A password manager generates, stores and retrieves credentials so that people and systems don't have to remember or reuse passwords manually. It supports several controls at once: Authentication information (secure issuance and storage of authentication information), (unique, generated passwords reduce reliance on password strength alone, usually combined with MFA), and, for products that also vault administrator or service-account credentials, . The vault's own encryption at rest also relates to Use of cryptography.
When and why do I need this?
This is one of our TOP recommendations as it comes with a big positive impact for basically everybody at very affordable cost.
While passwords are probably one of the worst authentication options available, it is also the most wide-spread and where a password manager can hugely improve your risk situation on short notice. Better solutions like 2FA, single sign-on, passkeys etc. are in fact good and should be used on top. But as you will find out, these might often come at high costs as often, software vendors require some kind of upgrade or enterprise subscription to activate these. And as more and more applications are cloud-based and often only used by a small subset of employees, the number of accounts and passwords is rising despite any single sign-on initiatives that might already run.
Thus, most organisations are unable to implement better authentication solutions for all applications and services. We consider having a good password manager for all users as a cornerstone in any security concept.
TLDR
Our recommendations for everyone in a rush
There are many good tools around, that absolutely do work well. But if you don’t want to search and compare for hours, we have a few suggestions where to start. These recommendations are written especially with Swiss customers in mind.
In general, pick a cloud solution. It is likely the more secure option compared to on premise installation of software in most settings.
For private individuals, an OS built-in option like Apple Keychain in iOS and MacOS are perfectly good solutions. You might also want to look at the free plan of Proton Pass, by Swiss-based Proton AG.
For businesses, usually additional requirements are needed. Common are password and secrets sharing for service accounts, central administration or password quality controls. We like LastPass ourselves. If you like it Swiss, Proton Pass Business might be another option, though it may have less features.
Disclaimer: we are authorized LastPass resellers. We have no affiliation with Proton or Apple.
Categories
Products on the market fall into three broad categories, distinguished mainly by hosting model and target use case. The list is obviously not complete. If you think, we need to mention an important tool, Contact us.
Personal and team vaults (cloud-hosted)
General-purpose vaults for individuals, families and teams, syncing across devices via the vendor's cloud. Most offer a business tier with centrally enforced policies (MFA, master-password rules) and admin reporting.
Bitwarden — open-source client code; free tier; business tier adds SSO/SCIM and an optional secrets-manager module for engineering teams.
1Password — closed-source; business tier includes centrally enforced sign-in policies, firewall rules and sign-in-attempt review.
LastPass — business-focused vault with centrally managed policies, SSO/SCIM provisioning, and dark-web monitoring; linkyard is an authorized reseller.
Keeper — positioned for regulated industries; includes breach monitoring and compliance certifications; sells a separate PAM/secrets product line.
Dashlane — bundles a VPN and dark-web monitoring alongside the vault.
NordPass — part of the Nord product family; integrates with Nord's VPN.
Proton Pass — part of the Proton privacy suite; includes email-alias generation.
Self-hosted and open-source
Relevant where data residency, sovereignty requirements, or contractual terms with a client rule out a vendor-hosted cloud vault.
Vaultwarden — community-built server implementation compatible with the Bitwarden client/protocol, run on infrastructure the organization controls.
KeePass / KeePassXC — local encrypted database file with no built-in cloud sync; syncing, if wanted, is left to the user's own file-sync mechanism.
Passwork — commercial, available self-hosted or cloud-hosted; developed in the EU and positioned around GDPR/NIS2 compliance.
Privileged access / secrets management
Aimed at administrator, service-account and infrastructure credentials rather than end-user logins, typically combined with just-in-time access, session recording and automated credential rotation.
CyberArk — established enterprise PAM platform.
HashiCorp Vault — secrets management with dynamic, short-lived credentials; common in engineering and infrastructure contexts.
Keeper Secrets Manager — Keeper's PAM/secrets product, separate from its end-user vault.
ManageEngine Password Manager Pro — privileged credential vaulting with session management; priced per administrator rather than per end user.
