Password managers compared: Bitwarden, 1Password, KeePassXC, and Proton Pass
Every few years we re-evaluate whether we're recommending the right password manager, and every few years it comes down to the same five options. Here's the comparison — Bitwarden, 1Password, KeePassXC, Proton Pass, and the free vaults built into your browser or OS.
The built-in option: Apple, Google, and browser vaults
iCloud Keychain, Google Password Manager, and the save-password prompts in Chrome or Edge are free, require zero setup, and sync automatically across your devices. For most people, this is a real upgrade over password reuse, and it shouldn't be dismissed.
The catch is platform lock-in. iCloud Keychain is painful outside Apple hardware; Google's vault leans heavily on being logged into Chrome. Sharing a login with someone outside your ecosystem, or auditing which sites reuse a password, is clunky or unsupported. Fine as a floor, not great as a long-term home for your vault.
Bitwarden
Open source, independently audited, and the most generous free tier of any dedicated manager — unlimited passwords and devices, with paid tiers mainly adding encrypted file attachments, emergency access, and advanced 2FA storage. It self-hosts if you want that, and its browser extension and apps are solid, if not the most polished.
The main tradeoff is UI: Bitwarden feels utilitarian next to 1Password. For most people that's a fair trade for open-source code and a free tier that isn't a trial.
1Password
The most polished experience of the group, with strong family and team sharing, Travel Mode (temporarily strips vaults from a device before crossing a border), and consistently good app design across platforms. It's closed source, subscription-only, and there's no free tier — you get a trial and then you pay.
Worth it if you value the UX and the sharing features, especially for families or small teams. Harder to justify if you're single-user and cost-sensitive, since Bitwarden covers the same core job for free.
KeePassXC
The odd one out: no built-in sync, no company behind it, and no subscription — just a local encrypted database file you control completely. Pair it with Syncthing, Dropbox, or a private server for cross-device sync, and it's arguably the most private option here, since nobody but you ever touches the vault.
The cost is that you own the sync problem. Mobile support is community-built and rougher, and there's no vendor to call if you lock yourself out. Best fit for people who specifically don't want a cloud vendor in the loop.
Proton Pass
The newest entrant, from the Proton Mail/VPN team, with the same end-to-end encryption ethos and a genuinely useful free tier that includes email aliasing alongside password storage. If you're already in the Proton ecosystem it's a natural add — but it's the least battle-tested of the group, with a smaller third-party audit history than Bitwarden or 1Password.
If you want the least friction: use whatever your phone or browser already gives you, and turn on 2FA everywhere. If you want a dedicated vault, Bitwarden is our default recommendation — open source, audited, and free doesn't mean crippled. Pay for 1Password if the sharing features and UI polish are worth the subscription. Reach for KeePassXC only if you specifically want zero cloud vendor involved and don't mind managing your own sync.
Whichever you pick, the real upgrade is moving off browser-saved passwords with no master password at all, or worse, a password reused everywhere — see our threat brief on why credential stuffing still works for exactly what that reuse costs you.