Bitwarden vs KeePassXC vs 1Password
Three defensible password manager picks for very different threat models. Free open source cloud-sync, fully local, or polished closed-source paid.
Picking the right password manager matters more than picking the right anything else on this site. Reuse is still the #1 source of credential breaches.
Bitwarden — free unlimited passwords with cloud sync, open source, self-hostable via Vaultwarden. Browser extensions and apps everywhere. The default for the median person. $10/year premium adds emergency access and TOTP, both optional.
KeePassXC — local-first. The .kdbx file is yours; sync via Syncthing, Nextcloud, USB stick. No cloud trust required. Browser extension exists; mobile compatible apps (Strongbox iOS, KeePassDX Android) read the same format. The choice when you want zero cloud dependency.
1Password — closed source but heavily audited. Secret Key architecture means even a server compromise yields ciphertext only. Best UX in the category, family vaults, SSH agent integration. $3/month. The pick when polish and family use matter more than openness.
Pick Bitwarden if you're picking your first password manager. It's the right answer 80% of the time.
Pick KeePassXC if you object to cloud dependency on principle, or if you want one less subscription. Sync is a DIY problem you must solve, but the format is yours forever.
Pick 1Password if you have a family, you want polish, and "open source" is not a hard requirement for you. The Secret Key threat model is genuinely strong.