Updated 16 October 2026 · Edited by the Benchmark Buyer team · How we review
We do the homework you'd do before buying, so you don't have to. Like any careful buyer, we read the independent security audits, the expert reviews and what users say, then sum up where they agree and where they don't. We don't run our own tests. No lab tests password managers side by side, so this guide draws on the security audits and certifications each company has published, documented security incidents, and 8 expert reviews published between September 2025 and October 2026.
The short answer
1Password is the consensus pick. Three expert sources rank it first, and seven of our eight list it. NordPass is a close second, top at TechRadar and Cybernews. If you want something free, Bitwarden scores best: experts rate its free plan the best around, and it has more independent security audits on public record than any other product here.
Stars show the consensus score out of 10, turned into a 5-star scale and rounded to the nearest half star; the exact score is in each product's section. Security audits sum up what each company has published about independent audits and certifications in the last 18 months, and any incident in that time. Where a company says it is independently audited but we couldn't confirm the details, its score is based on the expert reviews alone. Popularity (●●●● very high to ●○○○ lower) is based on how many people have rated each app on Google Play: very high (5m+ ratings), high (1m+), medium (500k+) or lower. It shows how widely used a product is, not how good it is, so it doesn't affect the score.
1. 1Password: the experts' favourite
★★★★★Consensus score: 9.5
1Password has the best expert record here. Tom's Guide, Zapier and All About Cookies rank it first, and Cybernews and Security.org third.
"1Password is the full-featured password manager we recommend to most for its all-in approach to security and convenience" (Tom's Guide)
1Password states SOC 2 Type 2 and ISO 27001 certification, and says annual penetration test reports have been available on its Trust Center since November 2025, but its public security page names no recent testing firm or test date. Its last named audit on that page, by Independent Security Evaluators, dates from 2020. Because we couldn't confirm a recent audit either way, its score is based on the expert reviews alone.
Where opinions differ: TechRadar ranks it sixth, naming it best for families, and PCWorld leaves it out.
Who it suits: people who want the most polished app and are happy to pay for it.
NordPass is TechRadar's and Cybernews' top pick and second at PCWorld and Security.org. TechRadar and PCWorld both single out its value.
"NordPass is the best password manager for most people, offering an affordable app packed with tools." (TechRadar)
NordPass states SOC 2 Type 2 and ISO 27001 certification and "independent third-party security audits", including one by Cure53, but its public pages give no date for a recent audit. Its score is based on the expert reviews alone.
Where opinions differ: PCWorld warns: "NordPass can feel cumbersome to use if you have more than a couple of devices to log into." (PCWorld) Zapier and Privacy Guides don't list it.
Who it suits: people who want a capable, good-value paid password manager.
Bitwarden publishes more independent security work than any other product here. Its 2025 list includes Cure53 assessments of its browser extension, desktop app, web vault and core code, a cryptography review by the Applied Cryptography Group at ETH Zurich, a mobile app assessment by Unit 42 and a network test by Fracture Labs. The reports are public, and Bitwarden also states SOC 2 Type 2 and ISO 27001 certification.
It ranks below 1Password and NordPass because fewer experts put it near the top. Experts mostly praise its free plan. Tom's Guide ranks it second and Zapier second, and both name it the best free option, as do TechRadar and PCWorld.
"Bitwarden is the best free password manager." (Zapier)
Privacy Guides, a non-commercial site, recommends it: "Bitwarden is among the best and safest solutions to store all of your logins and passwords" (Privacy Guides).
Where opinions differ: the comparison sites rate it lower: Cybernews ranks it seventh, All About Cookies ninth, and Security.org leaves it out of its ranked list. Tom's Guide notes: "The main caveat is that Bitwarden isn’t as seamless as some competitors." (Tom's Guide)
Who it suits: anyone who wants a well-audited password manager without paying, and doesn't mind a plainer app.
4. Keeper: security-minded, consistently top three
★★★★½Consensus score: 8.9
Keeper is third at TechRadar, Tom's Guide and PCWorld, and second at Cybernews. Tom's Guide names it best for security, and PCWorld calls it its most security-minded pick.
"Its emphasis on security beyond that of other password managers make it a good choice for uber-vigilant users." (PCWorld)
Keeper lists the most certifications here, including SOC 2 Type 2, ISO 27001 and US government FedRAMP High authorisation, and says firms such as NCC Group test it every quarter. It doesn't publish dated reports of those tests, so its score is based on the expert reviews alone.
