All well-known password managers compared: country, features, reviews and scores

In this manual you work with Proton Pass and 1Password. But there are many more, and you may already be using one. Here you can compare 23 well-known password managers side by side: where the company is from, where your vault is stored, what they can do, what they cost and what others think of them. We give each manager three scores, so you can quickly see which one suits you.

Good to know: WebOké does not sell any of these password managers and receives no money from their makers. The scores are our own judgement, based on the rules below. All details were checked on 10 November 2026. Prices change often and there is often a discount in the first year: check the maker's website for the current price.

Our advice in brief

• For almost everyone: Proton Pass. A European company (Switzerland) that stores your vault on its own servers in Switzerland, Germany or Norway. It works on your Mac, your Windows PC, your iPhone, your Android phone and in all major browsers. The apps are open source and the free version already offers plenty. For two-step verification codes and emergency access, choose Pass Plus. To get started, read Creating a Proton account for Proton Pass.
• The easiest of all, if you don't mind paying: 1Password. A Canadian company. Create your account on 1password.eu and your vault is stored in the EU. The EU considers Canada a safe country for personal data. To get started, read Creating a 1Password account on 1password.eu.
• What about Bitwarden? Good, open source and the most frequently audited, but it is an American company: even with your vault in the European region, American law applies. That is why Bitwarden gets a 2 for EU/GDPR and we recommend Proton Pass or 1Password instead.
• For your family: Proton Pass Family (6 people) or 1Password Families (5 people). Everyone has their own vault and you can share passwords with each other.
• For your business: Proton Pass Essentials, 1Password Business with the EU region, or Passbolt (Luxembourg) if you want the vault on your own server.
• Do you currently only use the passwords in your browser? That's fine to start with, but as soon as you have devices from different brands, you're better off switching. It takes about fifteen minutes (see Importing passwords from Chrome, Edge, Firefox and Safari).

How we score

Each manager gets three scores from 1 (poor) to 5 (excellent).

Why does the company's country count, even if your vault is in the EU? Under the American CLOUD Act, an American company must hand over data when the American government asks for it, including data stored in Europe. With a good password manager, your vault is encrypted with your master password. The company can then only hand over an encrypted file. But it can hand over your email address, your payment details and when you log in. That is why a European company scores higher.

The overview

Sorted by total score. On a narrow screen, swipe the table sideways to see all columns. Under "Works everywhere", Yes means: the same maker has an app or extension for Mac, Windows, iPhone, Android and the major browsers. Partial: not on some of your devices, or only with third-party apps. No: only on one brand. Prices in dollars are American prices excluding VAT: in euros the amount is about the same or slightly higher.

Which one should you choose?

• Easy, works everywhere, and as European as possible: Proton Pass (Swiss, generous free version) or 1Password with an account on 1password.eu (Canadian, paid, vault in the EU). NordPass (Lithuanian) and heylogin (German, no master password) are also good European choices.
• Free and still easy: Proton Pass (see Creating a Proton account for Proton Pass).
• Everything in your own hands: KeePassXC with your vault file in your Nextcloud, or Vaultwarden on your own VPS. This does mean more work: with KeePassXC you need a different app on your phone, and with Vaultwarden you handle the updates and backups yourself. This manual doesn't cover those two.
• For your family: the family plans of Proton Pass (6 people) or 1Password (5 people), see Sharing passwords with your team or family.
• For your business: see the table for businesses further down.

Please note: The password manager in your browser or phone (Apple, Google, Microsoft, Firefox, Samsung) is free and already built in, but it only works well if all your devices are the same brand or if you use the same browser everywhere. If you have an iPhone and a Windows PC, or an Android phone and a Mac, you'll run into gaps. In that case, choose a standalone password manager.

What we advise against

• Kaspersky Password Manager: a Russian company. The German BSI has been warning against Kaspersky software since 2022. Sales are banned in the US and the app is no longer in Google Play.
• SecureSafe: Swiss, but according to a study by the BSI (December 2025), the maker itself can access your passwords. So European does not automatically mean safe.
• LastPass: in the 2022 breach, customers' encrypted vaults were stolen. Since then, vaults with weak master passwords have been cracked and cryptocurrency has been stolen. If you still use LastPass, switch (see Switching from LastPass, Bitwarden or another manager) and then change your most important passwords.

Password managers one by one

Reviews: Trustpilot reflects customers' opinion of the company (often about invoices and customer service, less about the app). App Store and Google Play ratings are about the app itself (American store, unless stated otherwise). Checked on 10 November 2026.

1Password (Canada)

Made by AgileBits from Toronto. Choose 1password.eu when signing up and your vault is stored in the EU. In addition to your master password, you have a Secret Key, which makes a stolen vault almost impossible to crack. Apps for everything, passkeys, 2FA codes, sharing within a family or team. No free version (14-day trial). No real emergency access, but there is an Emergency Kit and recovery via the family organiser. Many independent audits (Cure53, Recurity Labs). Closed source.

Reviews: Trustpilot 4.1 (12,525 reviews), App Store 4.7, Google Play 4.7. Stiftung Warentest 2022: test winner. Consumentenbond 2020: Best in Test (8.1).

