Best Free & Open Source Alternatives to NordPass

Keeweb is a free, open-source password manager that works seamlessly with KeePass .kdbx databases. It runs as both a desktop application (built on Electron) for Windows, macOS, and Linux, and as a web app you can host yourself or use directly from keeweb.info — so your vault travels with you across platforms.

Your credentials stay in an encrypted KeePass-compatible database that you fully control. Keeweb can open and edit existing .kdbx files created by KeePass, KeePassXC, and other compatible tools, so you can migrate without losing data. Vaults can be stored locally, in popular cloud services such as Dropbox, Google Drive, and OneDrive, or in a self-hosted Docker container.

Features include a built-in password generator, automatic icon fetching, attachment support, keyboard shortcuts, multiple color themes, and a clean interface designed for fast entry and retrieval of credentials. Because it uses the well-audited KeePass database format, you can always switch clients without lock-in.

Vaultwarden is an unofficial, open-source implementation of the Bitwarden server API written in Rust. It is fully compatible with all official Bitwarden clients — browser extensions, mobile apps, and the desktop app — so you get the same user experience while keeping your vault entirely on your own infrastructure.

Compared to the official Bitwarden server, Vaultwarden is significantly lighter. It runs comfortably on a Raspberry Pi or a small VPS with less than 100MB of RAM, making it practical to add alongside other self-hosted services without needing dedicated hardware.

Vaultwarden supports the full Bitwarden feature set: organisations, collections, two-factor authentication, emergency access, the Send feature, and the web vault UI. It is a drop-in replacement for the Bitwarden cloud for individuals and small teams who want full control over their password data.

PearPass is an open-source, privacy-first password and identity manager that runs on macOS, Linux, and Windows. Unlike traditional cloud-based password managers, PearPass is built on the Pear Runtime and uses peer-to-peer technology to sync your encrypted vault directly between your own devices — there is no central server holding your data.

All passwords, credit cards, secure notes, and custom fields are encrypted locally on your device before being written to disk. Sync between devices happens directly over a peer-to-peer connection, ensuring only you can read your vault. PearPass also includes a password strength analyser, a random password generator, offline access, and optional mobile and browser-extension companions for the same vault.

Because PearPass runs on top of Pear Runtime and there is no company-operated cloud, there are no per-seat fees, no telemetry, and no vendor lock-in — your encrypted vault lives on devices you control and is shared only between them.

TeamPass is an open-source, self-hosted password manager built for teams and organizations. It provides a centralized vault where you can organize credentials into folders, define granular user roles, and share passwords securely across your team without sending secrets over email or chat.

Designed for collaborative use, TeamPass lets administrators set fine-grained permissions (read-only, modify, no access) per user and per folder, rotate shared passwords, and track every change through a complete activity log. Items can include attachments, custom fields, expiry dates, and TOTP secrets for two-factor authentication. A REST API and a real-time WebSocket daemon enable automation and live vault updates.

TeamPass runs on a standard LAMP-style stack (PHP 8.2+, MySQL/MariaDB) and is available as an official Docker image. Because it is self-hosted, all encrypted credentials stay on infrastructure you control — making it a popular choice for IT departments, agencies, and small businesses that need shared password management without paying per-seat SaaS fees.

Passbolt is an open-source password manager built for teams that put security first. It lets organizations centrally manage, securely share, and audit credentials and secrets without trusting a third-party cloud. Every secret is encrypted end-to-end with user-owned keys, and the entire stack can be self-hosted—even in air-gapped environments.

Key Highlights

• Security & Privacy by Design
  End-to-end encryption with user-owned secret keys. Passbolt is regularly audited (Cure53, Quarkslab, ANSSI CSPN) and publishes findings transparently. Licensed under AGPL-3.0 with no telemetry or personal data collection.

• Built for Teams
  Fine-grained sharing and access policies, resource groups, custom fields, and encrypted metadata. Administrators can define dynamic roles, manage users via SCIM provisioning (Entra ID, Okta), and enforce MFA.

• Browser Extensions & Autofill
  Native extensions for Chrome, Firefox, Edge, and Safari with automatic credential and TOTP autofill. Continuously expanding coverage for complex login forms.

• Flexible Resource Types
  Store passwords, standalone secure notes, and PIN codes (door codes, safes, SIM codes). Attach multiple URIs, custom icons, and rich metadata to any entry.

Community

• Active development on GitHub with regular releases and a detailed CHANGELOG.
• Strong community engagement with comprehensive documentation, contribution guidelines, and responsive support channels.

AliasVault is a privacy-first, open-source password manager with built-in email aliasing. It helps you protect your identity online by generating unique passwords and alternate email addresses for every service you use.

All data is encrypted end-to-end on your device using your master password, which never leaves your device. Even the cloud-hosted version operates on a zero-knowledge architecture, meaning only you can access your credentials and aliases.

Key Features

• Password management with secure generation and autofill via browser extension
• Email aliasing with a built-in email server for receiving messages directly inside AliasVault
• End-to-end encryption using modern cryptographic standards (Argon2id, SRP)
• Self-hosting support via Docker for full data sovereignty
• Cross-platform clients including web, browser extension, and mobile apps

AliasVault is licensed under AGPL-3.0 and is actively developed with a growing community.

Bitwarden is a password manager that securely stores, generates, and autofills credentials across all your devices. It uses end-to-end, zero-knowledge encryption, meaning only you can access your vault — Bitwarden itself has no visibility into stored data. The platform works across browsers, desktop apps, and mobile devices, and supports self-hosted deployment for those who want full infrastructure control.

For teams and enterprises, Bitwarden provides centralised credential management with granular access controls, organisation policies, directory sync, and SSO integrations. The Bitwarden Send feature enables secure, encrypted sharing of sensitive data, and a built-in TOTP authenticator adds a second layer of protection.

Bitwarden is well-suited for individuals seeking a trustworthy password manager, as well as organisations that need auditable, policy-driven credential management for their workforce.

KeePassXC is a modern, secure, and open-source password manager that stores and manages your most sensitive information. Built as a community-driven fork of KeePass Password Safe, it runs natively on Windows, macOS, and Linux without requiring a browser extension or internet connection.

Your data is encrypted using industry-standard algorithms (AES-256, Twofish, or ChaCha20) and stored in a local database file that only you control. KeePassXC supports password auto-fill via browser integration, SSH agent support, YubiKey challenge-response, and TOTP generation for two-factor authentication.

Unlike cloud-based password managers, KeePassXC keeps your vault entirely offline by default, giving you full ownership of your credentials while still offering convenient features like entry grouping, tags, attachments, and powerful search.