Who it suits: people who want strong security features, such as offline access, and don't mind paying.
Proton Pass had the most recent independent audit in this guide. Recurity Labs tested its browser extensions, mobile and desktop apps and command-line tool between January and April 2026, and Proton published the report in May 2026. Proton says the auditor rated its overall security "well above par" and that the desktop issues found were fixed on retest.
Seven of eight expert sources list it, mostly in the middle: third at Zapier, fourth to sixth at the comparison sites, fifth at Tom's Guide. Tom's Guide, TechRadar and All About Cookies all name it best for privacy.
"Proton Pass is the go-to choice for privacy-focused users" (Tom's Guide)
Where opinions differ: TechRadar ranks it seventh of ten, and PCWorld leaves it out.
Who it suits: people who put privacy first, or who already use other Proton services.
6. RoboForm: favoured by comparison sites, missing elsewhere
★★★☆☆Consensus score: 6.4
Security.org ranks RoboForm first, and TechRadar and All About Cookies second. Cybernews calls it one of the most budget-friendly options.
"RoboForm works great on mobile (both Android and iPhone), and the free version includes cloud syncing" (TechRadar)
Its last independent audit, by Secfault Security, was in early 2025, just outside our 18-month window, and RoboForm doesn't mention SOC 2 certification.
Where opinions differ: Tom's Guide, PCWorld, Zapier and Privacy Guides don't list it at all. That is the biggest split in this guide.
Who it suits: people who fill in a lot of online forms and want a low-cost option.
PCWorld ranks Dashlane first, and TechRadar names it best for security.
"Dashlane's password manager is one of the best on the market and has some top features for the security-conscious." (TechRadar)
Dashlane holds ISO 27001 and SOC 2 Type II certification and has an external penetration test at least once a year, according to its UK government G-Cloud listing; the testing firm isn't named. From 31 May 2026 an attacker got round two-factor checks on some accounts and downloaded the encrypted vaults of fewer than 20 personal-plan users. Dashlane says the vaults can't be opened without each user's master password and found no evidence its internal systems were affected (Dashlane).
Where opinions differ: the comparison sites place it sixth to eighth.
Who it suits: families (Security.org and All About Cookies name it best for families) and people who want dark web alerts built in.
LastPass isn't in any expert list we read from the last 18 months. In August 2022 attackers stole a backup of its customer vault data; passwords and notes were encrypted, but website addresses were not. In December 2025 the UK Information Commissioner's Office fined LastPass £1.2 million over the breach, which affected up to 1.6 million UK users (The Register).
Apple Passwords is recommended by Zapier and All About Cookies for Apple users, but we need a product in at least three expert lists to rank it.
LogMeOnce, Aura, KeePass, mSecure, Passwarden, Total Password and Bitdefender SecurePass each appear in only one or two expert lists.
How we score
We don't run our own tests. No independent lab tests password managers side by side, so each product's consensus score combines:
Security audits (30%, where known): what each company has published in the last 18 months, scored out of 100. A named, dated independent audit of the apps is worth the most (50 points), with more if its report is public (20) or there is a second recent audit (15). A company that says it is independently tested but publishes no named, dated report gets 20 instead. Current SOC 2 Type 2 or ISO 27001 certification adds 15. An incident in which attackers obtained customer vault data takes off 15. Audits published with a year but no month count as mid-year. If a company says it is independently audited but we couldn't confirm a named, dated report, we don't score it as zero: we leave audits out of its score and base it on expert rankings (71%) and breadth (29%). This applies to 1Password, NordPass and Keeper.
Expert rankings (50%): each product's position in 7 expert "best password manager" lists, from TechRadar, Tom's Guide, PCWorld, Zapier, Cybernews, Security.org and All About Cookies.
Breadth of agreement (20%): how many of 8 expert sources include the product. This adds Privacy Guides, which recommends products without ranking them.
Audits get less weight than lab tests do in our antivirus guide, because the companies commission them themselves and publish them unevenly. No score can be higher than 9.9. To be ranked, a product needs a place in at least three of the ranked expert lists. We leave out evidence older than 18 months; for example, Expert Reviews' password manager guide dates from 2023, so it isn't counted. Affiliate commission plays no part in the score.
Evidence last checked: 16 October 2026. Full details on how we review.