The best password managers in 2026

Ask the internet for the best password manager and you get affiliate roundups re-ranking the same five products every quarter, and forum threads recommending whatever the poster already uses. Both are more honest than they look: the core job — encrypt a vault, sync it, autofill it — is table stakes. What separates the field is who audited the code, whether you can leave, where your two-factor codes live, and what happens when you stop paying.

We build a 2FA vault rather than a password manager, so hold us to stated criteria instead of vibes — our bias runs toward the 2FA column. Criteria first, then the field. If price is your first constraint, the companion piece on the best free password managers of 2026 covers that half of the market.

How we judge a password manager

Six questions, roughly in order of importance:

• Encryption model. Is the vault encrypted on your device before upload, with keys the vendor never holds? Every serious manager claims zero-knowledge now; what matters is what each does beyond it.
• Independent audits. A published third-party assessment, ideally on a schedule. One old audit is a photograph; a yearly program is a habit.
• Export freedom. If you cannot get your data out, on any tier, you do not own your credentials. Test the export button before you commit.
• 2FA storage. Can the vault hold TOTP secrets, on which tier, and does putting both factors in one place bother you? It should, a little. We build a dedicated 2FA vault, so weight this one accordingly.
• Cross-platform reach. Apps for the devices you own, including the next one.
• Price model. Free forever, subscription, or lifetime — and what happens if you stop paying. Read-only after a lapse is the decent version.

The field

Bitwarden is the default answer, and keeps it the way boring infrastructure does: open-source code, audited every year since 2018, an unlimited free tier, and a premium around twenty dollars a year — $19.80 since the January 2026 change — adding TOTP storage and attachments. Self-hosting is supported, and the community's Vaultwarden server extends it to people who want the apps without the cloud. The Bitwarden guide has the fine print.

1Password is the polish pick, with the best answer to "what does a server breach leak?" Each account's key is derived from your password plus a 128-bit Secret Key generated on your device, never uploaded, so stolen server data is missing half the key material. Watchtower flags weak and reused passwords, TOTP storage is built in, and there is no free tier — a 14-day trial, then a premium subscription. The trade: lose both password and Secret Key and nobody can recover the vault. The 1Password guide covers the model.

Proton Pass is the privacy-ecosystem choice, from the Swiss company behind Proton Mail. The free tier is generous — unlimited logins across unlimited devices, open-source apps — and paid tiers add email aliases and unlimited 2FA storage; free accounts get three. If your email already lives at Proton, the manager is a short walk; if not, judge Proton Pass on the ecosystem alone.

Dashlane is the premium-first bundle. It retired its free tier in September 2025 and consolidated around paid plans that include the vault, a built-in authenticator, dark-web monitoring, and a bundled VPN — the only one in the category. The polish is real, the price is top of the category, and the figures move — check current pricing rather than trusting any roundup, ours included. The Dashlane guide covers what the money buys.

NordPass is the simple one, from the Nord Security group behind NordVPN. Its signature is XChaCha20-Poly1305 encryption where most competitors use AES-256-GCM; both are authenticated ciphers with no practical attacks, so the cipher is a headline, not a reason. What matters: audited apps, Argon2id derivation, and an interface non-technical relatives can use unsupervised. Closed source. The NordPass guide does the honest comparison.

KeePass is not a product but a format: one encrypted .kdbx file, open source since 2003, free forever, no accounts, no servers. The ecosystem does the rest — KeePassXC on desktop with TOTP built in, KeePassium on iOS, KeePassDX on Android. Sync is your problem. KeePassXC's documentation says it outright: TOTP seeds beside passwords collapse two factors into one, so keep a separate database. The KeePass guide maps the family.

Keeper barely appears in consumer roundups because it aimed itself at organizations years ago: role-based controls, zero-trust architecture claims, and the certification paperwork regulated industries ask for by name. Often overlooked; rarely a mistake. Keeper earns a look if your security questionnaire has pages.

Apple Passwords and Google Password Manager are the built-ins, good enough for many people. Apple's syncs through iCloud Keychain with end-to-end encryption and, alone among the majors, stores verification codes free; the limits are the ecosystem — no Android or Linux client. Google's is built into Chrome and Android and stores no TOTP codes — they live in the separate Google Authenticator app, whose sync is not end-to-end encrypted. Stay inside one ecosystem and it saves you a subscription; the lock-in is the price.

