Question Best password manager ( Free & Paid ) & why ?

[Game Of Thrones]

1Password. Simply the best. Period!
I've tried everything, literally everything. 1Password is the most robust...

exactly, nothing beats them in paid market. there is 1password and there are others. i tested every password manager read their whitepaper thoroughly , others like bitwarden proton etc are toys compared to it.their response to security vulnerability is the best in industry, they are getting audited many times per year. the form filling and password fields detection is the best iv seen many websites that nearly all password managers had problem but not 1password

 

[sophiakaile]

I use Bitwarden for many security reasons plus it is open source

 

[I Walk MY Way]

Changing my vote to Bitwarden I have used Norton for many years, so I decided to give another try, and I am loving it, Bitwarden all the way ,,

 

[lokamoka820]

Can you recommend KeePass plugins/extensions to make it act exactly as KeepassXC? I'm asking because there are too many plugins/extension/clients, and I don't know what to trust, after all it is a password manager, and you have to add something tested and trusted to extend its functionality.

UPDATE:

After testing many plugins on KeePass, I found those gave me the best usability I needed:



@ErzCrz, do you know any security/privacy issues with these plugins based on your experience?

 

[ErzCrz]

UPDATE:

After testing many plugins on KeePass, I found those gave me the best usability I needed:

View attachment 287938

@ErzCrz, do you know any security/privacy issues with these plugins based on your experience?

Nice. I haven't noticed any security or privacy issues. I have explained above in post 108 how to use the built-in TOTP which I discovered. The only plugin I'm currently using is the Early Update check

 

[IceMan7]

I use Bitwarden for many security reasons plus it is open source

1. Cloud on Microsoft servers is not really secure. ,
2. What does it matter that it's open source? I recently read an interview where even those who check software and issue a certificate don't review all the software because it's too time-consuming for them.
3. Brave is open source and despite that, it's still earned its share of failures recently.
4. Bitwarden is the most popular right now and will probably be the first to be attacked like LastPass.

The most secure is local KeePass/XC. Passwords are only yours and not in the cloud at someone else's service.

That's my opinion. But it's known that sometimes due to convenience (because the cloud) many people forget about security or falsely believe assurances.

 

[n8chavez]

But bitwarden can he self-hosted. That way you have the best of both worlds.

 

[lokamoka820]

Nice. I haven't noticed any security or privacy issues. I have explained above in post 108 how to use the built-in TOTP which I discovered. The only plugin I'm currently using is the Early Update check

Thanks. I tried to use the built-in TOTP, but it was not convenient as the plugin, it didn't remove spaces in secret codes by default, it gives error until I remove spaces manually.

 

[IceMan7]

But bitwarden can he self-hosted. That way you have the best of both worlds.

California USA Headquarters. Certainly the best in the world NSA, CIA, FBI... it's definitely a safe place for passwords :] And of course, by law in the USA they don't have any lock picks
You might as well email them the passwords as you would Google Password Manager
I'm not defending. Everyone uses what they want. We have freedom. I'm just pointing out certain things.

 

[Back3]

I use KeePass as a vault for all my passwords. On my PC, I use Proton in my browsers. On my iPhone, I prefer Apple's password manager, which I find user-friendly.

Last week, I assisted my brother-in-law in securing his passwords. He had stored 42 passwords in his Apple password manager, but 30 of them were insecure. Among those, 15 consisted of only 5 characters, and he was using the same password for multiple accounts, including his bank account. It took me two hours to resolve everything. He was unaware of the existence of his password manager and had no idea how to use it. I’ve done the same task for five friends, and encountered the same issues each time.

 

[IceMan7]

I can never get around to it I admit that I installed KeepassXC on my computer about 6 months ago. But I haven't started it yet It will definitely be my vault of all passwords.
So far, I've only been using Apple's manager on my iPhone for years, but only for applications that I have installed on my phone or where I log in from my phone.
For today, old school - a notebook
More managers that are unnecessary in my opinion than these two. KeepassXC will probably be backed up in the Proton cloud and on a pendrive or external drive. Of course, packed and password-locked.

