Password Manager Comparison 2026: Proton Pass, NordPass, LastPass, Keeper, Bitwarden and 1Password
A research-based comparison of six password managers in 2026 built from vendor pages and neutral references: free plans, open-source status, audit statements, family plans and security history. Not lab-tested.
A password manager is one of the few security tools where the basic advice is simple: use one. The harder question is which one, because the products differ in what the free plan allows, how open they are about their code and audits, and what their track record looks like.
This page compares six popular options using what the vendors state on their own pages, plus Wikipedia for security history and for NordPass.
How this comparison was made
- This is a research-based comparison, not a lab test. We did not run our own security audits or usability tests.
- Claims come from the vendors' own pages and Wikipedia, listed at the bottom, as read on 18 October 2026. A vendor describing its own security is a claim, not an audit result. Where a page does not say something, we write "not stated".
- NordPass's own pages blocked our access, so its row relies on Wikipedia, which itself carries a notice about promotional content. 1Password's plan pages were not readable either.
- We do not publish prices. They change and differ by country. Each section links to the vendor's page so you can see the current offer for your region.
Quick answers
Which one fits which need
- A free plan on unlimited devices: Bitwarden and Proton Pass both list their free plans with unlimited devices (Proton caps free hide-my-email aliases at 10).
- The most open about its code: Bitwarden states that its entire codebase is on GitHub. Proton states that all Proton Pass apps are open source.
- Documented annual audits: Bitwarden lists annual third-party audits with named firms.
- A family plan: Bitwarden and LastPass list plans for up to six users.
Things to weigh carefully
- LastPass suffered a significant breach in 2022 that exposed encrypted vault backups. Read the security history below.
- Free plans differ sharply: LastPass limits its free plan to one device type, and Keeper's free plan covers one mobile device and ten records.
- A password manager is only as strong as your master password and two-factor setup.
Side-by-side overview
| Proton Pass | NordPass | LastPass | Keeper | Bitwarden | 1Password | |
|---|---|---|---|---|---|---|
| Free plan | Yes: unlimited devices, 10 hide-my-email aliases | A freemium model (details not read) | Yes, limited to one device type (desktop or mobile) | Yes, limited to one mobile device and ten records | Yes: unlimited devices and passwords | Not covered by the pages we read |
| Family plan | Yes (launched October 2024, per Wikipedia) | Not stated | Yes, up to 6 users | Yes (five private vaults) | Yes, up to 6 users | Not covered |
| Open source | Yes, all apps (stated by the vendor) | No, proprietary (Wikipedia) | Not stated | Not stated | Yes, entire codebase on GitHub | Not stated |
| Independent audit | Vendor says audited by independent experts with public reports; a Cure53 audit of the apps and API was published in July 2023 (Wikipedia) | A Cure53 audit in February 2020 (Wikipedia) | Not stated on the pages we read | Not on the page we read; points to a Trust Center we could not open | Annual third-party audits by named firms (vendor) | Vendor says it publishes independent audit results; auditors not named on the page we read |
| Encryption (as described) | 256-bit AES-GCM, zero-knowledge | XChaCha20 (Wikipedia) | Not read | Zero-knowledge, zero-trust (vendor) | Not read | Not read |
“Not stated” means the sources we read do not say it. It does not mean the feature is absent.
Security history
- LastPass, 2022: according to Wikipedia, an attacker took source code and an encrypted copy of the key protecting backups of customer data, then used a senior engineer’s personal computer to reach more keys. The stolen vault data included unencrypted fields such as some website URLs and encrypted fields such as usernames and passwords. The UK Information Commissioner’s Office fined LastPass UK Ltd in November 2025, and LastPass settled a class action in 2025.
- Proton Pass, 2025: Wikipedia reports a browser-extension clickjacking vulnerability that version 1.31.6 addressed.
- We did not find comparable incidents in the pages we read for the other four, which does not mean there are none.
What each vendor says
Proton Pass
Proton states that Proton Pass protects passwords, passkeys and cards with zero-knowledge, end-to-end encryption, that all its apps are open source and that it has been audited by independent third-party experts with public reports. The free plan is called Proton Free and lists unlimited devices and 10 hide-my-email aliases. Proton AG is based in Geneva, Switzerland. See plans on Proton Pass.
NordPass
Wikipedia describes NordPass as a proprietary password manager developed by the makers of NordVPN, using the XChaCha20 cipher and audited by Cure53 in February 2020. NordPass’s own pages blocked our access, so we cannot confirm plan details. See plans on NordPass.
LastPass
The vendor lists a free plan limited to one device type, with unlimited password storage, autofill, dark web monitoring and basic sharing but no emergency access. Premium is for one user and Families covers six users. See the security history above for the 2022 incident. See plans on LastPass.
Keeper
Keeper’s free plan is limited to one mobile device and ten records, with two-factor authentication included. The Family plan is built on Keeper Unlimited (unlimited devices and sync) and adds five private vaults and file storage. The vendor says it uses zero-trust and zero-knowledge encryption, and the page we read does not mention certifications or third-party audits. See plans on Keeper.
Bitwarden
Bitwarden’s free plan lists unlimited devices and unlimited passwords, Premium covers one person and Families up to six users. The vendor states that the entire codebase is on GitHub under either the GNU Affero General Public License v3.0 or the Bitwarden License, and that it regularly undergoes annual third-party audits, listing firms such as Cure53, IOActive, Mandiant and Unit 42. See plans on Bitwarden.
1Password
The vendor says its security design is regularly assessed by independent experts and that it publishes audit results. The page we read does not name the auditors and does not say whether the software is open source. We could not read its individual plan pages. See plans on 1Password.
Which one fits you?
Tick what matters to you
Managers that meet every ticked need are highlighted.
Tick a need to see which managers match.
| Manager | Free, unlimited devices | Open source | Audit stated | Family plan | Match |
|---|---|---|---|---|---|
| Proton Pass | Yes | Yes | Yes | Yes | |
| NordPass | Not stated | No (proprietary) | Yes (Cure53, 2020) | Not stated | |
| LastPass | No, one device type | Not stated | Not stated | Yes | |
| Keeper | No, one mobile device | Not stated | Not on the page read | Yes | |
| Bitwarden | Yes | Yes | Yes, annual | Yes | |
| 1Password | Not covered | Not stated | Yes (stated) | Not covered |
Ticks come from the vendor pages and Wikipedia listed below. “Not stated” counts as no match because the sources do not say it.
Disclosure
Some outbound links on this page may be affiliate links. If you buy through them, UtilRank may earn a commission at no extra cost to you. Commissions do not influence which services are included or how they are described. Read our affiliate disclosure and editorial policy.
Sources and verification
Read on 18 October 2026. Sources are the vendors’ own pages and Wikipedia. Plans and prices change and differ by region, so confirm on the vendor’s page for your country.
- Proton Pass: Product page, Security page, Wikipedia
- NordPass: Wikipedia
- LastPass: Pricing, Wikipedia
- Keeper: Personal plans
- Bitwarden: Pricing, Audit page
- 1Password: Security
Looking for in-depth evaluations of the tools mentioned in this guide? Check out our hands-on reviews: