← Articles and guides on fraud, cybersecurity, privacy and AML

Free password manager: Bitwarden, Google, Apple and KeePassXC compared

Free password managers compared: what Bitwarden, Google, Apple, Proton Pass and KeePassXC offer on passkeys, sync and open source, and how to choose.

2026-10-31

Reusing one password across sites is what turns a small breach into a takeover of your email, bank and social accounts. Google's own account-security guide advises against reusing passwords and suggests a password manager. You can do that for free. This guide compares free options using objective criteria, with no sponsorship.

What should you look for in a free password manager?

Platforms: does it work on all your devices?
Passkeys: can it store and sync them?
Breach alerts: does it flag compromised, weak and reused passwords?
Sharing: can you share with family?
Transparency: open source code and published audits?
Free-tier limits: what is held back?

Which free password manager is best for you?

Tool	Platforms	Free highlights	Free limits
Google Password Manager	Android, Chrome on desktop	Password Checkup; passkeys sync between Android and desktop Chrome	Passkey creation and sync on iOS listed by Google as planned in its Sept 2024 announcement; check current status
Apple Passwords	iOS 18 / macOS Sequoia or later; Windows via iCloud	Passkeys, verification codes, Wi-Fi passwords, leak warnings, shared groups	Best inside Apple's ecosystem
Bitwarden	All major platforms	Unlimited items and devices, passkeys, open source, annual third-party audits	TOTP authenticator and vault health reports are Premium; free sharing limited to 2 users
Proton Pass	All major platforms	Unlimited items and devices, passkeys, 10 email aliases	Up to 3 2FA items; vault sharing is paid
KeePassXC	Windows, macOS, Linux	Free, open source (GPLv3), local encrypted file, ANSSI CSPN certification	No vendor cloud: you handle sync and backups

Is the built-in manager on your phone enough?

For many people, yes. Apple's Passwords app flags passwords that are easy to guess, reused or found in leaks, and stores passkeys and 2FA codes. Google's Password Checkup flags compromised, reused and weak passwords, and Google Password Manager has synced passkeys between Android and desktop Chrome since 2024, protected by a PIN that keeps them end-to-end encrypted. Friction appears when a household mixes iPhone and Windows or Android and Mac.

When does an independent manager make sense?

Mixed-device families benefit from a cross-platform tool. Bitwarden says its entire codebase is on GitHub under the AGPL and is audited annually by firms such as Cure53, plus a 2025 cryptography review by ETH Zurich. Proton Pass Free adds email aliases to keep your real address out of sign-ups. KeePassXC suits people who want full control over a local encrypted file.

What to do now

Pick one primary manager and protect it with a long passphrase and 2FA.
Import browser passwords, then delete the unencrypted export file.
Fix flagged passwords, starting with email, banking and phone carrier.
Turn on passkeys wherever offered; read our passkeys and MFA guide.
Keep recovery codes printed in a safe place.

If your data was already exposed, see what to do after a data breach and, in the US, IdentityTheft.gov and credit freezes. More in Tips and the Radar.

Free-tier features checked on official pages on Oct 31, 2026; they may change.