Password Managers

Vaultwarden68.0k★

Vaultwarden is a lightweight, unofficial Bitwarden-compatible server written in Rust. It uses the same Bitwarden apps and browser extensions but runs on a fraction of the resources. A Raspberry Pi handles it fine. AGPL v3. Implements the Bitwarden API so all official Bitwarden clients (desktop, mobile, browser extensions, CLI) connect to it without issues. Supports organizations, password sharing, TOTP (two-factor codes), file attachments, and the Send feature, all features that Bitwarden's official server gates behind paid plans. Fully free to self-host. No paid tier. Features that cost $10/year on Bitwarden's hosted service (TOTP, emergency access, vault health reports) are free on Vaultwarden. Premium features unlocked for everyone. Setup: Docker container with a SQLite database. Takes 10 minutes. Runs on 50MB of RAM. Ops: minimal. Update the container occasionally, back up the SQLite file. Solo and family use: this is a no-brainer if you're comfortable with Docker. Small teams: works great with organizations feature. The catch: it's an unofficial implementation. Bitwarden could change their API and break compatibility (hasn't happened in years, but the risk exists). There's no commercial support. And if you lose your server without backups, your passwords are gone. Backups are not optional. Automate them.

keepassxc28.8k★

KeePassXC is the password manager with no server, no account, and no subscription. Your vault is a single encrypted KDBX file on your own disk, and the app runs natively on Windows, macOS, and Linux. Everything is free: browser integration, TOTP codes, passkey support, an SSH agent, and a password generator. There is nothing to operate because there is nothing to host. Syncing across devices is your job: put the vault file in Syncthing, iCloud, or Dropbox and you get multi-device access without trusting a password company at all. Mobile means compatible apps like KeePassDX on Android or Strongbox on iOS, since KeePassXC itself is desktop only. Solo users who want maximum control should start here. Teams should not: there's no sharing model, no roles, and no admin console. A team canceling LastPass wants Bitwarden (bitwarden/server) or Passbolt (passbolt/passbolt_api), not a shared KDBX file. The catch is that you are the sync infrastructure and the recovery plan. Lose the file and the master password, and nobody can help you.

Bitwarden20.2k★

Bitwarden is the open source password manager that won. This repo is the backend: the APIs, database, and infrastructure behind every Bitwarden client. The hosted free tier already covers unlimited passwords on unlimited devices, which is more than most paid competitors give you. Self-hosting the official server is a real deployment: a fleet of Docker containers with SQL Server underneath, installed by script. It works and it's documented well, but it's built for organizations. Most homelabbers who just want their own vault run Vaultwarden (dani-garcia/vaultwarden) instead, a lightweight reimplementation that works with the same client apps. Solo: the free cloud tier, and Premium is $1.65 a month if you want built-in TOTP. Families runs $3.99 a month for six people. Teams and enterprises pay per user and get SSO, directory sync, and admin policies, which is exactly the kind of thing that should be paid. The catch: the enterprise features live in source-available modules under a separate Bitwarden license, not the AGPL core. You can read the code, but self-hosting doesn't unlock them without a paid license key.

Passbolt6.1k★

Passbolt is a password manager built for teams, with end-to-end encryption and user-owned secret keys. The Community Edition gives you password management, shared folders, browser extensions, mobile apps, CLI access, and 2FA. No user limits, no password limits. Self-hosting runs on PHP with MySQL or PostgreSQL. Docker and VM appliance options are available. The setup is straightforward, and the security model is solid: regular third-party audits with published findings. Ongoing maintenance is light if you keep PHP and the database healthy. Solo and small teams get a capable password manager for free. Once you need LDAP provisioning, SSO (Microsoft, Google, OpenID), or audit logging, you are looking at the Business tier at $4.90/user/month (minimum 10 users). That is a fair paywall. SSO and audit logs are enterprise features that cost real money to build. The catch: the 10-user minimum on the Business plan means small teams pay $49/month even if they only have 3 people who need SSO. If that pricing math does not work, Vaultwarden covers similar ground with a lighter footprint.