encryption) is something you turn on, not the default (Google's help page), so it fails must-have 1 |
| Keeper | 2 | Scored |
| Firefox's built-in password manager | 1 | Not scored: part of one browser, so on a computer it fills passwords only in Firefox. This ranking is for readers who want one vault across every browser and device |
| Microsoft Edge's built-in password manager | 0 (Edge was named only as a browser) | Not scored: part of one browser, and Microsoft says synced passwords are encrypted on the device but not that Microsoft can't decrypt them (Microsoft's Edge password manager security page), so we could not confirm must-have 1 |
| Enpass | 0 | Not scored: Enpass runs no sync service. The vault stays on your devices unless you connect your own iCloud, Dropbox, Google Drive, OneDrive or WebDAV account (Enpass security page), so sync, sharing and the breach record depend on a service Enpass doesn't run and can't be scored on the same terms as the rest |
Criteria and weights
These were set before any tool was scored.
| Criterion | Weight | What it measures |
|---|---|---|
| Security | 30 | Published independent testing of the apps, protection of a stolen vault, open client code, a bug bounty, and the breach record |
| Platforms and passkeys | 20 | Native apps on Windows, macOS, Linux, iOS and Android; extensions for Chrome, Firefox, Safari and Edge; passkey storage and sync |
| Price and free plan | 20 | What the free plan allows, plus the regular yearly price for one person after any first-year discount |
| Sharing and families | 15 | A family plan, shared vaults or folders, an organizer who can restore a member's access, and secure sharing with people who don't use the tool |
| Recovery | 15 | Ways back in after forgetting the master password, and emergency access for a trusted person |
Why these weights: the vault holds every other password, so security counts most. Working on every device in the household and the price are the next two reasons people switch or give up. Sharing and recovery matter most to families and to anyone who fears being locked out, and together they count for 30.
Not scored: ease of use and autofill reliability. We found no independent test with a published method that covers this field, and we didn't test the apps ourselves. The ETH Zurich and USI study of what a hostile server could do (below) shapes what the pages say but isn't scored, because it examined only four of the nine tools, and scoring it would penalize the vendors that were studied.
What each score means
Security: the sum of five parts, up to 10
| Part | Points |
|---|---|
| A. Published independent testing of the apps | 3: a full audit or pentest report you can read, dated within the last 24 months. 2.5: only a summary letter public, within 24 months. 2: a full public report 24 to 48 months old, or recent reports available only on request. 1: only certifications or attestations (such as SOC 2 or ISO 27001), or reports more than 48 months old. 0: nothing |
| B. Protection of a stolen vault against password guessing | 2: an extra secret held on your devices, or recovery records guarded by hardware that limits guesses, on top of the password. 1.5: a documented slow key derivation by default (Argon2, bcrypt, scrypt, or PBKDF2 with at least 600,000 iterations). 1: PBKDF2 with fewer or unpublished iterations. 0: weaker |
| C. Client source code published | 1.5: all of it. 0.5: part of it. 0: none |
| D. Public bug bounty or disclosure program | 0.5: yes. 0: no |
| E. Breach record | 3: no known incident in which attackers obtained users' vault data. 2: attackers obtained the encrypted vaults of fewer than 100 accounts, disclosed within days. 0: mass theft of encrypted vaults |
What a 10 looks like: full recent public audits, a secret held on your devices, open source, a bug bounty and a clean record. A 7: recent testing only on request, slow key derivation, closed source and a clean record. A 4: certifications only and a record of stolen vaults.
Platforms and passkeys
- 10: native apps for Windows, macOS, Linux, iOS and Android; extensions for Chrome, Firefox, Safari and Edge; stores and syncs passkeys.
- 8: one desktop system covered only by a browser extension or web app, otherwise as 10.
- 6: two or more desktop systems covered only by an extension or web app.
- 3: no app at all for Android, iOS or Windows.
- 0: works only on one company's devices.
- Subtract 2 if it can't store and sync passkeys.
Price and free plan: the sum of two parts
- Free plan: 4 for unlimited passwords on unlimited devices; 2 for a free plan with a real limit (one device, one type of device, one active session or a cap on items); 0 for a trial only.
- Paid price, the regular yearly price for one person after any first-year discount: 6 for $20 or less (or free with no paid tier); 5 for up to $30; 4 for up to $40; 3 for up to $50; 2 for up to $65; 1 for more than $65.
Sharing and families: the sum of four parts
- 3: a family plan for five or more people with a private vault each (or free sharing groups between separate accounts).