Proton Pass (Switzerland)

From Proton, also the maker of Proton Mail. Your vault is stored on Proton's own servers in Switzerland, Germany or Norway. You can't choose the country. The free version is generous: unlimited passwords and devices, passkeys and 10 email aliases. 2FA codes and emergency access are included in Pass Plus. The apps are open source and were audited by Cure53 (2023). By default you log in with your Proton password; you can set an extra password or PIN for Pass.

Reviews: Trustpilot 3.4 (only 18 reviews), App Store 4.8, Google Play 4.8. PCMag: Editors' Choice for free password managers.

Bitwarden (United States)

Open source and the most audited of all: every year by Cure53 and others. Choose bitwarden.eu when signing up and your vault is stored in the EU. Bitwarden does remain an American company. The free version has unlimited passwords and devices. 2FA codes in your vault, emergency access and attachments are included in Premium. You can also self-host Bitwarden, or use Vaultwarden (see below). In April 2026, a compromised version of the command-line tool was online for 90 minutes; according to Bitwarden, no vault data was affected.

Reviews: Trustpilot 3.0 (366), App Store 4.8, Google Play 4.7. Test-Aankoop (Belgium) March 2026: best free password manager. Stiftung Warentest 2022: "gut".

NordPass (Lithuania)

From Nord Security in Vilnius, the maker of NordVPN. In the app stores, the app is published by a Panamanian company in the same group. According to NordPass, your vault is stored in the EU and the US; only business customers can choose. The free version works on one device at a time. Passkeys, 2FA codes and emergency access in Premium. Audited by Cure53 (2020 and 2021). Closed source. The price depends heavily on promotions and the subscription term.

Reviews: Trustpilot 3.9 (2,080), App Store 4.7, Google Play 4.5. Test-Aankoop March 2026: 80 out of 100, joint best in the test. PCMag 2025: Editors' Choice.

heylogin (Germany)

From Hanover, vault in German data centres. There is no master password: you confirm with your phone, a security key, Touch ID or Windows Hello. That's easy, but without your phone or key you can't get in. Free for private users, with 2FA codes and passkeys. No family plan. On your computer it works via the browser extension. Source code audited by secuvera (2025). Closed source.

Reviews: Google Play 4.1 (497). Too few reviews on Trustpilot. No consumer test.

Keeper (United States)

From Chicago. Choose the European data centre (Ireland and Frankfurt) when signing up. Apps for everything, passkeys, 2FA codes, sharing and emergency access. Many certifications, but you only get the audit reports under a non-disclosure agreement. No known breach involving customer data. No real free version any more (30-day trial).

Reviews: Trustpilot 3.1 (3,174), App Store 4.9, Google Play 4.7. Stiftung Warentest 2020: test winner.

Enpass (India)

Enpass doesn't store your vault itself: it's on your device or in a cloud of your choice, such as iCloud, OneDrive, Google Drive or your own Nextcloud. So with your Nextcloud at WebOké, your vault is stored in the Netherlands. Apps for everything, passkeys and 2FA codes. Free for up to 25 items; there is also a one-off lifetime licence. Audited by Cure53 (2022 and 2023). Closed source. Enpass gets a 4 rather than a 5 for EU/GDPR: the default options are iCloud, OneDrive and Google Drive, and your licence is handled by an Indian company.

Reviews: Trustpilot 4.4 (70), App Store 4.2, Google Play 3.8.

KeePassXC (open source, no company)

Your vault is a single encrypted file on your own computer. You arrange syncing yourself, for example with your Nextcloud. Free, open source and one of the most secure in the BSI test of December 2025. KeePassXC itself is only available for Windows, Mac and Linux. On your phone you use a different app that opens the same file: KeePassDX or Keepass2Android (Android), KeePassium or Strongbox (iPhone). That's why it gets a 2 for ease of use. No emergency access and limited sharing.

Reviews: BSI and Verbraucherzentrale NRW (December 2025): no objections, together with Keepass2Android and Firefox. Stiftung Warentest 2022: "ausreichend", mainly because you're allowed to choose a weak master password. On Google Play: Keepass2Android 4.3, KeePassDX 4.2. Strongbox has been owned by an American company since 2025; KeePassium is from Luxembourg.

Vaultwarden (open source, no company)

A server you run yourself, for example on a VPS. You use the regular Bitwarden apps, so it works everywhere, including 2FA codes, sharing and emergency access, without a subscription. Vaultwarden is not made by Bitwarden itself. It was audited on behalf of the BSI (2024) and by ERNW (2024); the vulnerabilities found have been fixed. Whether it stays secure depends on you: you handle updates, https and backups yourself. Installation is covered in the VPS manual.

Dashlane (United States)

Started in Paris, now an American company based in New York. Your vault is always stored in Ireland. There are no desktop apps any more: on your computer you use the browser extension. Passkeys and 2FA codes. The free version ended in September 2025. In June 2026, attackers bypassed two-step login on about 20 accounts and downloaded encrypted vaults; according to Dashlane, its own systems were not hacked. Audit reports only for business customers.

