Best password managers of 2026: top 8 free and paid

The best password manager for most people in 2026 is the free Bitwarden: it stores unlimited passwords and passkeys on any number of devices, and its code is open and checked by independent auditors every year. For privacy, go with Proton Pass; on iPhone and Mac, the built-in Passwords app; on Android and in Chrome, Google Password Manager; on Windows with Edge, Microsoft Password Manager.

This list covers eight services that are current as of September 25, 2026. Six of them are free with no limits on passwords or devices, NordPass’s free version works on one device at a time, and 1Password only offers a trial. We compared free plans, prices, platforms, passkey support, encryption and published security reviews using official websites — the editors did not test the apps themselves.

How we picked

• An honest free plan. We looked at how many passwords and devices it allows and what sits behind the paywall: 2FA codes, password sharing, breach checks.
• Security you can verify. End-to-end or zero-knowledge encryption, open source code and independent security reports, where the maker publishes them.
• Passkeys. All eight managers can store passkeys — passwordless sign-in based on the FIDO standard.
• Platforms. Windows, macOS, Linux, iOS, Android and browsers: whether one manager works across all your devices.
• Being current. Only services that are running and updated in September 2026. Discontinued free plans and retired features are covered in “Who didn’t make the list and why.”

1. Bitwarden

Best freePassword manager

Bitwarden

Free

unlimited passwords and devices

Passkeys

yes, on phones with iOS 17 and Android 14 or later

Password sharing

free with one other person

Premium

2FA codes, 5 GB for files, emergency access

Encryption

zero-knowledge

Code

open source

2025 audits

Cure53, ETH Zurich, Unit 42

WindowsmacOSLinuxiOSAndroidWeb

PriceFree; Premium $19.80 a yearchecked 25 September 2026

The best pick for most people: a full-featured free password manager on every device, with open source code and yearly audits.

Pros

• Unlimited passwords and devices for free
• Open source code and 2025 audits
• Free password sharing with one person

Cons

• 2FA codes and attachments are Premium-only
• Passkeys on phones need iOS 17 or Android 14

Visit Bitwarden

Free Bitwarden is a complete password manager with no limits on passwords or devices: desktop and mobile apps, browser extensions, a password generator, passkey storage and breach checks. The free plan protects your Bitwarden login with two-step verification through an authenticator app, email or a hardware key, and you can share passwords with one other person through a free two-person organization.

Bitwarden’s code is open source and audited every year: in 2025, Cure53 and Palo Alto Networks’ Unit 42 reviewed the apps, and the Applied Cryptography Group at ETH Zurich reviewed the cryptography. Premium costs $19.80 a year ($1.65 a month) and adds built-in 2FA codes, 5 GB for files, emergency access and vault health reports. The Families plan for six people costs $47.88 a year.

2. Proton Pass

Best for privacyPassword manager

Proton Pass

Free

unlimited passwords and devices

Email aliases

10, unlimited in Pass Plus

Vaults

2, 50 in Pass Plus

Passkeys

yes, on all devices

Encryption

end-to-end

Code

open source (extensions, iOS, Android)

Audits

Cure53 (2023), Recurity Labs (2026)

WindowsmacOSLinuxiOSAndroidWeb

PriceFree; Pass Plus from $2.99 a monthchecked 25 September 2026

A free manager with end-to-end encryption and email aliases — for people who want to hide both their passwords and their real email address.

Pros

• Unlimited passwords and devices for free
• 10 email aliases on the free plan
• Open source code, 2026 audit

Cons

• 2FA codes and attachments need Pass Plus
• Only 2 vaults on the free plan

Visit Proton

Proton Pass comes from Proton, the Swiss company behind Proton Mail and Proton VPN. For free, it stores unlimited logins, notes and payment cards on any number of devices, supports passkeys and warns you about weak and reused passwords. Its standout feature is email aliases: when you sign up for a site, Proton Pass creates a separate address, so your real inbox stays hidden. The free plan includes 10 aliases.

The code of Proton Pass’s browser extensions and mobile apps has been open source since 2023, when Cure53 audited them. From January to April 2026, Recurity Labs reviewed the apps, extensions and command-line tool: it found no way to hack a user through a malicious site or link and no way to bypass the encryption.

