KeePass

KeePass is the answer to a question the rest of this category cannot address: what if there is no service? Passwords live in a single encrypted file on your own device. No account, no sync server, no company, no subscription, and no breach of a provider that could ever expose your vault — because there is no provider.

That architecture is why it remains the recommendation for people whose threat model includes the password manager itself. Every cloud-based manager, however well engineered, is a concentrated target holding millions of vaults, and the industry has demonstrated more than once what happens when one is compromised. A local file is not a target of that kind.

It is free and open source under GPL v2 or later, written by Dominik Reichl in Germany and maintained continuously since 2003 — more than two decades, which for security software is the strongest signal available.

A large plugin ecosystem and compatible clients on every platform read the same file format, so the file syncs through whatever storage you already trust. The costs are real: you handle sync and backup yourself, losing the file without a backup loses everything, the interface is dated, and sharing with a team is genuinely awkward — which is what Psono exists for.

What KeePass does well

• A local encrypted file — no service that can be breached
• Free and open source under GPL v2 or later
• Maintained continuously since 2003
• Compatible clients on every platform read the same file
• You choose how and whether it syncs

Where KeePass falls short

• You handle sync and backup yourself
• Lose the file without a backup and it is gone
• Dated interface
• Team sharing is awkward — Psono fits that better

Standout feature. There is no company to breach — the only design in this category where a provider compromise cannot reach you.