European Alternatives to Bitwarden
Looking for a European alternative to Bitwarden? Bitwarden is open source, but Bitwarden, Inc. is a Delaware company whose terms apply US federal and California law, so the case for leaving is jurisdiction and ownership, not closed code.
Eleven European tools are ranked for teams and companies: open-source and self-hostable vaults first, then hosted team vaults and offline options, from companies in Luxembourg, Germany, Switzerland, France and Denmark.
How we rank these tools — 4-step process
-
1
European ownership, verified
The company is headquartered and incorporated in the EU, EEA or Switzerland, and processes customer data in Europe. A US parent company disqualifies a tool from this page regardless of where its servers are.
-
2
Category fit and hands-on review
What the tool actually does, who it suits, and where it falls short — checked against the vendor’s own documentation, changelog and pricing page rather than its marketing copy.
-
3
Compliance and pricing check
GDPR posture, hosting location and the prices quoted on this page are verified against the vendor’s public pricing before publication, and re-checked when we revisit the category.
-
4
Position on this page
Placement on this page can be paid, and that can affect which tools appear here and the order they appear in. It never buys a good review: a tool that fails the checks above is not here at any price, and payment does not change the shortcomings we write about. A vendor can ask us to correct a factual error — not to remove a criticism.
Vendors can pay for visibility on this page. It never changes what an entry says about a product, including the criticism, and we earn nothing when you click through to a vendor. Paid placement can affect which tools appear here and the order they appear in. Editorial policy
11 European Alternatives to Bitwarden
Passbolt
Luxembourg open-source team vault under AGPLv3, free Community Edition and Luxembourg law
Proton Pass
Swiss open-source password manager with a free plan and a business edition, under Swiss law
Psono
German open-source company vault, self-hosted or SaaS, with all business features free up to ten users
LockPass
French business vault from LockSelf with on-premises option, French hosting and ANSSI CSPN certification
heylogin
German passwordless team vault hosted at Hetzner, free private plan and Business from EUR 3.99 per user
KeePassXC
Free offline open-source vault with an ANSSI security visa and no company behind it
Uniqkey
Danish business-only password and access manager with SCIM and audit log, price on request
Password Depot
Darmstadt vault sold as EUR 99.95 one-time licence, with a self-hosted Enterprise Server free up to three users
SecureSafe
Zurich safe for passwords and documents with data stored only in Switzerland, bundle from CHF 19.90 per month
KeePass
The original free open-source offline vault, maintained by one developer in Germany
Steganos Password Manager
Karlsruhe consumer vault for Windows, iOS and Android with local storage, no team features
Key takeaways
- Bitwarden, Inc. is a US (Delaware) company; its terms apply US federal and California law and California courts. The argument against it is jurisdiction and ownership, not closed code.
- Passbolt (Passbolt SA, Luxembourg, Luxembourg law) is the closest equivalent: open source under AGPLv3, free Community Edition for unlimited users, Pro at EUR 4.5 per user per month billed annually with a ten-user minimum.
- Psono (esaqa GmbH, Germany) is open source and self-hostable, with all business features free up to ten users.
- LockPass (LockSelf SAS, France) offers SaaS or on-premises with French law and ANSSI CSPN certification, but no price was readable.
- Proton Pass (Proton AG, Switzerland) and heylogin (heylogin GmbH, Germany) are hosted, not self-hostable. heylogin works without a master password and costs EUR 3.99 per user per month on annual billing.
- KeePassXC and KeePass are free offline vaults without any company behind them; they suit one person or a very small team, not central administration.
- There is no verified European replacement for Bitwarden Secrets Manager (machine credentials in CI).
Why people leave Bitwarden
Bitwarden is the password manager most teams reach for when they want something open, cheap and self-hostable. The code is open source, an organisation can run its own server, and that combination is why it is the default answer to "which password manager should we use". It is also the reason this page is not the usual argument.
Bitwarden, Inc. is a US company. Its terms say the service is governed by United States federal law and the law of California, with disputes going to the California courts, and that Bitwarden Inc. is incorporated in Delaware with 8bit Solutions LLC as a wholly owned subsidiary.
If you choose the hosted service, your team's vault is held by a company under that jurisdiction. If you self-host, the server is yours, but you still depend on a US vendor for updates, licences and the roadmap.