LastPass gets the honest paragraph, because skipping it would be lying by omission. The 2022 breaches put encrypted vault backups in attackers' hands alongside unencrypted metadata — the URLs that tell a cracker which vaults are worth the electricity. The encryption held where it existed, the UK regulator fined the company £1.2 million in November 2025, and a $24.5 million class action settled in February 2026. The LastPass guide has the full ledger and who should walk.

Passpack is the veteran oddity: older than the App Store, on version 7 since roughly 2011, aimed almost entirely at small teams. Its packing-key model — a login password plus a separate encryption key the server never sees — predates 1Password's Secret Key by years. No built-in TOTP storage; an interface best described as period-correct. The Passpack guide explains why that is a compliment.

2FA by DependsiT is ours, and it is not trying to win this category — it is not a password manager. It is a specialist vault for the other half of the equation: TOTP, HOTP, and Steam Guard secrets, encrypted in the browser before upload — PBKDF2 salted derivation, HKDF key separation, AES-256-GCM, a server that stores ciphertext only, Argon2id protecting login — with per-key control over algorithm, digits, period, and counter. Free tier: 100 folders and 100 entries; paid: $24 a year or $99 lifetime. Honest limits: it is young, has no browser autofill for websites and no password health reports, and does not want those jobs. For readers whose real problem is TOTP secrets rather than 400 website passwords, the free tier may be all you need — create a free account and keep your password manager for passwords.

The field compared

The password manager comparison in one glance:

Manager	Free tier	Open source
Bitwarden	Yes	Yes
1Password	Trial only	No
Proton Pass	Generous	Apps
Dashlane	No	No
NordPass	Device-limited	No
KeePass family	Always	Yes
Keeper	Trial	No
Apple Passwords	With hardware	No
Google Password Manager	Yes	No
LastPass	One device type	No
Passpack	Trial	No
2FA by DependsiT	100 entries	No

Free-tier details move; check plan pages before deciding.

Which one for whom

Every "best rated password manager" list is really a set of profiles. Ours:

• Most people: Bitwarden. Free tier that respects you, cheap premium, audited code, easy exit.
• People who buy the nice version: 1Password. The Secret Key and Watchtower justify the premium if you will use the depth.
• All-Apple households: Apple Passwords. Already installed, codes free; the trade is the ecosystem you chose.
• Privacy residents: Proton Pass. One account, one bill, one privacy policy.
• Self-hosters: KeePassXC, or Bitwarden on Vaultwarden for cloud apps on your own metal.
• Teams: a different purchase, with its own guide to password managers for teams.

Whatever you choose, do two chores on day one: turn on two-factor for the vault itself, and run a test export. The best password manager is the one you could leave tomorrow — which is why you will not need to.

Frequently asked questions

What is the best password manager in 2026?

For most people it is Bitwarden: open source, audited annually, an unlimited free tier, and a premium that costs less than dinner for two. 1Password when budget is secondary to polish; KeePass when the answer must be a file you control. Anyone promising a single winner for every reader is guessing at your constraints.

Is it worth paying for a password manager?

Usually not for the passwords — Bitwarden, Proton Pass, and KeePass store unlimited passwords for free. Money buys the layer around them: TOTP storage, breach reports, attachments, sharing, support. The market runs from Bitwarden's roughly twenty dollars a year to Dashlane's premium bundle; if you need none of that, the free products are complete, not crippled.

Which password manager is the most secure?

The serious ones all use strong authenticated encryption, so "most secure" is decided at the edges: key model, audit history, breach record. 1Password's Secret Key leaves stolen server data missing half the key; Bitwarden's yearly audits make its claims checkable; LastPass's 2022 incidents are the cautionary tale. Your master password still matters more than any of it.

Can password managers store 2FA codes?

Most of the paid ones can: 1Password and Dashlane include it, Bitwarden puts it behind Premium, Proton Pass allows three free, and Apple Passwords stores codes free while Google's does not. It is convenient, and it puts both factors in one basket — the argument for keeping codes in a separate 2FA vault. KeePassXC's documentation recommends the split, and we agree — we build one.

Should I avoid LastPass after the breaches?

"Avoid" is stronger than the facts require and weaker than some coverage implies. The 2022 attackers took encrypted vault backups with unencrypted URLs, older vaults were cracked, and the fallout included cryptocurrency theft, a £1.2 million UK fine, and a $24.5 million settlement. Staying with a strong master password was defensible; so was leaving. Choosing fresh in 2026, competitors offer the same functionality without the history.