- 3: shared vaults, folders or collections for the household, beyond sharing one item at a time.
- 2: a family organizer can restore a member's access.
- 2: secure, expiring sharing with someone who doesn't use the tool.
Recovery
- 10: two or more ways back in after forgetting the master password, plus emergency access for a trusted contact.
- 7: two ways back in without emergency access, or one way back in plus emergency access.
- 4: only one of those.
- 0: forget the password and the vault is gone.
A way back in is a route you set up before you forget, which later gets you into your vault with a new master password or without one, and which doesn't give the vendor your key. These count: a recovery code or phrase, recovery by a family organizer, a reset confirmed with your face or fingerprint or from a device you're still signed in on, and a login passkey or a signed-in device that unlocks the vault. These don't count: a password hint, biometric unlock that expires after a while, and the vendor resetting the account by deleting your data.
We settled that wording on October 16, 2026, after a review found that the first version was applied unevenly: Bitwarden's passkey login and log in with device had been counted as one route, while comparable routes at other tools counted as two. We applied the wording above to every tool. Bitwarden, NordPass and Dashlane rose as a result; no other score changed. We did not change any weight.
Scores
"Re-checked October 16, 2026" marks a fact read again that day; everything else was read on October 14, 2026.
Bitwarden: total 9.6
| Criterion | Score | Evidence |
|---|---|---|
| Security | 9.5 | A 3: full 2025 reports from Cure53 (browser extension, core app, desktop app, web vault, cryptography library), Unit 42 (mobile apps), Fracture Labs and a cryptography review by ETH Zurich, all on Bitwarden's audit page. B 1.5: PBKDF2 at 600,000 iterations by default, Argon2id as an option (key derivation page). C 1.5: open source. D 0.5: public HackerOne program. E 3: no known incident exposing vault data. On April 22, 2026, a malicious version of the Bitwarden command-line tool (2026.4.0) was available through npm for about 90 minutes; Bitwarden found no evidence that user vault data was accessed (re-checked October 16, 2026), so the breach-record part stands |
| Platforms and passkeys | 10 | Native apps for Windows, macOS, Linux, iOS and Android; extensions for Chrome, Firefox, Safari, Edge and others (downloads). Stores passkeys in its extensions and mobile apps (passkey help page) |
| Price and free plan | 10 | Free plan: unlimited passwords on unlimited devices (plan comparison). Premium $1.65 a month billed yearly at $19.80; Families $47.88 a year for six people (pricing page, re-checked October 16, 2026). 4 + 6 |
| Sharing and families | 8 | Families covers six people with unlimited collections (plan comparison). No organizer recovery: admin account recovery is for Enterprise plans only (account recovery page). Bitwarden Send shares text with anyone (plan comparison). 3 + 3 + 0 + 2 |
| Recovery | 10 | Two ways back in: a login passkey that unlocks the vault (passkey login page; works in the web app and Chromium browser extensions) and log in with device, approved from another signed-in app (log in with device page). Plus emergency access with view or takeover, for Premium users and members of paid plans. Bitwarden itself "has no way to access, retrieve, or reset your master password" (forgotten password page). All re-checked October 16, 2026. Was 7 before the Recovery wording was settled |
Proton Pass: total 9.2
| Criterion | Score | Evidence |
|---|---|---|
| Security | 9.5 | A 3: Recurity Labs tested the browser extensions, mobile and desktop apps and command-line tool between January and April 2026; Proton published the report in May 2026 (Proton's audit announcement, which links the full report; re-checked October 16, 2026). This replaced Cure53's 2023 audit as the latest; the score was 8.5 before we found it. B 1.5: bcrypt protects the key password (security model). C 1.5: all Pass apps are open source (Proton Pass security page). D 0.5: public bug bounty. E 3: no known incident exposing vault data |
| Platforms and passkeys | 10 | Windows, macOS, Linux, iOS and Android apps; extensions for Chrome, Firefox, Edge, Brave and Safari (downloads). Passkeys on every plan (pricing page) |
| Price and free plan | 8 | Free: unlimited logins and devices, passkeys, 10 hide-my-email aliases, two vaults, sharing with two others. Pass Plus $2.99 a month billed at $35.88 a year; Pass Family $59.88 a year for six people (pricing page, re-checked October 16, 2026). The page shows no separate renewal price. 4 + 4 |
