Best password managers 2026: 1Password, NordPass, Bitwarden and Proton Pass compared

Stolen credentials remain the most common way into other people's accounts: in Verizon's 2026 Data Breach Investigations Report (over 22,000 confirmed breaches from 145 countries), stolen credentials were involved in 36% of the cases analysed. On 16 October 2026 the Have I Been Pwned database counted around 17.8 billion affected accounts from 1,045 breaches – the stealer logs added in June 2026 alone contained 56 million email addresses and 124 million new passwords.

Anyone who reuses the same password hands attackers every other account after a single leak. A manager solves the problem at its root: you memorise one strong master password – how to build it as a long passphrase is explained in (→ Create a strong password – and what is actually secure in 2026) – and the rest is generated, stored encrypted and filled in automatically. The vaults are end-to-end encrypted – the provider itself cannot read them (zero knowledge). In their paid plans, all four also store one-time codes for two-factor sign-in – how to set up the second factor on your Google Account is shown in (→ Set up 2-Step Verification on your Google Account – prompts, app, key or passkey).

Passkeys are gradually replacing passwords: according to the FIDO Alliance, around 7 billion passkeys were in use worldwide on 15 October 2026, and more than a third of successful logins at major services are said to run through them already. All four managers in this comparison store passkeys and sync them across devices – an advantage over the built-in tools from Apple and Google, which are tied to their ecosystems.

Price per year for one person and for a family, free plan and its limits, device limit, passkeys, emergency access and sharing, data location and headquarters, independent audits and whether the source code is open. Plus the assessments of reviewers and users.

Not in the table: Dashlane and Keeper. Both load their prices only in the browser, so we could not verify them; more on that further down. We cover the free solutions from Apple and Google at the end.

On 1password.com, 1Password costs $3.99 per month for one person and $5.99 per month for families of five, each billed annually ($47.88 and $71.88 per year respectively). New customers who order directly on 1password.com with annual billing get 25% off in the first year ($2.99 and $4.49 per month); the offer does not apply in the app stores. There is a 14-day trial without a credit card, but no free plan (pricing page, retrieved on 16 October 2026).

The prices are new: for renewals from 27 March 2026, 1Password raised the individual plan from $35.88 to $47.88 per year (plus 33%) and the family plan from $59.88 to $71.88 (plus 20%). After roughly ten stable years this drew criticism – not least because 1Password called it an «update» in its announcement (TidBITS, 25 February 2026; 1Password community forum with over 150 replies).

In return you get the most mature feature set: unlimited devices, 1 GB of document storage per person, Watchtower (warns about weak, reused or leaked passwords), Travel Mode (hides vaults while travelling) and sharing of individual items via link, even with people who have no 1Password account. Passkeys can be created and used across all platforms; signing in to 1Password itself with a passkey instead of a master password is only available as a public beta for new individual accounts.

Security: AES-256-GCM, plus the Secret Key – a 34-character key that lives only on your devices and protects a weak master password. 1Password is SOC 2 Type 2 audited and ISO 27001:2022 certified; since November 2025 the company has published annual pentest reports in its Trust Center. In the Okta incident of autumn 2023 an internal admin system was affected, but according to 1Password no user data.

What grates: no free plan, pricing only in US dollars or euros (your region determines currency and data location – 1Password.com bills in US dollars and stores data in the USA, 1Password.eu in euros and in the EU), and Trustpilot reviewers report crashing browser extensions and slow support; Trustpilot notes that 1Password typically takes over a month to reply to negative reviews (4.1 out of 5 from 12,506 reviews, 85% five stars, 6% one star, as of 16 October 2026).

Reviewers' verdict: Tom's Guide lists 1Password as the best password manager overall on 2 October 2026, TechRadar puts it at no. 6 on 27 August 2026 («best for families», 4 stars). PCMag lowered its score by half a point in March 2026, mainly criticising the price rise. Company: 1Password (AgileBits) from Toronto, founded in 2005, over 1,400 employees, last valued at $6.8 billion in 2022.

NordPass belongs to Nord Security, the company behind NordVPN and Saily. Premium is for one person, Family for six accounts; consumer plans run for one or two years, monthly billing is only available for businesses. Added to that are a 30-day money-back guarantee on the first purchase and a 30-day Premium trial on the free plan, without a credit card.

On prices we have to be honest: nordpass.com loads the amounts only in the browser, and we could not read them directly on 16 October 2026. NordPass itself states in its FAQ «Premium from €1.23 per month» and «Business from €1.79 per month», and according to the pricing page billing is in US dollars excluding VAT. On 27 August 2026 TechRadar quoted $1.24 per month for the 2-year plan ($34.83 in total) and $25.35 for one year. After the first term the subscription renews at the then-current regular price, which NordPass does not state on its pricing page – check your account before that happens.