Reviews: Trustpilot 2.6 (6,139), App Store 4.8, Google Play 4.5. Stiftung Warentest 2022: test winner.

Sticky Password (Czech Republic)

From Brno. Can sync via the cloud or only via your own Wi-Fi, without a cloud. Free on one device. No published independent audit. No family plan, but there is a lifetime licence.

Reviews: Trustpilot 3.1 (66), App Store 4.7, Google Play 4.8.

pCloud Pass (Switzerland)

From the storage service pCloud. Vault in Luxembourg or the US. According to reviews, no passkeys, no 2FA codes and no emergency access yet. No published independent audit.

Reviews: Trustpilot 3.1 (for pCloud as a whole), App Store 4.2, Google Play 4.7.

RoboForm (United States)

One of the oldest managers. Your vault is stored in the US, with no EU option. Passkeys, 2FA codes and emergency access. Audited by Secfault (2023 and 2025). Very old versions (up to around 2015) generated predictable passwords: if you still have passwords that old, replace them.

Reviews: Trustpilot 4.6 (552), App Store 4.7, Google Play 4.7. Test-Aankoop March 2026: 78 out of 100.

Zoho Vault (India)

Mainly intended for businesses. Sign up via zoho.eu and your vault is stored in Amsterdam or Dublin. Free for one person, with 2FA codes and passkeys. Sharing only for business users.

Reviews: App Store 4.7, Google Play 3.9. The Trustpilot score of 3.8 applies to Zoho as a whole.

Apple Passwords (United States)

Built into your iPhone, iPad and Mac. Free, encrypted so that Apple can't access it, with passkeys and 2FA codes. You can share using shared groups. On Windows it works via iCloud for Windows and an extension. It doesn't work on Android. There is no separate master password: you unlock with your passcode or Face ID.

Reviews: App Store 4.7 (Passwords app). Macworld 4 out of 5.

LastPass (United States)

From Boston. Your vault is stored in the US; only business customers can move to the EU. In the 2022 breach, encrypted vaults were stolen. In 2025 LastPass paid a settlement in the US, and in November 2025 it was fined by the UK data protection regulator. The free version works on one type of device (computer or phone).

Reviews: Trustpilot 1.4 (946), App Store 4.4, Google Play 3.8. Test-Aankoop March 2026: 80 out of 100, joint best in the test. That test mainly looked at features, not at the breach.

Google Password Manager (United States)

Built into Chrome and Android. Free, with passkeys, but without 2FA codes. Sharing only with your Google family group. According to the BSI, Google itself can access your passwords if you don't set your own passphrase. If you use it, turn on on-device encryption in the settings. It doesn't work in Safari or Firefox.

SecureSafe (Switzerland)

Password vault and file vault with data centres in Switzerland. According to the BSI study of December 2025, the maker can access your passwords. That's why it gets a 1 for security.

Firefox passwords (United States)

From the non-profit Mozilla. Works in Firefox on all your devices, encrypted so that Mozilla can't access it. Doesn't store passkeys or 2FA codes. The master password (Primary Password) is off by default: turn it on. In December 2025 the BSI had no major objections. Only works in Firefox.

Norton Password Manager (United States)

From Gen Digital, also the owner of Avast and AVG. Free, only as a browser extension and phone app. No passkeys, no sharing and no emergency access. No known independent audit. At the end of 2022, attackers got into about 6,450 accounts using passwords stolen elsewhere.

Reviews: App Store 4.5, Google Play 4.4. The Trustpilot score of 4.7 applies to Norton as a whole.

Samsung Pass (South Korea)

Built into Samsung Galaxy phones. Free, with passkeys. It doesn't work on an iPhone or an Android phone from another brand, and only to a limited extent on your computer. That's why it gets a 1 for ease of use.

Edge passwords (Microsoft, United States)

Built into the Edge browser. Since August 2025, Microsoft Authenticator no longer fills in passwords; your passwords are now stored in Edge. No 2FA codes, and passkeys initially only on Windows. In April 2026 it emerged that Edge loads all your passwords unencrypted into memory at startup. Microsoft says this is by design. Only works in Edge.

Kaspersky Password Manager (Russia)

See "What we advise against". In 2021 it emerged that the password generator created predictable passwords (since fixed).

For businesses

For a team you need user management: who can see which passwords, and what happens when someone leaves. These options come from Europe or have an EU region:

Passbolt and Psono are regularly audited by Cure53 and others. For Uniqkey we found no public independent audit. If you want a team vault on your own server, you can set one up on a WebOké VPS with Vaultwarden, Passbolt or Psono. You then handle the management yourself.

Sources

The makers' websites and help pages, the audit reports published by the makers, the study of password managers by the BSI and the Verbraucherzentrale NRW (December 2025), Test-Aankoop (March 2026), Stiftung Warentest (2022), Trustpilot, the App Store and Google Play (10 November 2026).

Tip: You can always switch later. Almost all managers can export and import your vault (see Making a backup or export of your vault and Switching from LastPass, Bitwarden or another manager).