On September 25, Proton’s website listed Pass Plus at $4.99 a month, or $2.99 a month billed annually ($35.88). It adds built-in 2FA codes, attachments, dark web monitoring and emergency access. Pass Family for six people costs $4.99 a month billed annually.

3. Apple Passwords

Best for iPhone and MacBuilt-in password manager

Apple Passwords

Systems

iOS 18, iPadOS 18, macOS Sequoia, visionOS 2 or later

Stores

passwords, passkeys, verification codes, Wi-Fi passwords

Sharing

shared groups

Windows

iCloud Passwords app and extension for Chrome, Edge, Firefox

Encryption

end-to-end by default

Code

closed source

iOSiPadOSmacOSvisionOSWindows

PriceFreechecked 25 September 2026

The best option if you use an iPhone and a Mac: everything is built in, free and protected by end-to-end encryption.

Pros

• Free and already on iPhone, iPad and Mac
• End-to-end encryption by default
• 2FA codes and passkeys in one app

Cons

• Officially only Apple devices and Windows
• On Windows, works through iCloud for Windows

Visit Apple

Starting with iOS 18, iPadOS 18 and macOS Sequoia, passwords, passkeys, verification codes for two-factor authentication and Wi-Fi passwords live in the Passwords app. It syncs through iCloud Keychain, flags weak, reused and breached passwords, and lets you share entries through shared groups. Passwords and Keychain data are end-to-end encrypted by default.

On Windows, Apple passwords are available through iCloud for Windows — in the iCloud Passwords app and in an extension for Chrome, Edge and Firefox; your Apple Account needs two-factor authentication turned on. Install iCloud for Windows and sign in with your Apple Account first.

With iOS 26 and macOS 26, you can securely move passwords and passkeys between Passwords and another manager without an intermediate file, as long as the other manager supports this kind of transfer too. Officially, Passwords works only on Apple devices and Windows.

4. Google Password Manager

Best for Android and ChromeBuilt-in password manager

Google Password Manager

Works in

Chrome on every platform, Android

iPhone

AutoFill from Chrome, default app from iOS 18.2

Passkeys

yes, synced across devices

Password Checkup

exposed, weak and reused passwords

Sharing

a copy of a password with your family group

On-device encryption

turned on manually

AndroidWindowsmacOSLinuxChromeOSiOS

PriceFreechecked 25 September 2026

The simplest option for Android and Chrome: passwords and passkeys are already saved to your Google Account, you only need to turn on on-device encryption.

Pros

• Free, built into Chrome and Android
• Passkeys wherever Chrome runs
• Password Checkup for breaches

Cons

• You have to turn on on-device encryption
• Sharing works only with your family group

Visit Google

Google Password Manager is built into Chrome on every platform and into Android: passwords and passkeys are stored in your Google Account and filled in on websites and in apps. Passkeys are available on every device where Chrome runs and you’re signed in to the same account; on a new device, you unlock them with your Google Password Manager PIN or your Android screen lock.

On iPhone, you can use passwords saved in Chrome in other apps, and starting with iOS 18.2 you can set Chrome as the default passwords app. Password Checkup finds exposed, weak and reused passwords, and you can share a copy of a password with a member of your Google family group.

By default, passwords are encrypted with a key stored in your Google Account. On-device encryption is safer: the key stays with you alone. You can’t turn it off later, and if you lose all your recovery options — your Google Account password and the screen lock of your devices — your passwords are lost too.

5. Microsoft Password Manager

Best for Windows and EdgePassword manager in Microsoft Edge

Microsoft Password Manager

Works in

Microsoft Edge for Windows, macOS, iOS, Android

Passkeys

from Edge 142, synced through your Microsoft account

Passkey protection

Microsoft Password Manager PIN

Password Monitor

breach database checks, Windows and macOS

Master password

none, verification through the OS

WindowsmacOSiOSAndroid

PriceFreechecked 25 September 2026

Handy if you work in Windows and Edge: passwords and passkeys sync through your Microsoft account, and Password Monitor checks for breaches.

Pros

• Free and built into Edge
• Checks saved passwords against breaches
• Passkeys sync through your Microsoft account

Cons

• No separate master password
• Password Monitor only on Windows and macOS

Visit Microsoft

Microsoft Password Manager is built into Edge: it saves passwords and passkeys, syncs them through your Microsoft account and generates strong passwords, while Password Monitor checks saved passwords against a database of breaches (in Edge for Windows and macOS). Edge started saving and syncing passkeys in November 2025 with version 142 for Windows; on a new device, you unlock them with your Microsoft Password Manager PIN.

