Password Managers

Vaultwarden70.3k★

Vaultwarden is an unofficial, lightweight Bitwarden-compatible server written in Rust. Point the official Bitwarden apps (desktop, mobile, browser extension, CLI) at it and you get organizations, sharing, attachments, Send, emergency access and the built-in TOTP authenticator, with every user treated as Premium. AGPL-3.0, and not affiliated with Bitwarden. It's one Docker container on SQLite by default (MySQL and Postgres work too), and it runs happily on a Raspberry Pi. It needs HTTPS, because the web vault won't work without a secure context, so plan on a reverse proxy and certificates. OIDC single sign-on landed in late 2025; a master password is still required. The comparison: Bitwarden Premium is $19.80 a year and Families is $47.88 a year for six people, and Bitwarden's free plan already covers basic sharing and text Send. For one person the savings are small; the case is control and Premium features for a whole household or small team. Bitwarden Teams ($4 per user a month) and Enterprise ($6) bring vendor support and compliance paperwork vaultwarden can't. The catch: updates aren't optional. New Bitwarden client releases regularly require a matching vaultwarden update, and the security advisory volume is real: 1.37.4 in October 2026 fixed seven, one rated high. Self-hosting your passwords means patching promptly, every time.

keepassxc29.8k★

KeePassXC is the password manager with no server, no account and no subscription. Your vault is one encrypted KDBX file on your own disk, and the app runs natively on Windows, macOS and Linux. Browser autofill, passkeys, TOTP codes, an SSH agent, YubiKey support and a password generator are all free. France's cybersecurity agency ANSSI certified version 2.7.9. There is nothing to host. Sync is your job: put the file in Syncthing, iCloud or Dropbox, and version 2.8.0 (October) can also merge with remote copies through external tools. KeePassXC is desktop only, so phones need a KDBX app like KeePassDX on Android or Strongbox and KeePassium on iOS. Solo users who want full control should start here. Small groups can share folders of entries through KeeShare, which syncs via shared files, but there are no roles, no admin console and no clean offboarding. A team canceling LastPass or 1Password wants Bitwarden or Passbolt. The catch is that you are the sync infrastructure and the recovery plan. Lose the file or the master password and nobody can help. Also update: 2.8.0 fixed five published advisories, including a browser-extension bug that allowed limited data exfiltration.

Bitwarden20.6k★

Bitwarden is the open source password manager that won. This repo is the backend: the APIs, database, and infrastructure behind every Bitwarden client. The hosted free tier already covers unlimited passwords on unlimited devices, which is more than most paid competitors give you. Self-hosting the official server is a real deployment: a fleet of Docker containers with SQL Server underneath, installed by script. It works and it's documented well, but it's built for organizations. Most homelabbers who just want their own vault run Vaultwarden (dani-garcia/vaultwarden) instead, a lightweight reimplementation that works with the same client apps. Solo: the free cloud tier, and Premium is $1.65 a month if you want built-in TOTP. Families runs $3.99 a month for six people. Teams and enterprises pay per user and get SSO, directory sync, and admin policies, which is exactly the kind of thing that should be paid. The catch: the enterprise features live in source-available modules under a separate Bitwarden license, not the AGPL core. You can read the code, but self-hosting doesn't unlock them without a paid license key.

Passbolt6.2k★

Passbolt is a password manager built for teams, with end-to-end encryption and user-owned secret keys. The Community Edition gives you password management, shared folders, browser extensions, mobile apps, CLI access, and 2FA. No user limits, no password limits. Self-hosting runs on PHP with MySQL or PostgreSQL. Docker and VM appliance options are available. The setup is straightforward, and the security model is solid: regular third-party audits with published findings. Ongoing maintenance is light if you keep PHP and the database healthy. Solo and small teams get a capable password manager for free. Once you need LDAP provisioning, SSO (Microsoft, Google, OpenID), or audit logging, you are looking at the Business tier at $4.90/user/month (minimum 10 users). That is a fair paywall. SSO and audit logs are enterprise features that cost real money to build. The catch: the 10-user minimum on the Business plan means small teams pay $49/month even if they only have 3 people who need SSO. If that pricing math does not work, Vaultwarden covers similar ground with a lighter footprint.