Open Source 1Password Alternatives

Usernames, passwords, URLs, attachments and notes live inside one encrypted file that KeePassXC manages. That file is yours to place anywhere, on a local disk, a private server or a public cloud folder, and its contents are never exposed outside the program. The project aims at people with high demands for secure personal data management.

Databases use the KeePass compatible KDBX format, both KDBX4 and KDBX3, so the file is not bound to this one client. Entries carry user defined titles and icons and sit in customizable groups, and the search function takes advanced patterns for finding a single record in a large database.

The feature set reaches well past storing a password.

• Password generator: build passwords from any combination of characters, or passphrases that are easier to remember.
• Auto-Type and browser integration: fill credentials into applications and into Chrome, Firefox, Edge, Chromium, Vivaldi, Brave and Tor Browser, with passkeys supported through the extension.
• Hardware and TOTP: store and generate TOTP codes, and unlock with YubiKey or OnlyKey challenge response.
• System integration: an SSH agent, the FreeDesktop Secret Service that can replace a Gnome keyring, and a command line client named keepassxc-cli.
• Reports and migration: password health, Have I Been Pwned checks and statistics, plus imports from CSV, 1Password, Bitwarden, Proton Pass and KeePass1.

Pre-compiled binaries cover all three desktop platforms and many Linux distributions ship their own package. Twofish and ChaCha20 are available as alternative ciphers, entry history restores overwritten values, and exports to CSV, XML and HTML get your data out whenever you want it elsewhere.

This repository holds the Bitwarden server: the APIs, the database and the core infrastructure behind every Bitwarden client application. Running it yourself is what turns a hosted password manager into one whose storage sits on hardware you answer for.

The code is C# on .NET with ASP.NET Core, and the database is T-SQL on SQL Server. It can be developed, built, run and deployed on Windows, macOS and Linux distributions alike, which keeps contribution open to whatever machine you already use.

The backend is split into services that mirror the product.

• API and Identity: the endpoints clients call, and the authentication service standing behind them.
• Events: an events service with a separate processor for recording account and organization activity.
• SSO and SCIM: single sign-on and directory provisioning for organizations.
• Billing: subscription handling deployed as its own service.
• Admin: an administrative surface, alongside the notifications service.

Deployment is through Docker containers on Windows, macOS or Linux, with PowerShell and Bash scripts for the install and start steps, and images published on the GitHub Container Registry. Docker and Docker Compose are the only requirements. The server setup guide in the contributing documentation covers building from source, and security reports are welcome privately or through the project's HackerOne program.

Passbolt lets an organization centralize, organize and share passwords and secrets without the spreadsheet or the shared login everyone half trusts. Its security model puts secret keys in the hands of users and encrypts end to end, so the server never holds anything readable.

The project is audited several times a year and publishes the findings, which is worth stating plainly because few password managers do. Passbolt is headquartered in Luxembourg inside the European Union, collects no personal data or telemetry, and can be deployed in an air-gapped environment.

Access happens from wherever the team already works.

• Browser extensions: Chrome, Firefox and Edge, covering Brave, Opera, Vivaldi and other Chromium browsers.
• Mobile apps: native clients published on the App Store and Google Play.
• Command line: a Go based CLI tool handles scripted access.
• Desktop: a Windows application exists in pre-alpha and is not finished.
• Sharing policies: credentials are shared and audited under policies built for power users.

Self-hosting is documented for Docker, Kubernetes and native installs on Ubuntu, Debian, RedHat, Fedora, openSUSE, Rocky Linux, AlmaLinux, Oracle Linux, CentOS and Raspberry Pi, plus AWS and DigitalOcean. The code is AGPL version 3, though the Passbolt name is a registered trademark held back from that license. A community edition, a paid pro edition and a hosted cloud sit side by side.

Storing shared credentials in a spreadsheet or a chat thread stops working the moment a team grows. Padloc handles password and data management for individuals and teams, with the whole stack published as source so an organization can run its own server rather than trusting someone else to hold the vault.

The repository is a monorepo split by target. A core package holds the logic, an app package holds the web UI components, and a server package is the backend. Separate packages wrap the same client as a progressive web app, an Electron desktop build, a Tauri native build, Cordova projects for iOS and Android, and a browser extension. A locale package carries translations, and a security whitepaper in the repository documents the design.

Running your own instance comes down to a handful of components.

• Server: the backend, listening on port 3000 by default and configurable through environment variables.
• Web client: a progressive web app on port 8080, the minimum pairing with the server.
• Desktop builds: Electron and Tauri packages producing cross-platform native applications.
• Mobile: a Cordova project used to build the iOS and Android apps.
• Browser extension: a separate package for working with credentials in the browser.

A local test instance takes a clone, an npm install, and npm start. Unit tests and Cypress end-to-end tests come with the repository, and every component is built and released through a single GitHub workflow driven by one project-wide version number.

Two-factor authentication puts a second check on top of a password, and 2FAS is the free app that supplies it. This repository holds the official Android client for the Open Source 2FAS project, showing the one-time code that proves you hold the phone as well as the password.

It implements the two standard algorithms rather than a proprietary scheme, which is what makes it a drop-in for accounts you already have. Any service supporting TOTP or HOTP works with it, Google, Microsoft and Dropbox among them, and setup is a matter of following the on-screen instructions once the app is installed.

A few things are worth knowing before adopting it.

• TOTP: time-based one-time passwords, the algorithm most services use.
• HOTP: counter-based one-time passwords, for services that use those instead.
• Graphics licensing: the artwork in the app is not part of the open source project and carries separate terms.
• Security reports: vulnerabilities go to a dedicated security address rather than the public issue tracker.
• Funding: development and maintenance are supported by donations rather than a paid tier.

Builds are downloaded from the project's releases page and installed on the device. Bug reports go through GitHub issues, where searching for an existing report first is requested, and a contribution guide covers pull requests. The code is licensed under GPL-3.0 by Two Factor Authentication Service, Inc. It suits anyone who wants an authenticator whose source they can read, rather than one tied to an account they do not control.

PearPass keeps a password and identity vault on your own devices, encrypting passwords, credit cards, secure notes and custom fields before they are written to disk. No provider holds the copy that matters. The README states that active development is currently paused, so anyone adopting it should weigh that.

Sync is where it departs from the usual design. Instead of a central service, the desktop app is built on Pear Runtime and moves credentials directly between your devices over peer-to-peer connections. The interface is React with styled-components, Redux for state and Lingui for translations, while the vault itself lives in separate worker libraries shared with the mobile app and the browser extension.

What the desktop app covers day to day is small and specific.

• Encrypted storage: every entry type is encrypted at rest before it touches the disk.
• Offline access: the vault opens with no network connection at all.
• Password health: strength analysis flags weak entries in the vault.
• Generator: strong, unique passwords created on demand.
• Multi-platform: macOS, Linux and Windows builds, with a mobile app and browser extension alongside.
• Diagnostics: logging is off by default, and the vault worker redacts known sensitive fields before writing.

Building it needs Node at the version pinned in the repository plus the Pear Runtime, after which the app is staged and run through the pear command. Intel Mac builds are deprecated and shipped without official support or testing. The code is Apache 2.0 licensed, and guides for setup, vault management and syncing live in the project documentation.