Passwords from Microsoft Authenticator moved here too: in 2025, Microsoft removed password storage and autofill from the app. To fill passwords in apps on iPhone and Android, set Edge as the autofill provider in your phone’s settings.

There’s no separate master password: passwords are encrypted on the device before syncing, and Edge can ask for Windows Hello or your system password before autofill. Microsoft warns plainly that if your computer is infected with malware, an attacker can get to the passwords saved in the browser. We compared browsers on privacy in “Best browser.”

6. KeePassXC

Best without the cloudOffline password manager

KeePassXC

Version

2.7.12, released March 10, 2026

Storage

an encrypted file on your device

Sync

through your own cloud, such as Dropbox or OneDrive

Passkeys

yes, through the KeePassXC-Browser extension

Extension

Firefox, Chrome, Microsoft Edge

Code

open source, GPLv3

Certification

ANSSI CSPN for version 2.7.9 (2025)

WindowsmacOSLinux

PriceFreechecked 25 September 2026

For people who don’t want to trust anyone’s cloud with their passwords: a free open source app that keeps everything in an encrypted file.

Pros

• Free, no subscriptions or ads
• Passwords never sit on someone else’s servers
• ANSSI CSPN certification

Cons

• No official iOS or Android apps
• You have to set up sync yourself

Visit KeePassXC

KeePassXC is a free open source app (GPLv3) for Windows, macOS and Linux, with no ads or subscriptions. All your passwords live in one encrypted database file on your device, and nothing goes to the developers’ servers. To use the database on several devices, you put it in a Dropbox, Google Drive, OneDrive or Nextcloud folder and let your cloud handle the syncing.

Since version 2.7.7 (March 2024), KeePassXC stores passkeys and signs in to sites with them through the KeePassXC-Browser extension for Firefox, Chrome and Edge. In November 2025, the French cybersecurity agency ANSSI awarded version 2.7.9 for Windows 10 a CSPN certification valid for three years. The current version is 2.7.12, and the 2.8.0 beta came out on September 23, 2026.

There are no official mobile apps: the developers recommend the compatible KeePassDX and KeePass2Android for Android, and Strongbox and KeePassium for iPhone.

7. NordPass

Free on one devicePassword manager

NordPass

Free

unlimited passwords and passkeys

Free plan limit

one active session on one device

Premium

unlimited sessions, breach checks, sharing

Encryption

XChaCha20, zero-knowledge

Reviews

Cure53 (2021), ISO/IEC 27001, SOC 2 Type 2

Code

closed source

WindowsmacOSLinuxiOSAndroidWeb

PriceFree; Premium from $1.99 a monthchecked 25 September 2026

A good fit if you need a manager on one device: the free plan has no password limit, but using several devices at once requires a paid plan.

Pros

• Unlimited passwords and passkeys for free
• XChaCha20 encryption, zero-knowledge
• Cure53 audit, ISO 27001, SOC 2 Type 2

Cons

• Free plan allows one active session
• The discounted price applies to year one only

Visit NordPass

NordPass from Nord Security stores unlimited passwords, passkeys and personal data for free. The free version’s limit is one active session: you can install the app on all your devices, but you can only be signed in on one at a time. Premium removes that limit and adds breach scanning, password health, email masking, item sharing and emergency access.

The vault is encrypted with XChaCha20 on your device, and your master password and encryption keys never reach NordPass’s servers. In 2021, Cure53 audited the NordPass Business apps and extensions, and the company holds ISO/IEC 27001 certification and a SOC 2 Type 2 report.

On September 25, NordPass’s website listed Premium on the annual plan at $1.99 a month — $23.88 for the first year instead of $35.88 — and the Family plan for six accounts at $44.28 for the first year instead of $71.88. Prices exclude VAT.

8. 1Password

Best paidPassword manager

1Password

Free plan

none, 14-day trial

Individual

$3.99 a month billed annually

Families

$5.99 a month, for 5 people

Files

1 GB per person

Features

Watchtower, Travel Mode, Secret Key

Encryption

end-to-end

Reviews

SOC 2 Type 2, ISO 27001

WindowsmacOSLinuxiOSAndroid

PriceFrom $3.99 a monthchecked 25 September 2026

If you’re ready to pay: a polished manager for families, with Watchtower, Travel Mode and an extra Secret Key.

