Why the vault has to live on somebody else server

Mainstream password managers follow one pattern with little variation: hand over every password, receive an encrypted vault stored on the vendor servers, pay a subscription for the privilege. It works. It also carries a psychological threshold that no marketing can remove, because the leaks in this industry keep proving that a provider saying it is secure and a provider that cannot be breached are two different claims.

Enpass removes the question by removing the server. There is no central store of user vaults, the vault file lives on the devices it belongs to, and the vendor has nothing to leak even if it wanted to. For anyone who has watched a breach notice arrive in their inbox, that architectural difference is worth more than a comparison table.

Sync through storage you already pay for

Without a central server, the obvious question is how several devices stay in step. The answer is borrowing: point Enpass at a cloud account you already own, whether that is iCloud, Google Drive, OneDrive, Dropbox, Box, Nextcloud or any WebDAV service, and the vault file travels between them. Everything is encrypted with AES-256 under a zero knowledge design, so the password is known only to its owner and neither the storage provider nor the vendor can read the contents. Inside a local network, a direct Wi-Fi sync bypasses the cloud entirely.

The free tier changed in 2026-09 and is worth stating precisely: a single vault and 25 active items across every platform, with anything beyond that read only. That is enough to test the water honestly. For daily use there is a subscription, or a one-time lifetime licence, which is rare in this category and means paying once for the tool rather than renting it.

What it does, and what it costs

The expected features are all present: a password generator and audit, passkey support, browser extension autofill, and wallet style cards for bank cards and documents. The Windows build reached 6.12.6 this month with a batch of sync and interface fixes, which is the sort of maintenance that matters more than a feature announcement in software people trust with their accounts.

The costs belong in the same paragraph. Compared with products that sync automatically, the first setup asks the user to choose a storage location, which takes ten minutes and a decision. And because of the zero knowledge design, a forgotten master password has no recovery route; whatever fallback exists, such as a key file, has to be arranged in advance. Both are the same coin, seen from the other side.

That is the trade being offered, and it is not for everyone. A person who wants to forget the vault exists should choose a hosted service. A person who wants the risk of a provider breach removed from the architecture, and is willing to spend ten minutes configuring, gets exactly that.

There is a further argument for the architecture that shows up after a year of use. A hosted vault is a subscription with a switching cost: leaving means exporting everything, trusting the export, and rebuilding habits elsewhere. A vault file plus a chosen storage location is portable by definition, and even the choice of vendor stops being permanent, because the file belongs to the person rather than to the account.

Enpass sells sovereignty rather than convenience: the vault on your device, the sync through your storage, the key in your head. A whole class of risk disappears at the design stage rather than being managed afterwards.