| Sharing and families | 8 | Pass Family covers six accounts with an admin panel; vault sharing; secure links for people without a Proton account on paid plans. No organizer recovery found. 3 + 3 + 0 + 2 |
| Recovery | 10 | Recovery phrase, recovery file, data backup on a device you're signed in on, and an old password (recovery guide); emergency access on Pass Plus (pricing page) |
Keeper: total 7.8
| Criterion | Score | Evidence |
|---|---|---|
| Security | 7 | A 2: pentests by NCC Group and others, with summaries for enterprise customers on request; SOC 2 and ISO 27001, a FIPS 140-3 validated encryption module, and FedRAMP authorization, which covers Keeper's government product rather than consumer plans (encryption model). B 1.5: PBKDF2 at 1,000,000 iterations (same page). C 0: closed source. D 0.5: Bugcrowd program. E 3: no known incident exposing vault data |
| Platforms and passkeys | 10 | Windows, macOS, Linux, iOS and Android; Chrome, Firefox, Safari, Edge, Opera and Brave (downloads); manages passkeys |
| Price and free plan | 5 | Free: "Limited to 1 Mobile Device" and "Limited to 10 Records", with no sync or sharing (Keeper Free compared with the trial, re-checked October 16, 2026). Keeper Unlimited $42.99 a year; Family $91.99 a year for five people, read on October 14, 2026 from the price service the pricing page loads. 2 + 3. Was 3 when we had missed the free plan |
| Sharing and families | 8 | Family covers five people with private vaults and lists "Unlimited shared folders, records and permissions"; its help text says families can share through Shared Folders and share a record one time with someone outside the plan (pricing page, re-checked October 16, 2026). Keeper's sharing page lists record sharing and One-Time Share for Unlimited and Family and names shared folders only under business plans; we follow the pricing page, which says what the Family plan includes. No organizer recovery found. 3 + 3 + 0 + 2. Was 5 before we read the pricing page's Family list |
| Recovery | 10 | A 24-word recovery phrase; a reset confirmed with your face or fingerprint on a signed-in device (reset guide); emergency access for up to five contacts (encryption model page) |
RoboForm: total 7.5
| Criterion | Score | Evidence |
|---|---|---|
| Security | 7 | A 2.5: Secfault Security pentested the Windows, macOS, Android and iOS apps, extensions and web portal from August to September 2024, with retests to February 2025; only a three-page summary is public. B 1: "AES256 bit encryption with PBKDF2 SHA256", with no iteration count published (security page). C 0. D 0.5: bug bounty (security page). E 3 |
| Platforms and passkeys | 8 | Windows and macOS apps (the Safari extension comes with the Mac app), iOS and Android; Linux only through the Chrome and Firefox extensions (Linux download page). Stores passkeys (help article) |
| Price and free plan | 7 | Free: unlimited passwords on one device. Premium $2.49 a month, renewing at $29.88 a year; Family (five accounts) renews at $47.75 a year (pricing page, re-checked October 16, 2026). Any first-year discount shows only at checkout. 2 + 5 |
| Sharing and families | 6 | Family plan for five accounts; shared folders for personal users (help article). No organizer recovery or sharing with non-users found. 3 + 3 + 0 + 0 |
| Recovery | 10 | Account recovery through two-factor authentication or the mobile app's biometrics, if set up beforehand, plus emergency access (RoboForm's help center and security page) |
1Password: total 7.4
| Criterion | Score | Evidence |
|---|---|---|
| Security | 7.5 | A 2: the last openly published independent report is ISE's from 2020; since November 2025, pentest reports are shared through the Trust Center on request (security assessments page). B 2: a 128-bit Secret Key, created on your devices and never sent to 1Password, is required along with the account password (Secret Key page). C 0: closed source. D 0.5: public HackerOne program. E 3: no known incident exposing vault data |
| Platforms and passkeys | 10 | Apps for macOS, Windows, Linux, iOS and Android; extensions for Chrome, Firefox, Safari, Edge and Brave (downloads). Stores passkeys |
| Price and free plan | 3 | No free plan (14-day trial). Individual $3.99 a month billed yearly ($47.88), or $2.99 a month for new customers' first year; Families $5.99 a month billed yearly ($71.88), or $4.49 for the first year (pricing page, re-checked October 16, 2026). 0 + 3 |
| Sharing and families | 10 | Families covers five people (pricing page); shared vaults and organizer recovery; items shared by link "with anyone, even if they don't use 1Password" (sharing page). 3 + 3 + 2 + 2 |