Pros

• Families plan for five people
• Watchtower alerts you to breaches
• Secret Key on top of the master password

Cons

• No free plan
• Costs more than Bitwarden and Proton Pass

Visit 1Password

1Password is the only manager on this list without a free plan: there’s just a 14-day trial. On September 25, 1Password’s website listed Individual at $3.99 a month billed annually and Families for five people at $5.99 a month. New customers paying annually on 1Password’s website were offered the first year at $2.99 and $4.49 a month.

Plans include 1 GB of file storage per person, Watchtower alerts about weak and compromised passwords, sharing items with anyone and Travel Mode, which hides vaults when you cross a border. Your data is end-to-end encrypted, and on top of the master password, your account is protected by a Secret Key.

1Password’s code is closed source. The company publishes its security reviews: a SOC 2 Type 2 report, ISO 27001 certifications and a bug bounty program on HackerOne.

Comparison

Prices are as of September 25, 2026, in US dollars, as shown on official websites; prices and taxes may differ by country. All eight managers support passkeys.

Manager	Free	Paid plan	Platforms
Bitwarden	Unlimited passwords and devices	Premium: $19.80 a year	Windows, macOS, Linux, iOS, Android
Proton Pass	Unlimited, 10 email aliases	Pass Plus: $35.88 a year	Windows, macOS, Linux, iOS, Android
Apple Passwords	Fully free	—	Apple devices, Windows
Google Password Manager	Fully free	—	Chrome, Android, iPhone
Microsoft Password Manager	Fully free	—	Edge: Windows, macOS, iOS, Android
KeePassXC	Fully free	—	Windows, macOS, Linux
NordPass	Unlimited, one session	Premium: $23.88 for year one	Windows, macOS, Linux, iOS, Android
1Password	No, 14-day trial	Individual: $3.99 a month	Windows, macOS, Linux, iOS, Android

Manager	Encryption	Open source	Independent reviews
Bitwarden	Zero-knowledge	Yes	Cure53, ETH Zurich, Unit 42 (2025)
Proton Pass	End-to-end	Yes	Cure53 (2023), Recurity Labs (2026)
Apple Passwords	End-to-end by default	No	No published report
Google Password Manager	On-device, optional	Partly (Chromium)	No published report
Microsoft Password Manager	On-device before syncing	Partly (Chromium)	No published report
KeePassXC	Local file, no cloud	Yes	ANSSI CSPN (2025)
NordPass	Zero-knowledge	No	Cure53 (2021), ISO 27001, SOC 2
1Password	End-to-end + Secret Key	No	SOC 2 Type 2, ISO 27001

Who didn’t make the list and why

• LastPass. The free plan is limited to one device type — computers or mobile devices. In 2022, an attacker copied a backup of customer vaults: website URLs in it were unencrypted, while usernames, passwords and notes were encrypted with a key derived from the master password.
• Dashlane. The free plan ended on September 16, 2025. Only the paid Premium and Friends & Family plans remain, and Premium comes with a 14-day free trial.
• Microsoft Authenticator. Since June 2025, you can’t add passwords to it; autofill stopped in July, and since mid-August, saved data is no longer accessible in the app. Passwords are synced to your Microsoft account and open in Edge, and Authenticator itself still supports passkeys for Microsoft Entra work and school accounts.

How to choose a password manager

• Your devices. If everything is Apple, Passwords is enough; if it’s Android and Chrome, Google Password Manager. With a mix, such as an iPhone and a Windows PC, Bitwarden or Proton Pass is more convenient: they run on every system.
• Free plan limits. NordPass allows one active session; Bitwarden and Proton Pass charge for built-in 2FA codes and attachments. The built-in managers from Apple, Google and Microsoft have no paid features.
• Who can read your passwords. With end-to-end or zero-knowledge encryption, only you hold the key. Google offers this as a separate setting called on-device encryption.
• Transparency. Open source code from Bitwarden, Proton Pass and KeePassXC and published audit reports mean you don’t have to take the maker’s word for it.
• Account recovery. Bitwarden can’t recover or reset a forgotten master password. Set up a hint or emergency access (Premium) in advance, and keep your Google Account recovery options up to date.
• Protecting the manager itself. The UK’s National Cyber Security Centre (NCSC) advises turning on two-step verification for your password manager account, so a master password alone isn’t enough for an attacker.

