Password Manager Download Guide: Free, Local and Cloud Vaults

A good manager encrypts your vault with strong encryption (typically AES-256) derived from your master password. With proper zero-knowledge design, the provider never sees your master password or the unencrypted contents, meaning even a breach of their servers shouldn't expose your logins. The trade-off is that if you forget your master password, no one can recover it for you, so choose something strong and memorable, and store a recovery code safely.

Cloud managers sync your vault across phone, laptop, and browser automatically, which is convenient and how most people use them. Local managers keep the vault file entirely on your own devices, giving you full control but requiring you to handle syncing and backups yourself. Both can be very secure; the choice comes down to convenience versus control.

For a local vault, our KeePassXC download guide walks through the installers, signature checks and first database setup step by step.

Look for these capabilities when choosing:

• A strong, customizable password generator.
• Autofill via browser extensions and mobile apps.
• Two-factor authentication (2FA) on the vault itself.
• Breach monitoring that alerts you if a saved login appears in a known leak.
• Secure sharing for family or team credentials.

You don't need to pay to be secure. Bitwarden's pricing page lists unlimited passwords on unlimited devices, passkey management and sharing with one other user on its free plan, and KeePass and KeePassXC are entirely free and open source. Paid plans add features such as an integrated authenticator, file attachments, emergency access and security reports; Bitwarden lists its Premium plan at $19.80 per year at the time of writing. Start free, and upgrade only if you find a feature you genuinely need.

The two best-known local managers share a file format but are different programs. KeePass is the original, written in C#; its official download page lists KeePass 2.61.1 for Windows 7 to 11, in installer and portable form, with Mono needed to run it on Linux and macOS. KeePassXC is a separate community project that began as a fork of KeePassX. It is written in C++, runs natively on Windows, macOS and Linux, and uses the same KDBX database format, so the same vault opens in both.

KeePassXC 2.8.0, released on 21 October 2026, moved to Qt 6, added configurable shortcuts and Wayland Auto-Type on Linux, and fixed several security issues. Neither project makes its own mobile app; KeePassXC's documentation points to compatible third-party apps for Android and iOS. If you go local, you are responsible for copying the vault between devices, usually by keeping the file in a synced folder, and for backing it up.

More sites now offer passkeys, which replace a typed password with a cryptographic key stored on your device or in your password manager. Passkeys cannot be phished in the same way as passwords because they only work on the real website. If you want to keep passkeys alongside your passwords, check that your manager supports them on every device you use; Bitwarden, for example, lists passkey management on its free plan. You can adopt passkeys gradually: keep your existing passwords in the vault and add a passkey whenever a site offers one.

A password manager concentrates everything in one place, so a backup plan matters. For a local vault, keep at least one copy of the database file on another drive or in encrypted cloud storage; our backup software guide covers tools that do this automatically. For a cloud vault, export an encrypted backup occasionally and print or safely store the account recovery code. Also keep the computer itself clean: no manager can protect a master password typed on a PC with a keylogger, which is why our malware removal tool guide is worth a look if anything seems off.

When you install a manager, the most important decision is your master password: make it long, unique, and something you'll never reuse. Enable two-factor authentication on the vault immediately. Then import existing passwords (browsers can export them) and, over time, replace weak or reused ones using the built-in generator. Download only from the official site or your device's official app store to avoid fake clones.