So the question here is not whether a European tool is more open, because Bitwarden already is. It is whether you want your company's credential store contracted with, and owned by, a company in Europe. The eleven tools below are ordered for exactly that: open-source and self-hostable options first, then hosted team vaults, then simpler or single-user options. They are not all drop-in replacements, and each entry says what you give up.
- The hosted service sits under US and California law Bitwarden's terms state that the agreement and any use of the service are governed by the federal laws of the United States and the laws of the State of California, with exclusive jurisdiction and venue in the California courts. Vault contents are encrypted on your device before they reach Bitwarden, and nothing on this page says otherwise. What the terms do decide is which courts rule on any dispute with the vendor and whose legal process the company is subject to.
- Open source answers the code question, not the ownership question Because Bitwarden is open source, you can read what the client does and run the server yourself. That is a real advantage, and Passbolt, Psono and KeePassXC offer the same. What open source does not change is who owns the company that ships the releases and sells the support. A Luxembourg or German company under local law is a different counterparty from a Delaware one, even when both publish their code.
- Self-hosting moves risk onto your own team Running your own server keeps the data inside your infrastructure and your jurisdiction. It also makes you responsible for backups, patching, uptime and recovery if an admin leaves. Passbolt, Psono and LockPass (on-premises) are built for that, and Password Depot's Enterprise Server is free for up to three users. If nobody on your team wants to run a server, a hosted European vault is the more honest comparison.
- There is no European tool for developer secrets Bitwarden also sells a Secrets Manager for machine credentials in pipelines. We did not find a European, verifiable product that replaces it. The tools here share logins and passwords with people, not secrets with build servers, and this page does not pretend otherwise. If that is your use, plan a separate choice for it.
What you have to replace, not just match
Export is the easy part. Most of the tools here import from a CSV or from Bitwarden's export, so a first test takes an afternoon: export one collection, import it into a trial or a local KeePassXC vault, and check that folders, notes and attachments came across. Test TOTP codes and attachments separately, because those are the fields CSV imports handle worst.
Decide the hosting model before the tool. A team that wants no server should look at Proton Pass, heylogin, Uniqkey, SecureSafe or the hosted tiers of Passbolt and LockPass. A team that wants to keep the data in-house should start with Passbolt Community, Psono or Password Depot. Run the new vault in parallel with Bitwarden for a few weeks before you cancel, and rotate shared credentials that were in the old vault as you go.
The alternatives compared
| Position | Tool | Headquarters | Pricing | Jurisdiction |
|---|---|---|---|---|
| #1 | Passbolt | Luxembourg City, Luxembourg | Free Community Edition / from about €4/user/month (Pro) | EU (Luxembourg) |
| #2 | Proton Pass | Geneva, Switzerland | Free tier / from about €1.99/month (Pass Plus) | Switzerland (adequacy decision, outside the EEA) |
| #3 | Psono | Germany | Free and open source / paid hosting and enterprise plans | EU (Germany) |
| #4 | LockPass | Levallois-Perret, France | No public price list: Starter from 2 licences, Premium from 25, On-Premises from 50, priced by module and by a one- or three-year term | EU (France) |
| #5 | heylogin | Hannover, Germany | Free tier / from about €2.50/user/month (Business) | EU (Germany) |
| #6 | KeePassXC | Weimar, Germany | Free and open source | No service — the file is yours |
| #7 | Uniqkey | Copenhagen, Denmark | From about €3/user/month | EU (Denmark) |
| #8 | Password Depot | Darmstadt, Germany | €99.95 one-time (1 user, all own devices) / Family €149.95 one-time for 5 licences / Enterprise Server by quote, free for up to 3 users | EU (Germany) |
| #9 | SecureSafe | Zurich, Switzerland | Pass from CHF 11.70/month (Starter) / CHF 3.20 per user/month (Professional) / CHF 4.60 per user/month (Business); Pass + File bundles from CHF 19.90/month for 5 users | Switzerland (adequacy decision, outside the EEA) |
| #10 | KeePass | Germany | Free and open source | No service — the file is yours |
| #11 | Steganos Password Manager | Karlsruhe, Germany | €29.99/year annual subscription (list price €39.99) | EU (Germany) |
How each alternative compares to Bitwarden
- Which law reaches it. EU (Luxembourg). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. EU cloud, or self-hosted anywhere.