Selection criteria
Independent of vendor, check the following against your own requirements before choosing a product:
Encryption architecture — whether the vendor uses a zero-knowledge model (data encrypted client-side; the vendor cannot read vault contents) or server-side encryption.
Hosting and data residency — cloud-only vs. self-hosted, and the legal location of the vendor's cloud infrastructure.
Enforcement capabilities — whether admins can enforce MFA, master-password policies and access rules organization-wide, not just recommend them.
Directory/SSO integration — SCIM provisioning and SSO login, so account lifecycle stays tied to the organization's identity provider rather than a separate credential.
Secrets/API access — whether the product exposes secrets to automation (CI/CD, scripts), not only to a human via browser extension.
Auditability — admin activity logs, and, for open-source products, whether the client code is publicly auditable.
Passkey/FIDO2 support — relevant given the gradual shift away from passwords as the primary authentication factor.
Licensing model — per-user, flat-fee or per-administrator pricing, which changes cost behaviour at different organization sizes.
Sources:
Vendor documentation and market comparisons, as of September 2026 — feature sets and pricing change frequently; verify current details before selecting a product.
Frequently asked questions
Is it secure to store passwords in a cloud solution, or should we host on-premises?
Short answer: a reputable cloud-hosted vault is not inherently less secure than a self-hosted one — properly implemented, both can protect passwords adequately. The two approaches trade off different risks, and the right choice depends on what you're protecting against and how much operational effort you're able to put into running your own infrastructure.
Arguments for a cloud-hosted vault
Zero-knowledge architecture: with a properly implemented vendor, vault contents are encrypted client-side before they ever reach the vendor's servers, and the encryption key is derived from your master password, which the vendor never receives or stores. A breach of the vendor's infrastructure does not by itself expose readable vault contents.
Specialized vendors typically run more mature patching, monitoring and incident-response practices for this one product than most organizations can maintain for an internally-run tool that isn't their core business.
No infrastructure to operate yourself: no server patching, backup-integrity checks, TLS certificate renewal or high-availability setup to get wrong — each of those is itself a place where mistakes introduce risk.
Cross-device sync, mobile apps and browser integration work without extra setup.
BCM: if your organisation is struck by a disaster, be it flooding, fire or a successful ransomware attack, you likely will at least still have access to your passwords and secrets as they are stored in the cloud. Without access to these, recovery might become much more challenging.
Arguments for self-hosting
Full control over where the data physically resides and who can access the underlying infrastructure — relevant if a client contract, sovereignty requirement, or your own risk model specifically calls for keeping this class of data off third-party infrastructure.
No dependency on the vendor's continued existence, pricing changes, or an extended vendor-side outage locking you out of your own vault.
Removes you from the pool of high-value, at-scale targets that large commercial vault providers represent, since attackers who breach a big provider can go after many customers' vaults at once.
The trade-off: you take on the operational security work yourself. A self-hosted instance that is patched late, backed up carelessly, or left with weak access control to the host can end up less secure than a well-run commercial vault — self-hosting shifts risk, it doesn't eliminate it.
Illustrative case: LastPass disclosed in 2022 that attackers had copied a backup containing customers' encrypted vault data, alongside some unencrypted metadata such as website URLs. Because vault contents were encrypted client-side, exploitation depended on cracking each user's master password offline; researchers later linked successful cracks to victims who generally had weak or reused master passwords, and the case led to a regulatory fine and a 24.5 million dollar class-action settlement in 2025. The incident illustrates both sides of the argument: the encryption held up against direct data exposure, but being a large, centralized target created downstream risk that a smaller or self-hosted deployment would not face in the same way.
In practice, most organizations without a specific data-residency or contractual requirement are well served by a reputable cloud vault with a verifiable zero-knowledge architecture (see Selection criteria above), combined with a strong, unique master password and MFA on the vault account itself. Self-hosting is worth the added operational burden mainly when there's a concrete reason to avoid vendor-side data aggregation, or when the organization already has the infrastructure and staff capacity to run it at least as securely as a specialized vendor would.