Current promotions (as of 21 October 2026): with the code gladyoufoundthis, according to nordpass.com/coupon, you get an extra free month on the 2-year Premium plan, with no stated expiry date. Students get 10% off the same plan with STUDENT10. NordPass also advertises three extra months on 2-year plans on its Black Friday page; the prices and end date only load in a browser, so we cannot state them here.

Technology: NordPass encrypts with XChaCha20-Poly1305 and derives the key from your master password using Argon2id – more modern than the usual AES-256 with PBKDF2. Premium includes a data breach scanner, password health check, email masks, an authenticator, emergency access (released after seven days), secure sharing and 3 GB for file attachments. All plans store passkeys; signing in to NordPass itself without a master password has been announced but is not available yet. Apps exist for Windows, macOS, Linux, Android and iOS, extensions for Chrome, Firefox, Edge, Safari, Brave and Opera.

The free plan is unlimited in the number of passwords but allows only one active session on one device – for a phone plus a laptop you need Premium. Sharing and file attachments are also missing in Free.

Audits: Cure53 examined the apps in 2020 and the Business version in 2021 (15 findings, one of them severe, fixed quickly according to Cure53). SOC 2 Type 2 (December 2023) and ISO 27001 explicitly refer to NordPass Business. We found no newer public audit reports. The clickjacking vulnerability in browser extensions demonstrated at DEF CON in August 2025 had, according to its discoverer, already been closed by NordPass in February 2025.

Company and contract: Nord Security was founded in Lithuania in 2012 and was worth around $3 billion in September 2023 after a funding round led by Warburg Pincus (TechRadar). According to the promotion terms, the contracting party for consumers is nordvpn S.A. in Panama – the data, according to NordPass, is held in AWS data centres in the USA and the EU.

Criticism: on Trustpilot NordPass stands at 4.0 out of 5 from 2,063 reviews (80% five stars, 10% one star, as of 16 October 2026); the poor reviews revolve around charges after cancellation, sluggish refunds and autofill that fails to recognise fields on some sites. Reviewers criticise the double login (Nord account plus master password), the lack of shared folders for families and the lack of custom fields. TechRadar nevertheless ranks NordPass no. 1 (4.5 out of 5, 27 August 2026), Tom's Guide no. 4; at Testachats and Que Choisir (February 2026) NordPass offered the best combination of features and security.

Bitwarden is open source, and its free plan is the most generous in the comparison: unlimited passwords on unlimited devices, passkeys, a free authenticator and a two-person organisation for sharing. If you want, you can run the server yourself.

Since 21 January 2026 Premium costs $1.65 per month ($19.80 per year) and adds file attachments (5 GB), emergency access, security reports, hardware keys as a second factor and the authenticator inside the vault. Families costs $3.99 per month ($47.88 per year) for six people. For businesses: Teams $4, Enterprise $6 per user per month (pricing page, retrieved on 16 October 2026). Bitwarden raised its prices in January 2026 – if you still have «$10 per year» in your head, that is the old rate.

Audits are Bitwarden's strength: in 2025 Cure53 (extension, desktop, web vault, crypto library), the Applied Cryptography Group at ETH Zurich, Palo Alto Networks' Unit 42 (mobile) and Fracture Labs examined the service; the reports are linked in the help centre. Added to that are SOC 2 Type 2, SOC 3 and ISO 27001. Key derivation runs with 600,000 PBKDF2 iterations by default, or Argon2id on request.

When creating your account you choose the data location, USA or EU (Microsoft Azure); it cannot be changed later. Company: Bitwarden Inc. from Santa Barbara (California), founded in 2016 by Kyle Spearrin, funded with $100 million from PSG in 2022, over 15 million users according to the company.

The weakness is convenience: Tom's Guide (2 October 2026) finds autofill and the password generator «a bit clunky», TechRadar (27 August 2026) says the desktop apps and support could be improved. On Trustpilot Bitwarden stands at 3.1 out of 5 – though from only 368 reviews (73% five stars, 17% one star, as of 16 October 2026), which says little about a product with millions of users. In both best-of lists Bitwarden is the best free manager (Tom's Guide no. 2, TechRadar no. 4).

Proton Pass comes from Proton AG in Geneva, which also runs Proton Mail and Proton VPN; its main shareholder is the non-profit Proton Foundation. All apps are open source, Cure53 audited the apps, extensions and API in 2023, and there is a public bug bounty programme. Data is encrypted with AES-256-GCM and stored in Switzerland.

The free plan includes unlimited passwords on all devices, passkeys, two vaults, sharing with two people and ten hide-my-email aliases – throwaway addresses that hide your real one. Pass Plus costs $2.99 per month billed annually ($35.88 per year; promotional price, regularly $4.99) and adds unlimited aliases, dark web monitoring, the authenticator, sharing with ten people and the Proton Sentinel protection programme. Pass Family costs $4.99 per month ($59.88 per year, regularly $6.99) for six people; Proton Unlimited with all Proton services $9.99 per month ($119.88 per year). 30-day money-back guarantee (proton.me, retrieved on 16 October 2026; we could not read the monthly and 2-year prices).

