Best open-source password managers for Linux

On Linux, the best open-source password manager for most people is KeePassXC if you want everything offline, or Bitwarden if you want it synced to your phone without thinking about it. Proton Pass is the pick if built-in email aliases matter. pass is the answer for people who live in a terminal. If you want Bitwarden's apps on your own server, run Vaultwarden.

"Open source" here means the code you run is published and inspectable. It doesn't mean the same licence everywhere, and it doesn't mean "self-hosted." Proton Pass and Bitwarden's cloud are open-source clients talking to a company's servers.

#The shortlist

#1. KeePassXC: best offline password manager

Best for: Linux users who want a local, "cloud-free" vault, with no account at all.

KeePassXC is a native Qt desktop app, and Linux is a first-class platform. Many distributions package it, and the project also publishes an AppImage. Everything lives in one encrypted KDBX 4 file. For key derivation, the user guide recommends Argon2, and specifically Argon2id. Features include KeePassXC-Browser integration with passkeys, Auto-Type, TOTP, an SSH agent and YubiKey challenge-response. There are no plugins, by design.

Its security record is unusually well documented for a volunteer project. France's ANSSI awarded KeePassXC 2.7.9 a CSPN Security Visa on 17 November 2025, valid to 2028, and an independent code review of 2.7.4 was published in 2023.

Linux-specific, and time-sensitive: the 2.8.0-beta1 release (23 September 2026) adds Auto-Type on Wayland through XDG Desktop Portals, Quick Unlock via Polkit, a move to Qt 6, and state files moved to XDG_STATE_HOME. It also fixes several CVEs that affect all 2.7.x releases, rated low to moderate. The latest stable version is 2.7.12 (10 March 2026). Upgrade when 2.8.0 goes stable.

Trade-offs: there's no built-in sync (you sync the file yourself) and no official mobile app. On Android, the team recommends KeePassDX or KeePass2Android. On iPhone, it suggests Strongbox or KeePassium. See KeePassXC sync between devices.

#2. Bitwarden: best for syncing across every device

Best for: anyone who wants one vault on Linux, Windows, a phone and every browser, with no setup.

Bitwarden's download page lists Linux desktop builds as AppImage, .deb, .rpm, Flatpak (Flathub) and Snap, plus a CLI. It also has official iOS and Android apps and extensions for every major browser. That makes it the strongest answer to "open source password manager for android" and "for iphone," since the mobile apps come from the same vendor.

The free plan covers unlimited passwords and devices. Premium, which adds TOTP, attachments and emergency access, is $19.80 a year (USD, checked 29 September 2026). Bitwarden says data is encrypted on your device with AES-CBC 256-bit plus HMAC, and the master password is stretched with PBKDF2-SHA256 at 600,000 iterations or, optionally, Argon2id. It publishes annual third-party audits. The 2025 list includes Cure53 reviews of the core app, web vault, extension and desktop app, and an ETH Zurich cryptography review.

Trade-offs: the licence file says code in the /bitwarden_license directory is under the Bitwarden License v1.0, not the GPL. If "open source" to you means everything, look at KeePassXC or pass.

#3. Proton Pass: best for email aliases

Best for: people who want hide-my-email aliases built in, or already use Proton Mail.

Proton ships an official Linux app as .deb (Debian and Ubuntu-based) and .rpm (Fedora and Red Hat-based) packages, alongside Windows, macOS, iOS, Android and browser extensions. The free tier has unlimited logins and devices and 10 aliases. Pass Plus costs $35.88 per 12 months, and unlocks TOTP, attachments and unlimited aliases.

Proton says vaults are encrypted with 256-bit AES-GCM, keys are protected with OpenPGP using Curve25519, and metadata is encrypted too. Cure53 audited the apps, extensions and API in 2023, and Proton published the report.

Trade-offs: there's no Flatpak or Snap listed, and no self-hosting. TOTP is paid. See Bitwarden vs Proton Pass.

#4. pass: best for the terminal

Best for: developers who want passwords as GPG-encrypted files in a Git repository.

pass calls itself "the standard unix password manager." Each password is a GPG-encrypted file in ~/.password-store. You can organise the files in folders, copy them between machines and manage them with ordinary shell tools. It can copy a password to the clipboard temporarily and track changes with git. It's "a very short and simple shell script," with shell completion for bash, zsh and fish, and the community has built GUIs and clients for other platforms, plus extensions for pass itself.

Trade-offs: you need to be comfortable with GPG keys. Mobile and browser support come from community projects, not the author. Each entry's filename is the site or resource name, so those names aren't hidden the way the passwords are. It's GPL-2.0-or-later.

#5. Vaultwarden: best self-hosted server

Best for: Linux homelabbers who want Bitwarden's polished clients against a server they run.

Vaultwarden is an unofficial, AGPL-3.0 Bitwarden-compatible server in Rust. It's one Docker image, SQLite by default, and it runs from a VPS down to a Raspberry Pi. You use the official Bitwarden apps listed above. Its README is clear that it's "not associated with Bitwarden or Bitwarden, Inc." Latest release: 1.37.3 (13 September 2026).

Trade-offs: you own HTTPS, updates and backups. More options are in the best self-hosted password managers, and Bitwarden lite vs Vaultwarden covers the choice between them.

#On Android and iPhone

Your phone is where most of these differ, and where two secondary questions ("open source password manager for android" and "for iphone") actually get settled:

• Bitwarden and Proton Pass have official apps on both platforms from the same vendor as the desktop app. Proton's Android app source is public under GPL-3.0.
• Vaultwarden uses the official Bitwarden mobile apps. Push notifications to mobile need extra configuration, which its wiki documents.
• KeePassXC has no mobile app. The team recommends KeePassDX or KeePass2Android on Android and Strongbox or KeePassium on iOS. These are separate projects, so check each one's licence and security documentation yourself before trusting it with your vault.
• pass relies on community clients for phones, listed on its website.

#"Open source password manager, local only"

If "local" means your passwords never leave your devices, only two picks qualify out of the box: KeePassXC and pass. Both store an encrypted file or folder you control, and any syncing is up to you. Bitwarden and Proton Pass keep an encrypted copy on their servers by design. Vaultwarden moves that copy onto a server you run, which is local to your network but still a server you have to secure.

#How to choose

• Local only, nothing online: KeePassXC. pass if you prefer the command line.
• Just works on Linux, phone and browser: Bitwarden.
• Email aliases, or you're on Proton already: Proton Pass.
• Your own server: Vaultwarden, or Bitwarden's own lite image.

A note on "best": the audits and certifications above are what each project publishes for specific versions. None makes a product safe by itself. What matters most is a strong master password, two-factor login on hosted accounts, and keeping the app updated. For the Bitwarden angle, see free Bitwarden alternatives.