Password managers
The best password manager
Best password manager: Bitwarden. Pickr rates Bitwarden 9.1 out of 10, ahead of the 4 others we ranked.
A password manager asks you to put every credential you own into one place and trust that the maths holds. You cannot evaluate that by using the app — it feels identical whether the cryptography is sound or not. What you can evaluate is whether the company lets anyone else look: whether the code is public, whether a reputable third party has audited it recently, and whether the resulting report is something you can actually read.
Judge the evidence, not the interface
Every password manager in this group is pleasant to use. They all autofill, they all sync, they all support passkeys now. The interface tells you nothing about the only thing that matters, which is whether your vault is safe.
So the questions that do the work are narrow. Is the client code public, so that anyone can look for a flaw rather than taking a marketing page on trust? Has an independent security firm audited it, how recently, and can you read the report — because an audit behind a login is a claim, not evidence. And if the company has had an incident, did it publish the details itself?
An audit from 2020 or 2021 is not disqualifying, but it is a long time in this field. The gap between a vendor publishing six audits last year and one publishing its last readable audit five years ago is the single widest quality gap in this category, and it is invisible from inside the app.
The free tier is a security feature
This sounds like a value argument and it is not. A password manager protects a household or a team only if everyone in it actually uses one, and the person who will not install a password manager is almost never persuaded by a subscription.
That makes a usable free tier a genuine security property rather than a pricing decision. The distinction to watch is between a free tier that is bounded (a vault limit, an alias limit) and one that is crippled — a free plan that does not sync between devices is not a free password manager, because the entire point is having your credentials where you are.
Check that specific thing before you recommend one to a relative.
What we weighted
Quality of the work carries 30 and here it means the security architecture and how much of it is inspectable. Reliability is 25 — sync that works and a vault you can always reach. Value is 15, including what the free tier actually does. What other customers say is 20, credentials 10, and in this category credentials means a current, readable third-party audit. The full standard is here.
The ranking
| Company | PICKR | Free tier | Entry paid | Open source | Most recent public audit |
|---|---|---|---|---|---|
| Bitwarden | 9.1 | Yes, unlimited devices | $1.65/mo billed annually | Yes (GPL-3.0) | Cure53, 2025 |
| Proton Pass | 8.3 | Yes — 2 vaults, 10 aliases | $2.99/mo billed yearly | Yes | Cure53, 2023 |
| 1Password | 8.2 | None — 14-day trial | $3.99/mo billed yearly | No | ISE, 2020 |
| NordPass | 7.2 | Yes, but single-device | $1.39/mo on a 2-year plan | No | Cure53, 2021 |
| Dashlane | 6.8 | Not published | Highest of the five | No | Synacktiv, 2026 (access-gated) |
Bitwarden
Open source · self-hostable
Our pick, and the reason is that you do not have to take its word for anything. Bitwarden is fully open source under GPL-3.0 with the client code public on GitHub, and it can be self-hosted on your own server if you would rather not hand your vault to anybody. It also has by far the strongest audit record in this group: six separate Cure53 engagements published in 2025, alongside work from ETH Zurich, Unit 42 and Fracture Labs. In a category where the entire product is a promise about cryptography, a current and repeatedly published third-party audit is the only evidence that promise is worth anything — and most of the field is years behind on it. The free tier is genuinely usable rather than a demo: unlimited passwords across unlimited devices, passkeys included, which is the thing almost everyone actually needs. Premium is the cheapest paid tier of the five. Two real catches: it allows only one passkey per login item, and TOTP codes are behind Premium.
The evidence (4 sources)
- Open sourceClient code public on GitHub under GPL-3.0; server is self-hostable via Docker or Kubernetessourceread 2026-10-05
- Independent auditsSix Cure53 engagements published in 2025, plus work from ETH Zurich, Unit 42 and Fracture Labssourceread 2026-10-05
- Free tier“Always free” — unlimited devices and passwords, passkeys, and sharing with one other usersourceread 2026-10-05
- Paid pricingPremium $1.65/mo billed annually at $19.80; Teams $4/user/mo billed annuallysourceread 2026-10-05
What we could not verify
- Bitwarden publishes no breach history, which we read as none having occurred rather than as proof of none.
- We did not independently review the audit reports' findings, only that they exist, who performed them and when.
Proton Pass
Open source · Switzerland
The best choice if you care about email aliases, and a serious one if you care about jurisdiction. Proton Pass builds a full alias service directly into the vault — unlimited aliases on paid plans, a custom alias domain, and the ability to send mail from an alias rather than merely receive it — which is a meaningfully different privacy model from storing a password next to your real address. It is open source across web, iOS and Android, and Swiss-based. The free tier is real but tightly bounded at two vaults and ten aliases, and the published audit is from 2023, which is older than Bitwarden's and carries one medium finding recorded as unresolved.
The evidence (4 sources)
- Open sourceClient code published for web, iOS and Androidgithub.com/protonpassread 2026-10-05
- Free tier limitsUnlimited logins and devices, but capped at 2 vaults, 10 aliases and 1 GBproton.me/pass/pricingread 2026-10-05
- PricingPass Plus $4.99/mo monthly, or $2.99/mo billed yearly at $35.88proton.me/pass/pricingread 2026-10-05
- AuditCure53, conducted May–June 2023 and published 19 July 2023proton.me/blog/pass-security-auditread 2026-10-05
What we could not verify
- One medium-severity finding in the 2023 Cure53 audit is recorded as unresolved; we did not assess its practical impact.