- Source code. Open source, as Bitwarden is.
Best for: IT and security teams that want an open-source, self-hostable shared vault under European law
Passbolt is built by Passbolt SA, a Luxembourg company with its registered office in Belvaux. Its subscription and cloud terms are governed by the law of the Grand Duchy of Luxembourg, which is the cleanest contracting position of the tools here. The Community Edition is open source under AGPLv3, free for unlimited users, and covers password sharing, private and shared folders, user and group management and secret-key authentication.
The paid Pro edition adds tags, LDAP provisioning, single sign-on with Microsoft, Google and OpenID, account recovery, an activity log and a VM appliance, at EUR 4.5 per user per month on annual billing with a minimum of ten users.
If you do not want to host it, Passbolt Cloud costs EUR 5 per user per month billed monthly, in Belgium and Germany on Google Cloud data centres, or EUR 7 in a private Luxembourg data centre. The Pro tier needs a server and someone to run it.
What Passbolt does better than Bitwarden
- Luxembourg company under Luxembourg law, where Bitwarden is Delaware under California law
- Free Community Edition for unlimited users, open source under AGPLv3
- Self-hosting and a Luxembourg-hosted Sovereign cloud tier
- Pro adds SSO, LDAP provisioning and an activity log
Where Passbolt is a step down from Bitwarden
- Pro and the cloud tiers need at least ten users
- Cloud Business runs on Google Cloud data centres, a US infrastructure provider
- You run the server yourself on the free and Pro editions
- A narrower product, built for teams rather than for personal use
Standout against Bitwarden. It is the only option here that combines open source, self-hosting and a Luxembourg contract for teams.
- Which law reaches it. Switzerland (adequacy decision, outside the EEA). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. Switzerland, Germany.
- Source code. Open source, as Bitwarden is.
Best for: Teams that want a hosted tool from Switzerland and already use or consider Proton
Proton Pass is operated by Proton AG in Geneva, under the supervision of the non-profit Proton Foundation. Proton's terms apply Swiss law for business users and give the Geneva courts exclusive jurisdiction. Switzerland is outside the EU but has an adequacy decision, and Proton describes Pass as an encrypted, open-source password manager with a free plan.
It is hosted only: we did not find a self-hosted edition. Proton sells Pass inside its business suite, with permission management over who can reach company credentials. Prices on its pages are rendered in the browser, so no figure is quoted here. Check the current business price before you compare it with Bitwarden's.
What Proton Pass does better than Bitwarden
- Swiss company and Swiss law, where Bitwarden is Delaware under California law
- Described as open source, with a free plan
- No server to host or patch
- Part of a wider Proton suite if you also want mail and storage
Where Proton Pass is a step down from Bitwarden
- No self-hosted option that we could find
- Switzerland is outside the EU, though covered by an adequacy decision
- Business pricing could not be read, so we cannot say how it compares
- Less focused on shared infrastructure credentials than Passbolt or Psono
Standout against Bitwarden. It is the simplest hosted route to a European-jurisdiction vault, for teams that do not want to run a server.
- Which law reaches it. EU (Germany). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. Self-hosted, or German servers.
- Source code. Open source, as Bitwarden is.
- Independently checked. GDPR.
Best for: Teams with their own server that want an open-source shared vault and no licence cost for the first ten users
Psono is made by esaqa GmbH in Vorra, near Nuremberg, registered at HRB 37978 in Nuremberg. Its home page describes it as an open-source, self-hosted password manager for companies, with all business features free up to ten users, and as available either self-hosted or as a hosted service.
The terms on its site cover only the free psono.pw demo, not the commercial SaaS or Enterprise licences, so we could not verify the governing law for paid plans, and no paid price is quoted here. Check the contract before you sign. For a small team with an admin who can run a server, it is a free way to leave Bitwarden Cloud.