Using your browser’s built-in password manager is fine too: according to the NCSC, it’s safe on your own devices and the easiest option, especially if you use the same operating system and browser everywhere.

Passkeys: what they are and where to store them

A passkey is a passwordless way to sign in based on the FIDO standard: you approve the sign-in the same way you unlock your phone or computer — with a fingerprint, your face, a PIN or a pattern. When you register, the password manager creates a cryptographic key pair for that specific account: the site gets the public key, and the private key stays in the manager. When you sign in, the manager signs the site’s challenge with the private key, and your biometrics never leave the device.

The main benefit is phishing protection: a passkey is only presented to the site it was created for, so there’s no way to enter it on a fake page. Passkeys in password managers sync across your devices, while passkeys on hardware security keys stay on the key itself.

It’s most convenient to keep passkeys where your passwords are — in a manager you have on all your devices. To avoid lock-in, the FIDO Alliance developed the Credential Exchange standard for securely moving passkeys and other data between managers. Apple already supports this kind of transfer in iOS 26 and macOS 26, and other makers are adding it gradually.

What to do after a password leak

1. Confirm the breach. Check for news of the incident on the service’s official website or app, not through a link in an email or message.
2. Change the password. If you still use the leaked password, change it — and on every account where you used the same one. Your password manager will generate a new unique password.
3. Turn on a second factor or a passkey. Then a password alone won’t be enough for an attacker. You can do this in your account’s security settings.
4. Check your account. Look at recent sign-ins and whether your security settings have changed.
5. Expect phishing. After major breaches, emails arrive saying “reset your password” or “claim compensation” — don’t open links in them.
6. Check for other breaches. The NCSC recommends Have I Been Pwned. Saved passwords are also checked by Google’s Password Checkup, Apple’s Passwords app, Password Monitor in Edge and the data breach report in free Bitwarden.

If your password may have leaked from your own device, check the device first. Microsoft points out that if a computer is infected, an attacker can get the passwords from a password manager, and a master password only partly helps. We collected the signs of spying on a smartphone in “How to understand that your phone is being tapped.”

Sources and methodology

Analysis of public sourcesChecked 25 September 2026

Versions

• KeePassXC 2.7.12

1. FIDO Alliance — how passkeys work passkeycentral.org
2. Microsoft — notice on the end of password autofill in Authenticator support.microsoft.com
3. NCSC — data breaches: what to do ncsc.gov.uk
4. NCSC — password managers ncsc.gov.uk
5. Prices — official developer websites as of September 25, 2026

FAQ

What is the best free password manager?

For most people, Bitwarden: it stores unlimited passwords and passkeys on any number of devices for free, its code is open source, and independent auditors review its apps. If all your devices belong to one ecosystem, the built-in Apple Passwords or Google Password Manager is enough, and if you want to avoid the cloud, use KeePassXC.

Is it safe to save passwords in your browser?

According to the UK’s NCSC, yes, on your own devices, especially if you use the same operating system and browser everywhere. Turn on two-step verification for your Google or Microsoft account, and turn on on-device encryption in Google Password Manager.

What happens if you forget your master password?

With zero-knowledge managers, it can’t be recovered: Bitwarden says plainly that it can neither see nor reset your master password. Your options are a password hint, emergency access by a trusted person (Premium) or signing in on a device where you’re already logged in; otherwise, you’ll have to create a new account.

What happened to passwords in Microsoft Authenticator?

Microsoft removed password storage and autofill from Authenticator: since June 2025 you can’t add passwords, since July autofill doesn’t work, and since mid-August the data is no longer accessible. Saved passwords are synced to your Microsoft account and open in Edge.

How do you move passwords to another password manager?

Usually you export passwords from the old manager to a CSV file, import it into the new one and then delete the file, since the passwords in it aren’t encrypted. For passkeys and transfers without unencrypted files, the FIDO Alliance developed the Credential Exchange standard; in iOS 26 and macOS 26, Apple already lets you move passwords and passkeys between managers this way.