Reviewers' criticism: the free plan lacks breach monitoring, there is no live chat (TechRadar), and biometric unlock was available only on iOS and macOS at the time of testing, not on Android (Tom's Guide). Both lists feature Proton Pass as the privacy pick (Tom's Guide no. 5, TechRadar no. 7). The Trustpilot sub-profile has only 16 reviews – too few to draw a conclusion.

Dashlane has scrapped its free plan and sells Premium (with built-in VPN and fraud alerts) as well as Friends & Family for ten accounts. Keeper offers Unlimited and Family (five vaults, 10 GB), with breach monitoring costing extra. Both pricing pages show the amounts only in the browser; on 27 August 2026 TechRadar quoted $4.99 per month for Dashlane Premium and $1.67 for Keeper Personal – we could not verify this with the providers. Keeper is «best for security» at Tom's Guide (no. 3), Dashlane «best for security» at TechRadar (no. 5); both are criticised for their price.

Apple's Passwords app (from iOS 18 and macOS Sequoia) and Google Password Manager are free and a solid foundation for pure Apple or Chrome users – both store passkeys too. Their limit is the ecosystem: for Windows, Apple offers only the detour via iCloud for Windows and no Android support at all; Google works in Chrome and Android, and on the iPhone «best with Chrome». If you mix devices, share with others or want emergency access and breach alerts, you are better off with one of the four managers above.

All four providers work on the zero-knowledge principle: the vault is encrypted and decrypted on your device, and the provider does not know your master password. A breach at the provider therefore gives attackers encrypted data – how secure that is depends on the strength of your master password. Use a long phrase and turn on two-factor authentication.

In August 2025 security researcher Marek Tóth demonstrated a clickjacking method at DEF CON that let crafted websites trick the browser extensions of many password managers into filling in data. According to Tóth, NordPass, Dashlane, Keeper and Proton Pass had closed the gap by then; 1Password rated the risk as low, offers confirmation prompts per item type and stresses that passkeys are not affected. Our advice: trigger autofill only by clicking the extension icon, not automatically. Conversely, domain-bound autofill is an effective guard against phishing: on a cloned bank or login page under a different address, the field simply stays empty. A current example is the hotel-booking phishing wave targeting TWINT accounts that Switzerland's NCSC warned about in October 2026 (→ Hotel phishing with a 7.5 per cent «cashback» targets TWINT accounts – Switzerland's NCSC warns).

We are not aware of any leak of user vaults at any of the four providers. The benchmark remains the LastPass incident of 2022, in which encrypted vaults were stolen – one reason why public audit reports and a strong master password count for more than marketing promises.

You don't want to spend anything: Bitwarden Free. No device limit, passkeys included, open code – you only have to compromise on convenience.

You want the cheapest paid plan with all the trimmings: NordPass Premium on the 2-year plan. Check the total in the basket, use the code gladyoufoundthis for the free month and note down the renewal date.

A family with mixed devices and little appetite for tech: 1Password Families – five people, the best user experience and Travel Mode, but no free plan and noticeably more expensive since March 2026. Bitwarden Families costs $24 per year less for six people.

Privacy first, ideally with a Swiss base: Proton Pass – ten email aliases already in the free plan, breach monitoring in Plus. If you already use Proton Mail or Proton VPN, go for Proton Unlimited.

Whichever you choose: more important than the provider is that you use one at all – with a long master password and two-factor authentication turned on. A VPN is a further building block for protecting yourself online, but it does not replace a password manager.

Prices and features: 1password.com (pricing page, support articles on Travel Mode, Secret Key, security, regions and audits), nordpass.com (pricing page, FAQ, coupon page, promotion terms, support articles on plans, devices, attachments and emergency access), bitwarden.com (pricing page, blog post of 21 January 2026 on the price change, help on audits, key derivation and data location), proton.me (pricing page, security page, blog on the Cure53 audit) – all retrieved on 16 October 2026.

1Password price rise: TidBITS of 25 February 2026 and 1Password community forum (February 2026). NordPass dollar prices: TechRadar best-of list of 27 August 2026 (third-party figure).

Expert tests: TechRadar «Best password manager» (as of 27 August 2026), Tom's Guide «Best password managers» (as of 2 October 2026), PCMag review of 1Password (9 March 2026), Stiftung Warentest on the review by Testachats and Que Choisir (4 February 2026). Ratings: Trustpilot, retrieved on 16 October 2026.

Threat landscape and passkeys: Verizon Data Breach Investigations Report 2026, Have I Been Pwned (16 October 2026), FIDO Alliance (7 May and 15 October 2026). Clickjacking: Malwarebytes (22 and 27 August 2025), 1Password community forum (August/September 2025).