What Psono does better than Bitwarden
- German GmbH with a commercial register entry, where Bitwarden is Delaware
- Open source and self-hostable, as Bitwarden is
- All business features free for the first ten users
- Hosted option exists for teams that do not want a server
Where Psono is a step down from Bitwarden
- Governing law for paid plans was not verifiable
- Paid pricing could not be read
- Smaller vendor and ecosystem than Bitwarden
- The self-hosted version needs someone to operate it
Standout against Bitwarden. It is the only option here that offers every business feature free to ten users, open source and self-hosted.
LockPass
a French business vault with on-premises and a state security certification
- Which law reaches it. EU (France). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. France: hosted at Outscale or Scaleway, with HDS or SecNumCloud certified options, or on your own servers.
- Source code. Closed source, where Bitwarden publishes its code.
- Independently checked. ANSSI CSPN certification (version 2.2).
Best for: French and public-sector style organisations that want an ANSSI-certified vault and a choice of French hosting
LockPass is the password manager in the LockSelf suite, sold by LockSelf SAS in Levallois-Perret, registered at RCS Nanterre 800 034 043. Its terms of sale are governed by French law. LockSelf says LockPass is CSPN-certified by ANSSI, the French cybersecurity agency, and that data is hosted in France: on Scaleway for the shared cloud and on OUTSCALE for a dedicated cloud, with SecNumCloud hosting available. On-premises is offered as an alternative to SaaS.
Every plan lists a minimum number of licences (two on the entry plan, twenty-five on the premium plan), and the price columns on the page showed EUR 0.00 because they load in the browser, so no price is quoted here. A 14-day free trial is offered on the home page. We did not see it described as open source.
What LockPass does better than Bitwarden
- French company under French law, where Bitwarden is Delaware
- ANSSI CSPN certification, stated by the vendor
- Hosting in France, with SecNumCloud available on request
- On-premises option alongside SaaS
Where LockPass is a step down from Bitwarden
- Not open source as far as we could see
- Prices could not be read
- Minimum licence counts apply on the plans we saw
- Prices are not visible on the page, so you need a trial or a quote to compare
Standout against Bitwarden. It is the only option here with French hosting, on-premises deployment and an ANSSI-certified vault in one product.
- Which law reaches it. EU (Germany). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. Germany.
- Source code. Closed source, where Bitwarden publishes its code.
- Independently checked. End-to-end encrypted.
Best for: Small and mid-size companies that want to drop the master password and manage logins by team
heylogin is run by heylogin GmbH in Braunschweig. Its terms are governed exclusively by German law, and its privacy policy names Hetzner Online GmbH in Germany as the host. It works without a master password: you confirm each login with your phone, a security key, Touch ID or Windows Hello.
The private plan is free. Business costs EUR 3.99 per user per month on annual billing or EUR 4.99 monthly, with user and team management, predefined roles, an audit log and Entra ID or Google Workspace integration. Enterprise is priced on request. It is not self-hostable and we did not find it described as open source.
What heylogin does better than Bitwarden
- German GmbH under German law, hosted in Germany
- No master password to remember or reset
- Free private plan and a published business price
- Entra ID and Google Workspace integration on the Business plan
Where heylogin is a step down from Bitwarden
- Not open source as far as we could see, where Bitwarden is
- No self-hosted edition
- Daily logins depend on your phone or security key
- A smaller product than Bitwarden
Standout against Bitwarden. It is the only option here that gets rid of the master password altogether.
- Which law reaches it. No service — the file is yours. Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. An encrypted KDBX file on your own device; no KeePassXC cloud.
- Source code. Open source, as Bitwarden is.
- Independently checked. ANSSI CSPN security visa (version 2.7.9, 2025).
Best for: One person or a very small group that shares a database file and wants no service in the middle
KeePassXC keeps passwords in an encrypted KDBX file on your own device. There is no account, no sync server and no vendor cloud. It is free and open source, and its audits page lists an ANSSI security visa (ANSSI-CSPN-2025/16), valid from 17 November 2025 to 17 November 2028 for version 2.7.9 on Windows 10.
It is a community project, not a company: the legal contact on keepassxc.org is Janek Bevendorff in Weimar, Germany. That means no support contract, no service level and no central admin. For a team, syncing the file and managing access is your job.