| Recovery | 7 | A recovery code, if you generated one, and organizer recovery on Families (forgotten password page, re-checked October 16, 2026). Biometric unlock also works for a while but "will eventually expire", so it doesn't count. No emergency access feature |
NordPass: total 7.0
| Criterion | Score | Evidence |
|---|---|---|
| Security | 6 | A 1: the only independent audit found is Cure53's, announced in March 2020, which covered the desktop app, browser extension and mobile apps; NordPass states ISO 27001 and SOC 2 Type 2 in its App Store listing. B 1.5: XChaCha20 with Argon2id per the App Store listing; XChaCha20 confirmed in NordPass's help center. C 0. D 0.5: bug bounty program. E 3 |
| Platforms and passkeys | 10 | Windows 10 and later, macOS 13 and later, Linux, Android 9 and later, iOS 18 and later; extensions for Chromium browsers, Firefox, Opera, Edge and Safari (supported systems). Stores passkeys, with no option to import or export them (passkeys FAQ) |
| Price and free plan | 6 | Free: one active session at a time (plan comparison, re-checked October 16, 2026). NordPass's own pricing page refused every automated request. PanicVault, a site that sells a competing password manager, listed in September 2026: Premium $23.88 for the first year, then $35.88; Family $44.28 for the first year, then $71.88 for six people. Security.org listed different monthly prices in April 2026. Scored on the $35.88 renewal: 2 + 4 |
| Sharing and families | 3 | Family covers six accounts (help article). Shared folders are for business plans (help article), so personal users share item by item with other NordPass users. 3 + 0 + 0 + 0 |
| Recovery | 10 | Two ways back in: a 24-symbol recovery code, and, without the code, unlocking a signed-in app with your face or fingerprint to make a new recovery code (NordPass's guide for a lost password and code). Plus emergency access on Premium and Family, granted automatically after seven days unless you decline. All re-checked October 16, 2026. Was 7 before the Recovery wording was settled |
Apple Passwords: total 6.5
| Criterion | Score | Evidence |
|---|---|---|
| Security | 6.5 | A 1: no independent audit of Passwords is published. Apple holds ISO 27001 and ISO 27018 certifications whose scope includes iCloud. B 2: keys stay on trusted devices, and the recovery record is guarded by hardware that destroys it after 10 failed attempts; passwords are end-to-end encrypted under standard data protection (Apple's data protection overview). C 0. D 0.5: Apple Security Bounty. E 3 |
| Platforms and passkeys | 3 | iPhone, iPad, Mac and Vision Pro; Windows through iCloud for Windows with extensions for Chrome, Edge and Firefox (Passwords app page; Windows guide). No Android or Linux app. Stores passkeys |
| Price and free plan | 10 | Free with every Apple Account, with no paid tier. 4 + 6 |
| Sharing and families | 6 | Shared groups of passwords and passkeys between separate Apple Accounts (Passwords app page). No organizer recovery or sharing with non-users. 3 + 3 + 0 + 0 |
| Recovery | 7 | iCloud Keychain recovery through escrow and trusted devices, plus Apple Account recovery. A Legacy Contact can't access "data stored in your iCloud Keychain (payment information, passwords, and passkeys)" (Legacy Contact page), so there is no emergency access for passwords |
LastPass: total 6.3
| Criterion | Score | Evidence |
|---|---|---|
| Security | 3.5 | A 1: no recent independent app audit report found; certifications only. B 1.5: PBKDF2 with at least 600,000 rounds for new accounts and accounts that have been updated; older accounts may use fewer (LastPass Trust Center FAQ). C 0.5: client code partly available (per the ETH Zurich and USI paper). D 0.5: bug bounty. E 0: in the 2022 breach, attackers copied "a backup of customer vault data" (LastPass's notice); the UK Information Commissioner's Office fined LastPass £1.2 million in December 2025, saying up to 1.6 million UK users were affected and that there was no evidence the attackers could decrypt customer passwords (re-checked October 16, 2026) |
| Platforms and passkeys | 8 | Windows and macOS apps, iOS and Android; Chrome, Firefox, Edge and Opera extensions, and Safari through the Mac app; no Linux download (downloads). Stores passkeys since August 2025 |
| Price and free plan | 6 | Free: "Limited to 1 device type" (pricing page). Premium $36 a year and Families $48 a year for six people, from the product catalog the pricing page loads (re-checked October 16, 2026). 2 + 4 |
| Sharing and families | 6 | Families covers six accounts with shared folders and a family manager dashboard (pricing page). 3 + 3 + 0 + 0 |
