Open source password managers you can trust (and self-host)

A password manager holds the keys to everything else, so being able to read its code matters. Open source does not make a vault secure on its own. It does let independent researchers inspect the encryption, and it gives you a way out if the company behind your vault changes direction.

The four projects below cover the common cases: a hosted service with open code, a self-hosted server, an offline vault file, and a team tool built for sharing credentials. We checked licenses and recent releases on October 5, 2026.

Quick comparison

Project	Where your vault lives	License	Best for
Bitwarden	Bitwarden’s cloud or your server	AGPL-3.0 server, GPL-3.0 apps	Most people and families
Vaultwarden	Your server, with Bitwarden apps	AGPL-3.0	Home servers and small groups
KeePassXC	An encrypted file you control	GPL-2.0 or 3.0	Offline, account-free use
Passbolt	Your server	AGPL-3.0 (Community Edition)	Teams sharing credentials

Bitwarden: the safe default

Bitwarden offers apps for every major platform, browser extensions, and a hosted service with a free plan. Its server code is AGPL-3.0 and its client apps are GPL-3.0. Some business features live in a separate directory under the Bitwarden License, so read the license file if you plan to self-host for an organization.

Choose it when you want a password manager that a non-technical family member can use from day one.

Vaultwarden: self-hosting on a small server

Vaultwarden is a lightweight server written in Rust that speaks the Bitwarden API. You keep using the official Bitwarden apps and extensions, but your vault lives on hardware you run. It is far lighter than the official self-hosted stack, which makes it popular on home servers.

It is unofficial and not affiliated with Bitwarden. You are responsible for HTTPS, updates, and backups.

KeePassXC: no server at all

KeePassXC stores your passwords in an encrypted KeePass database file. There is no account and no cloud. A browser extension fills logins on desktop, and the same file format is supported by KeePass-compatible apps on phones.

The trade-off is syncing. If you want the vault on several devices, you choose how to move the file, for example with Syncthing.

Passbolt: built for teams

Passbolt is designed for sharing credentials across a team. Each user has their own OpenPGP key, and every shared secret is encrypted for each person who may read it. The Community Edition is AGPL-3.0; features such as single sign-on are in the paid Pro edition.

Choose it when a development or IT team needs to share infrastructure access with clear permissions.

What self-hosting really involves

Running your own vault removes a third party, but it adds work that cannot be skipped:

1. Serve it over HTTPS only, and keep the server off the open internet if you can, for example behind a VPN.
2. Update promptly. A password server is a high-value target, so security releases cannot wait for a quiet weekend.
3. Back up the database and keys, then restore them to a clean machine at least once. An untested backup is a guess.
4. Plan for when you are unavailable. Someone in your family or team should know how to reach the vault if you cannot.

If that list sounds like a burden, use Bitwarden’s hosted service or a KeePassXC file. Both are open source and need no server.

How to choose

• You want the easiest switch from LastPass or 1Password: Bitwarden.
• You run a home server and want Bitwarden apps on your own hardware: Vaultwarden.
• You want no account and no server: KeePassXC.
• Your team shares server and service credentials: Passbolt.

Looking for other privacy-friendly swaps? See our self-hosted Google Drive alternatives or browse the directory.