What KeePassXC does better than Bitwarden
- No company, no cloud and no subscription
- ANSSI security visa for a specific version
- Free and open source
- Nothing to breach on a vendor server
Where KeePassXC is a step down from Bitwarden
- No central administration, audit log or user management
- No support contract or service level
- Sharing in a team means sharing a file you must sync yourself
- The certificate covers one version and platform, not every release
Standout against Bitwarden. It is the only option here backed by a French state security visa and with no service in between.
- Which law reaches it. EU (Denmark). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. Denmark (EU).
- Source code. Closed source, where Bitwarden publishes its code.
- Independently checked. Zero-knowledge, GDPR by design.
Best for: Companies that want password and access management together and are happy to request a quote
Uniqkey is sold by Uniqkey A/S, Lyskaer 8B in Herlev, Denmark, CVR 39 00 41 27. Its home page says it is ISO 27001 certified, hosted and operated in Europe and zero-knowledge, and it lists SCIM, an audit log and access restriction. The terms say it cannot be bought for personal use alone.
Its pricing page describes a single price and a complete solution, but shows no amount, and we could not find the governing law in the terms. The site-data figure of about EUR 3 per user per month was not confirmable. Ask for the price and the contract law before you compare it to Bitwarden Teams.
What Uniqkey does better than Bitwarden
- Danish company, hosted and operated in Europe (vendor statement)
- SCIM, audit log and access restriction listed
- Built for businesses rather than adapted from a consumer tool
- ISO 27001 certification stated by the vendor
Where Uniqkey is a step down from Bitwarden
- No price published, and no governing law found in the terms
- Not open source as far as we could see
- No self-hosted edition
- Cannot be bought for personal use only
Standout against Bitwarden. It is a business-only vault that pairs password management with company-wide access control.
- Which law reaches it. EU (Germany). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. No vendor cloud: a local file, your own Enterprise Server or your own Azure tenant; optional sync via Google Drive, OneDrive, Dropbox or HiDrive.
- Source code. Closed source, where Bitwarden publishes its code.
- Independently checked. ISO/IEC 27001:2022 (TÜV NORD); penetration-tested by SySS.
Best for: Companies on Windows that prefer a licence to a subscription and want the vault on their own server
Password Depot is made by AceBIT GmbH in Darmstadt, registered at HRB 33038 at the local court of Darmstadt. The client costs EUR 99.95 once for one user on any number of their own devices, with twelve months of support. The Enterprise Server for teams is quoted by user count and free for up to three users. AceBIT runs no vault cloud of its own: the vault is a local file, your own server or your own cloud tenant.
AceBIT says its ISMS is ISO/IEC 27001-certified by TUV NORD and that the product was penetration-tested by SySS in December 2025. The source is closed, so the client that handles your key has to be trusted rather than read, which is the opposite of Bitwarden.
What Password Depot does better than Bitwarden
- One-time price instead of a subscription for the client
- German GmbH with a commercial register entry
- Self-hosted Enterprise Server, free up to three users
- No vendor cloud holding your vault
Where Password Depot is a step down from Bitwarden
- Closed source, where Bitwarden is open
- Updates beyond the support period may cost extra
- Enterprise Server pricing is by quote
- A heavier, older-style product than the web-first competitors
Standout against Bitwarden. It is the only option here you buy once and run without any vendor cloud.
- Which law reaches it. Switzerland (adequacy decision, outside the EEA). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. Switzerland only; data centre operator not named.
- Source code. Closed source, where Bitwarden publishes its code.
- Independently checked. ISO/IEC 27001:2022.
Best for: Small teams that also want to keep contracts and scans next to the logins, stored only in Switzerland
SecureSafe is operated by DSwiss AG in Zurich. Its security page says data is stored and processed exclusively in Switzerland and not routed through hyperscale cloud providers, and describes server-side encryption as zero-knowledge. That wording is the vendor's own, and "server-side" is worth asking about before you rely on it.
The Starter Bundle, with passwords and files for five users, is CHF 19.90 per month, or CHF 183.60 billed yearly. We did not check the governing law or the per-user prices for the password module alone. It is not open source and not self-hostable.
What SecureSafe does better than Bitwarden
- Swiss company, with data only in Switzerland
- Passwords and files together in one safe
- Published bundle price for five users
- No hyperscale cloud in the hosting chain, per the vendor
Where SecureSafe is a step down from Bitwarden
- Switzerland is outside the EU
- Encryption is described as server-side, which differs from client-side encryption
- Not open source and not self-hostable
- Governing law and per-user pricing were not checked
Standout against Bitwarden. It is the only option here that stores passwords and documents together, exclusively in Switzerland.