BTW The passwords that I won't save in the password manager are - Apple account for iPhone, email, computer login password, bank password.

 

[n8chavez]

California USA Headquarters. Certainly the best in the world NSA, CIA, FBI... it's definitely a safe place for passwords :] And of course, by law in the USA they don't have any lock picks
You might as well email them the passwords as you would Google Password Manager
I'm not defending. Everyone uses what they want. We have freedom. I'm just pointing out certain things.

Um...I don't think you know what the term "self-hosted" means.

 

[lokamoka820]

KeepassXC will probably be backed up in the Proton cloud and on a pendrive or external drive.

Looks like a nice setup. Does Proton Drive reliable enough now to replace Microsoft OneDrive on Windows, or Mega will be a better option?

 

[Digmor Crusher]

Looks like a nice setup. Does Proton Drive reliable enough now to replace Microsoft OneDrive on Windows, or Mega will be a better option?

I find Proton to be more reliable then OneDrive which had frequent glitches when I used it.

 

[n8chavez]

I find Proton to be more reliable then OneDrive which had frequent glitches when I used it.

Completely agree! Proton products are impressive.

 

[IceMan7]

Looks like a nice setup. Does Proton Drive reliable enough now to replace Microsoft OneDrive on Windows, or Mega will be a better option?

I don't know yet. I don't use Microsoft or Google cloud. For obvious reasons. If I had to choose the least evil, I would choose iCloud.
Passwords need to be backed up somewhere. So I would do it on the Proton cloud. And additionally on a pendrive or external drive.

Generally, I'm not in favor of keeping anything in the cloud, so I keep very little there. Your own drive is your own drive.
But I don't use ProtonPass and I don't intend to. I have email and VPN (free) from Proton. Two services are enough. You can't put all your eggs in one basket. That's my rule.

Apart from Proton VPN, I also use Windscribe sometimes.
I provided the password manager - KeepassXC (computer) and Keychain from Apple (iPhone). Mail on Proton and the provider of one of the portals in my country. Generally, I try not to have diversified services in one bag, I avoid Google services and if I ever switched to Mac, I would also free myself from Microsoft

But these are my rules. Everyone does as they like and on their own responsibility

 

[Kaffee4Eck]

Bitwarden / Vaultwarden — Why?
Quite simple: because you can self-host it, everything is fully encrypted, and you have the ability to sync multiple instances, allowing you to set up failover scenarios. Most importantly, you remain in full control of your credentials and data—no third-party dependency, no compromise on privacy.

You can also easily install and set it up on a VPS, and for example, synchronize it with a self-hosted Docker instance at home. This allows for flexible, secure deployment while maintaining full control over your data.

 

[IceMan7]

I don't know why people are so naive. I guess they know perfectly well that if it's open source and free, Bitwarden will probably be so great. VPNs were also supposed to be so safe, but then it turns out that almost everyone openly or covertly collects something. Bitwarden is an American company that uses the American Microsoft cloud. Even if someone sets up a cloud themselves (you can self-host it), the program is still written by an American company. And an American company (like a Chinese one) means no privacy. I don't even trust the praised Proton, but I would save passwords there faster than in Bitwarden. But that's none of my business. Let others live in the illusion that free American software gives them a guarantee that their passwords remain private. I don't care.

 

[Kaffee4Eck]

I don't know why people are so naive. I guess they know perfectly well that if it's open source and free, Bitwarden will probably be so great. VPNs were also supposed to be so safe, but then it turns out that almost everyone openly or covertly collects something. Bitwarden is an American company that uses the American Microsoft cloud. Even if someone sets up a cloud themselves (you can self-host it), the program is still written by an American company. And an American company (like a Chinese one) means no privacy. I don't even trust the praised Proton, but I would save passwords there faster than in Bitwarden. But that's none of my business. Let others live in the illusion that free American software gives them a guarantee that their passwords remain private. I don't care.

I completely understand your skepticism — especially when it comes to U.S.-based software companies and cloud services. Trust, in the world of privacy and security, should never be blind — and questioning even open-source solutions is not only fair but healthy.