| Recovery | 10 | Mobile biometric recovery and a recovery one-time password stored in browsers where you have logged in (LastPass account recovery guide); emergency access on Premium (pricing page) |
Dashlane: total 4.8
| Criterion | Score | Evidence |
|---|---|---|
| Security | 5.5 | A 1: no published independent app audit found; Dashlane states annual SOC 2 Type II audits and ISO 27001 certification (compliance page). B 1.5: Argon2d (security page). C 0.5: client code partly available (per the ETH Zurich and USI paper). D 0.5: bug bounty. E 2: from May 31, 2026, attackers brute-forced the codes used to register a new device and downloaded the encrypted vaults of fewer than 20 personal-plan users; Dashlane disclosed it on June 1, 2026 (security advisory) |
| Platforms and passkeys | 6 | Web app and extensions (Chrome, Firefox, Edge, and Safari on macOS 15 and later), Android and Apple mobile apps; no desktop apps (platforms; "the desktop app, which we no longer offer", help article). Stores passkeys (help article) |
| Price and free plan | 2 | The free plan ended on September 16, 2025, and Dashlane sells no free or monthly plans (plan comparison). Dashlane's pricing page shows no prices without its script. Apple's US App Store lists "Dashlane Premium - 1 Year" at $64.99; PanicVault listed $60 a year in September 2026. Prices rose from February 2026 (help article). Scored at $60 to $65: 0 + 2 |
| Sharing and families | 3 | Friends & Family covers 10 members (plan comparison). Personal plans share item by item; shared collections are for business plans (help article). 3 + 0 + 0 + 0 |
| Recovery | 7 | Two ways back in: an account recovery key, and biometric recovery on Android and iOS, which resets the master password after a face or fingerprint check (re-checked October 16, 2026). The emergency contact feature went away with the desktop app (help article). Was 4 before the Recovery wording was settled |
The order
Bitwarden 9.6, Proton Pass 9.2, Keeper 7.8, RoboForm 7.5, 1Password 7.4, NordPass 7.0, Apple Passwords 6.5, LastPass 6.3, Dashlane 4.8. The site computes each total as the weighted average of the scores, rounded to one decimal place.
How close is the top? Bitwarden leads Proton Pass by 0.4, and all of it comes from price: the two score the same on every other criterion. No change of weights puts Proton Pass ahead; with no weight on price, the two would tie.
Keeper (7.8) is third. It beats RoboForm on platforms (a native Linux app) and on sharing (one-time links for people outside the plan), and beats 1Password on price and recovery. RoboForm (7.5) and 1Password (7.4) are a tenth of a point apart, which is effectively a tie.
1Password against Bitwarden: 7.4 against 9.6. 1Password wins Sharing by 2 points; Bitwarden wins Security by 2, Price by 7 and Recovery by 3. Price alone accounts for 1.4 of the gap. With no free-plan points for either, Bitwarden would still lead, 8.8 to 7.4. Moving all of Price's weight to Sharing still leaves Bitwarden ahead, by 0.4.
What we couldn't check
- NordPass's and Dashlane's own pricing pages: NordPass refuses automated requests, and Dashlane's draws its prices with a script. Both prices above come from labeled third parties; check them at checkout.
- Keeper's prices were read from its price service on October 14, 2026; that service didn't answer our check on October 16.
- RoboForm's first-year price for new customers, which shows only at checkout.
- The full ETH Zurich and USI paper on IACR ePrint refused our requests, so the six attacks on 1Password weren't read one by one; the counts come from the paper's abstract, revised in August 2026.
- RoboForm's recovery help articles, beyond its security page.
The ETH Zurich and USI study
The paper (IACR ePrint 2026/058, revised in August 2026) describes 12 attacks on Bitwarden, seven on LastPass, six on Dashlane and six on 1Password that work if the company's own server turns hostile. Its abstract says "remediation is underway". Bitwarden says it was tested on ten attacks, which the researchers later split into 12, and that seven are resolved or being fixed while three were accepted as design decisions. 1Password says its six reflect limits it already documents.
Changes before publishing
- October 16, 2026: Proton Pass's Security rose from 8.5 to 9.5 for its May 2026 Recurity Labs audit. Keeper's Price rose from 3 to 5 for its free plan, and its Sharing from 5 to 8 for the shared folders its pricing page lists for Family. The Recovery wording above was settled and applied to every tool: Bitwarden rose from 7 to 10, NordPass from 7 to 10 and Dashlane from 4 to 7. No weight changed. Bitwarden stayed first; Keeper moved from fifth to third.