1Password
Proprietary
The most polished product here and the one most people are happiest using day to day. Travel Mode is a genuinely distinctive feature — it removes vaults you have not flagged from your devices entirely, rather than hiding them — and it is included on every subscription rather than sold as an upgrade. Two things keep it off the top. It is the only one of the five with no free tier at all, which matters because a password manager only protects a household if the whole household will install it. And the most recent audit we could actually read is from 2020; newer assessments exist but sit behind a login on its trust portal, which means they are not evidence a prospective customer can check.
The evidence (4 sources)
- No free tierA 14-day trial is offered; there is no free plan1password.com/personal-family-securityread 2026-10-05
- PricingIndividual $3.99/mo billed yearly; Families $5.99/mo1password.com/personal-family-securityread 2026-10-05
- Travel ModeRemoves vaults not marked travel-safe from devices; included in every subscriptionsupport.1password.com/travel-mode/read 2026-10-05
- Disclosed incidentDisclosed an October 2023 incident linked to the Okta breach, stating no user data was accessedblog.1password.com/okta-incident/read 2026-10-05
What we could not verify
- Audits newer than 2020 are referenced but gated behind a login on 1Password's trust portal, so we could not read them.
- The monthly (non-annual) price is not published.
NordPass
Proprietary
Cheap on a two-year commitment, and the XChaCha20 cipher is a reasonable engineering choice. The free tier is the problem: it does not sync, so multi-device access is explicitly excluded — which for most people means the free plan is not a password manager at all, it is a password manager on one device. The audit record is the weakest of the five at four years old, in a category where that is the one credential that matters. Team pricing is sold only as a ten-user pack, so a five-person company pays for ten.
The evidence (3 sources)
- Free tier does not sync“Access on multiple devices” is explicitly not included in the free plannordpass.com/pricing/read 2026-10-05
- PricingOn the 2-year plan: Premium $1.39/mo, Teams $1.79/user/mo sold in a 10-user pack, Business $3.59, excluding VATnordpass.com/pricing/read 2026-10-05
- AuditCure53, published 20 October 2021 — 21 person-days, 15 issues, one High severity, recorded as fixednordpass.com/blog/nordpass-security-audit/read 2026-10-05
What we could not verify
- NordPass returned 403 to plain fetches during this research; the figures above were read in a browser.
- One-year and one-month pricing, and the full platform support matrix, are not reflected here.
Dashlane
Proprietary
The most expensive entry tier of the five, and the least inspectable. There is no native desktop application — it is a web app plus a browser extension, which is a real constraint if you want your vault reachable when a browser is not. The bundled VPN is a genuine extra if you would otherwise pay for one separately. But a free tier is no longer published, business pricing is withheld entirely, and although a 2026 Synacktiv audit is referenced, every artefact behind it requires requesting access — so, as with 1Password, it is not evidence a customer can verify before buying.
The evidence (3 sources)
- No native desktop appDelivered as a web app plus browser extensionsupport.dashlane.com/hc/en-us/articles/202625042read 2026-10-05
- PricingPremium is the most expensive entry tier of the five; business pricing is not publishedwww.dashlane.com/pricingread 2026-10-05
- Disclosed incidentDisclosed an August 2025 compromise via the Salesforce/Drift integration, stating vaults were unaffectedwww.dashlane.com/blog/salesloft-drift-security-incidentread 2026-10-05
What we could not verify
- Dashlane returned 403 to plain fetches during this research, so some pages could not be read.
- We could not confirm whether a free plan still exists; none is published on the pricing page.
- The 2026 Synacktiv audit is referenced but its artefacts require requesting access, so we have not read it.
- Dashlane's pricing page would not serve us a readable price, so we describe its entry tier relative to the others rather than quoting a figure we could not confirm.
Questions people actually ask
What is the best password manager?
Bitwarden, on the evidence. It is fully open source under GPL-3.0, can be self-hosted, and has the strongest recent audit record in the category — six Cure53 engagements published in 2025 plus work from ETH Zurich and Unit 42. Its free tier also syncs unlimited passwords across unlimited devices.
Is a free password manager safe to use?
It depends entirely on which one. Bitwarden's free tier is the full product with unlimited devices and passkeys. NordPass's free tier does not sync between devices at all. Proton Pass's free tier is real but capped at two vaults and ten aliases. 1Password has no free tier.
Does it matter if a password manager is open source?
Yes, because it is the difference between a security claim you can check and one you have to accept. Bitwarden and Proton Pass publish their client code; 1Password, Dashlane and NordPass do not.
How recent should a password manager's security audit be?
Recent enough to reflect the product you are actually installing. Bitwarden published six audits in 2025. The newest publicly readable 1Password audit is from 2020, and NordPass's is from 2021. Audits that sit behind a login are claims rather than evidence.
Do password managers support passkeys?
All five here do. Bitwarden allows only one passkey per login item, which is worth knowing if you intend to store several for one service.
If you are switching
Export from the old one before you cancel it, not after. Every manager here can import a CSV from the others, but a cancelled account can leave you locked out of the export you needed.
Then turn on two-factor on the vault itself, which is the one account where it matters most, and write the recovery code down on paper. A password manager you cannot get back into is a worse outcome than the problem it solved.
Spotted something wrong here? Write to hello@pickrmedia.com and we will check it against the source.