However, in the case of Bitwarden and especially Vaultwarden (the community self-hosted variant), there are important distinctions to be made:

---

Why Bitwarden/Vaultwarden can still be secure and private — even if based in the U.S.:​

1. Zero-Knowledge Encryption by Design
   • All data is encrypted client-side (locally in your browser/app) using well-vetted cryptographic standards (e.g. AES-256, PBKDF2, Argon2).
   • Bitwarden (and Vaultwarden) servers never see unencrypted data, including your master password or vault contents.
2. Open Source Codebase
   • The entire codebase is public, regularly audited, and reproducible.
   • Anyone can inspect, compile, or even fork it. It’s not "trust us", it’s trust but verify.
3. Self-Hosting Removes the Cloud Trust Factor
   • Vaultwarden can be hosted entirely offline or behind firewalls.
   • There is zero dependency on Bitwarden.com or Microsoft Azure if you don’t want it.
   • All secrets stay within your infrastructure, under your full control.
4. Audits & Cryptography Standards
   • Bitwarden undergoes regular third-party security audits, with public reports (e.g., from Cure53).
   • No known backdoors, no "silent" data exfiltration.

---

Addressing the “American Company = No Privacy” point:​

You're absolutely right that U.S. law (like FISA, CLOUD Act) can compromise data privacy for cloud-hosted U.S. services.
But Vaultwarden:

• does not rely on any U.S. infrastructure if self-hosted
• does not transmit cleartext data
• and is fully auditable, even if the original repo is U.S.-based.

So unless a mathematical backdoor is introduced (which would be publicly detectable), even U.S. jurisdiction can’t decrypt locally encrypted data.

---

Compared to Proton?​

Proton is excellent — but it’s closed-source in parts, relies on Swiss jurisdiction (which is great), but also still has to comply with court orders if forced.
Bitwarden gives you more control if self-hosted, not less.

---

TL;DR:​

No software is perfect, but Vaultwarden combines zero-knowledge encryption, full open-source transparency, and self-hosting freedom — a rare trio.
If configured properly, it's more private than 99 % of commercial password managers, regardless of national origin.

 

[IceMan7]

Yes, I am skeptical for many reasons.

I don't know what sources you are citing and what you are quoting, but:
1. Just because it is open source does not mean that its code has been analyzed from A to Z. I have read many articles where these audits of external companies do not analyze the entire code out of "laziness".
2. Brave is also an open source browser and no one has detected any mistakes in its code. People have only just realized that they had add-ons like a miner installed with the browser.
3. How many people use the paid Bitwarden? A promille probably. The company gives you full security for free? Do you believe in that? Google also provided privacy in many cases and then there was one blunder after another.
4. How can you be sure that they do not have some kind of a skeleton key, since they are subject to American law?
5. How many people make their own hosting? Most of them fly due to lack of knowledge or convenience on Bitwarden's cloud solution on Microsoft servers
6. After the LastPass mishap, Bitwarden gained popularity. Are you sure that a company that makes pennies will defend its customers? Or won't get a warrant from some 3-letter US law?
7. VPNs weren't supposed to collect anything either. You could read almost everyone's certainty of 100% privacy. The truth turned out to be different.
8. And many other things. Free, from the US, cloud in Microsoft, popular, etc. Just connect the dots.

Yes, Proton is subject to Swiss law, but if they don't collect anything, they have nothing to pass on to third parties. Nevertheless, I don't believe it at all. The old wise proverb - if something is in the cloud (any cloud service) it's not just yours anymore. Especially when you see that Bitwarden is a US company.

If someone believes that Bitwarden is so wonderful because it provides this and that (and is from the US), let them believe it. I am not easily loyal. And that is why I think it is not the best and most secure.
The current popularity of password managers definitely has a second layer. And in my opinion, these are just another privacy thief.

The best password manager is a local Keepass. Passwords are only yours. Or a notebook

PS
I am not belittling the functionality of Bitwarden. Simple, easy to use, many functions in the free version. You don't even need a paid version, because in the free version you have almost everything in the options.
But in terms of security, I already trust Proton faster. But I don't even trust them 100%.