- Which law reaches it. No service — the file is yours. Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. A file on your own device.
- Source code. Open source, as Bitwarden is.
- Independently checked. ANSSI CSPN; EU-FOSSA audit; code analysis sponsored by BSI.
Best for: People who want a file they control and are comfortable with a plain, older interface
KeePass is open source and has been developed since 2003 by Dominik Reichl, whose legal contact on keepass.info is in Metzingen, Germany. Passwords live in one encrypted file on your device, with no account and no cloud.
Like KeePassXC it has no company, support contract or central administration, but it has no ANSSI visa on its site that we saw, and its interface is dated. For a team it works only if you share and sync the file yourselves.
What KeePass does better than Bitwarden
- No service, no account and no subscription
- Open source and free
- Years of use since 2003
- No vendor to breach
Where KeePass is a step down from Bitwarden
- No central administration or audit log
- No support contract
- We did not find a security certification on its site
- A dated, desktop-centred interface
Standout against Bitwarden. It is the longest-running offline vault here, run by a single German developer rather than a company.
- Which law reaches it. EU (Germany). Bitwarden is run from the United States, so the CLOUD Act obliges the provider to hand over data on a valid order regardless of which country the servers are in.
- Where the data sits. A local encrypted file; optional sync through your own Dropbox, Microsoft OneDrive, Google Drive or MagentaCLOUD account (encrypted on your devices).
- Source code. Closed source, where Bitwarden publishes its code.
Best for: Individuals and very small offices on Windows who want a local vault and no team features
Steganos Password Manager comes from Steganos Software GmbH in Karlsruhe, registered at HRB 758 458. The product page lists it at EUR 29.99, struck through from EUR 39.99, for Windows, iPhone and Android. It keeps the vault as a local file and syncs through a cloud account you choose.
It is on this page last because it has no team administration, and because we could not confirm its ownership: it shares an address and managing director with Nero AG, and no group relationship is stated. Three of its sync options are American cloud services, which defeats the point for anyone choosing it on jurisdiction.
What Steganos Password Manager does better than Bitwarden
- German GmbH with a commercial register entry
- Works without any cloud
- Low price for a single user
- Windows, iPhone and Android apps
Where Steganos Password Manager is a step down from Bitwarden
- No team features, so not a Bitwarden Teams replacement
- Closed source
- Ownership not confirmed (shared address and director with Nero AG)
- Most of its sync options are US cloud services
Standout against Bitwarden. It is the cheapest local vault with phone apps here, for one person rather than a team.
What actually breaks when you switch
The slow part of leaving Bitwarden is not the import, it is the people. A team gets used to the browser extension, the Send feature and the organisation structure, and every one of the tools above handles sharing a little differently. Pilot with one team for a month before you move the company.
If you move to a self-hosted tool, budget for operations: backups of the database, a tested restore, a plan for when the one admin leaves. If you move to a hosted European vault, budget for the price difference and for checking the data processing agreement, which is a contract you should read either way.
Shared credentials in the old vault were visible to everyone who had access. After the move, rotate the ones that matter, especially for former staff, rather than copying them across.
If Bitwarden is open source, why look at a European alternative?
Because the open-source licence and the company behind it are separate questions. The code can be read and the server can be self-hosted, but Bitwarden, Inc. is a Delaware company whose terms apply US federal and California law. If your reason for leaving is the vendor's jurisdiction or ownership, an open-source tool such as Passbolt or Psono, run by a European company, answers it.
If your reason is that you wanted open code, there is nothing to gain by leaving, and this page says so.
Does self-hosting Bitwarden solve the jurisdiction problem?
Largely for the data, because the vault server and its database then sit in your own infrastructure. It does not change who sells you the licence, who provides updates and support, or which law governs your contract with the vendor.
For some teams that is enough, and self-hosting Bitwarden is a legitimate answer. For teams that need a European counterparty on paper, a European vendor is the cleaner answer.
Which of these can I run on my own server?
