Password managers compared

A password manager creates a different strong password for every site and fills it in for you, so one leaked password can't open the rest of your accounts. You protect the whole vault with one master password. The good ones use "zero-knowledge" encryption: your vault is encrypted on your device with a key derived from your master password, and the company only stores the scrambled result. This page compares what each maker publishes about its security, as of November 13, 2026. Tunnelcheck hasn't tested these apps, and we don't list prices because they vary by region; see each official pricing page.

Password managers at a glance

Bitwarden

Bitwarden's whole codebase is public on GitHub under the AGPL v3.0 or Bitwarden License. It publishes a long list of third-party assessments, including Cure53 penetration tests and audits from 2018 to 2025, a 2025 review of its core cryptography by ETH Zurich's Applied Cryptography Group that assumed a malicious server, and reviews by Fracture Labs, IOActive, Mandiant and Palo Alto Networks' Unit 42 (Bitwarden: audits). Its free plan includes unlimited passwords on unlimited devices (Bitwarden). You can also host the server yourself.

1Password

1Password adds a second secret to your master password: a 34-character Secret Key generated on your device. 1Password never receives it. Your password and Secret Key together form the encryption key, so someone who steals 1Password's server data would also need your Secret Key, which 1Password says adds 128 bits of strength and is "infeasible to guess" (1Password Support). The trade-off: if you lose both your devices and your Emergency Kit, nobody can recover your data.

Proton Pass

Proton Pass comes from Proton, the Swiss company behind Proton Mail and Proton VPN. Proton says Pass encrypts your data end to end, including metadata, that all Proton Pass apps are open source, and that it has been audited by independent experts with the reports made public (Proton Pass security). See our Proton VPN review for the company's VPN.

KeePassXC

KeePassXC takes the opposite approach to the cloud apps. Your passwords live in "an offline, encrypted file that can be stored in any location", and nothing is stored on its servers. It's open source under GPLv3, runs on Windows, macOS and Linux, and version 2.7.9 received a first-level security certification (CSPN) from France's cybersecurity agency, ANSSI (KeePassXC). Syncing between devices is up to you, for example by keeping the file in a cloud folder you already use. It suits people who want control and don't mind the extra setup.

Apple Passwords

Apple turned its built-in keychain into a separate Passwords app with iOS 18, iPadOS 18, macOS Sequoia and visionOS 2 in 2024. It stores passwords, passkeys and verification codes, syncs through iCloud Keychain, and reaches Windows through the iCloud for Windows app, including in Chrome and Edge (Apple Support, Apple Newsroom). It's a good choice if you live in Apple's ecosystem. It doesn't run on Android or Linux.

Dashlane

Dashlane ended its free plan on September 16, 2025. Free users were moved to a temporary Premium trial from August 5, 2025, then had to upgrade or export their data (Dashlane).

What happened in the LastPass breach

LastPass's 2022 breach is the best-documented failure in this market, and it explains what to look for.

1. August 2022: source code stolen LastPass disclosed that an attacker used a compromised developer account to get into part of its development environment and took source code and technical information. It said at the time that no customer data or vaults were accessed (LastPass).
2. Late 2022: vault backups copied Using what was taken in August, the attacker targeted another employee and got credentials and keys to a cloud storage service. On December 22, 2022, LastPass said the attacker copied customer account data (names, email and billing addresses, phone numbers, IP addresses) and a backup of customer vaults. Vault passwords and notes stayed encrypted, but some fields, such as website URLs, were not (LastPass).
3. How they got in LastPass later said the attacker installed a keylogger on a senior DevOps engineer's home computer through a vulnerable third-party media software package, and captured the engineer's master password after they signed in with multi-factor authentication (GovInfoSecurity).
4. 2023 to 2025: cryptocurrency thefts Anyone holding the stolen vaults can try to guess weak master passwords offline. Blockchain analytics firm TRM Labs has linked a series of cryptocurrency thefts to vaults decrypted after the breach (TechRadar).
5. November 2025: UK fine The UK Information Commissioner's Office fined LastPass UK Ltd £1,228,283 in a penalty notice dated November 20, 2025, for failing to keep personal data of up to 1.6 million UK users secure. The ICO noted that customer passwords stayed protected by the zero-knowledge design (ICO, ICO penalty notice).

The lesson: zero-knowledge encryption held, but a stolen vault is only as safe as the master password protecting it, and fields left unencrypted, like URLs, leak information. Look for a manager that encrypts all fields, uses a strong key-stretching setting, and publishes audits. 1Password's Secret Key design is one answer to this exact scenario.

How to choose a password manager

• Pick a long master password you've never used anywhere else. A random passphrase of several words is easier to remember than a jumble of symbols.
• Turn on two-factor authentication for the password manager account itself.
• Prefer published audits and open code. Bitwarden publishes the most third-party reports of the apps here; KeePassXC, Bitwarden and Proton Pass are open source.
• Decide where your vault should live. Cloud sync is easiest; a local KeePassXC file gives you full control.
• Check your exit route. Dashlane's free users had to export when the plan ended. Make sure your manager can export to a standard format.
• Use passkeys where sites offer them. Apple Passwords and Bitwarden, for example, store them alongside passwords.

A password manager protects your accounts; a VPN protects your connection. They solve different problems. If you use public Wi-Fi often, see public Wi-Fi safety.