Passbolt (Community and Pro editions), Psono (open source, self-hosted or SaaS), LockPass (on-premises offered alongside SaaS) and Password Depot (an Enterprise Server, free for up to three users) all describe a self-hosted option. KeePassXC and KeePass need no server at all, because the vault is a file.
Proton Pass, heylogin, Uniqkey and SecureSafe are hosted services, and we did not find a self-hosted edition of them.
Is there a European replacement for Bitwarden Secrets Manager?
Not one we could verify. Passbolt and Psono share passwords and credentials between people, and some of them offer APIs or CLI tools, but this page did not test whether they work as a secrets store for build pipelines.
If you use Bitwarden Secrets Manager, treat it as a separate decision and check the current feature set of any candidate yourself.
Which one to pick
If you want to stay open source and self-hosted and only change the vendor, start with Passbolt, then Psono if a German vendor suits you better. If you want a hosted tool and no server, Proton Pass or heylogin are the simplest routes, and LockPass fits if French hosting and an ANSSI-certified product matter.
If you are one person or a very small group, KeePassXC does the job without any company. Password Depot is the route if you want a licence and an in-house server on Windows.
Be realistic about the gap. Bitwarden is open source, cheap and mature, and none of these eleven reproduces its Secrets Manager. Switch if US jurisdiction and ownership of your credential store is the problem, and stay if open code was the reason you chose it.
Frequently Asked Questions
Passbolt is the closest in spirit: open source under AGPLv3, self-hostable, built for teams and run by Passbolt SA in Luxembourg under Luxembourg law. Psono is similar and German, and Proton Pass is the better answer if you want a hosted tool from Switzerland with no server to run.
Yes. Its terms say Bitwarden Inc. is incorporated in the State of Delaware, that 8bit Solutions LLC is wholly owned by Bitwarden Inc., and that the service is governed by US federal law and the law of California, with exclusive jurisdiction in the California courts.
Yes, and so are several alternatives on this page: Passbolt (AGPLv3), Psono, KeePassXC and KeePass, and Proton Pass describes itself as open source. Leaving Bitwarden is therefore not a way to get more open code, only to change the company and jurisdiction.
The Community Edition is free with unlimited users under AGPLv3. Pro costs EUR 4.5 per user per month billed annually, with a minimum of ten users and volume discounts after one hundred. Passbolt Cloud Business is EUR 5 per user per month billed monthly, hosted in Belgium and Germany on Google Cloud data centres, and Cloud Sovereign is EUR 7 per user per month billed annually, hosted in Luxembourg.
It is hosted in the EU, but the Cloud Business tier runs in Belgium and Germany on Google Cloud (GCP) data centres, so the infrastructure provider is a US company. The Sovereign tier is hosted in a private data centre in Luxembourg. Self-hosting removes the question entirely.
Psono says all business features are free up to ten users. It is open source and can be self-hosted, or used as a hosted service. We could not read the paid pricing, so none is quoted here.
The private plan is free. Business is EUR 3.99 per user per month on annual billing or EUR 4.99 monthly, with Entra ID, Google Workspace and CSV integrations. Enterprise is on request. heylogin has no master password: you confirm each login with your phone, a security key or Touch ID.
For a single person or a very small group that shares a database file, yes. It has no central administration, audit log or user management, because there is no server. It has an ANSSI CSPN security visa for version 2.7.9, valid until November 2028. For central control of a team, choose Passbolt, Psono or one of the hosted vaults.
KeePassXC has an ANSSI CSPN security visa (ANSSI-CSPN-2025/16). LockSelf states that LockPass is CSPN-certified by ANSSI. Uniqkey and Password Depot's vendor describe ISO/IEC 27001 certification, and Passbolt's Cloud Business tier lists SOC 2 Type II. These are vendor statements, apart from the KeePassXC page, which lists the visa details.
We left it out. nordpass.com blocked every automated request, so we could not read its terms and could not confirm which company contracts with customers or under which law. A tool we cannot verify does not get listed.
Nothing leaves automatically. Export your vault from Bitwarden, import it into the new tool, and keep Bitwarden active until you have checked folders, notes, attachments and one-time-code entries. Delete the old organisation only after that.
Related comparisons
European tools head to head
Who worked on this review
Explore More European Alternatives
Discover privacy-focused European alternatives to other popular US tech services.