KeePass keeps every account inside a single encrypted database and asks you to remember one master key. Version 2.61.1 arrived on 1 May 2026 with a list of fixes, and Auto-Type fills forms by simulating keystrokes.

KeePassXC 2.7.12 is free and open source on Windows, macOS and Linux, storing every account in one local encrypted file with a browser extension for autofill and a generator built in. Data never sits on a vendor server, and no subscription is charged.

Passbolt is an open source credential platform for teams, with the vault running on your own server or inside the firewall. A browser extension, mobile apps and a command line tool share one encrypted set of data, sharing uses OpenPGP public keys, and private keys stay on the client.

One encrypted file on your own disk, no cloud sync, no telemetry, no account: a password vault whose trust model is a file and a master password, nothing else.

No rule list to update, no settings to tune: the extension watches which third party domains follow you across sites, and blocks the ones whose behaviour gives them away.

Most blockers slow the browser down as lists grow. This one was built by a single maintainer to use less memory the more it blocks, and it has stayed at the top of the category for ten years.

Every signup form asking for your real address is a small wager on somebody else data handling. SimpleLogin hands out a separate forwarding address per site, passes the mail to your real inbox, and lets you switch off whichever alias starts receiving nonsense.

Pi-hole is the classic open source answer to network level filtering: it stands in front of a whole local network as a DNS server, so devices need no plugin of their own to have tracking and advertising requests dropped, it runs on a Raspberry Pi, and the self hosting community around it is mature.

Portmaster is an open source application firewall from Safing that shows every outbound connection in real time and lets you allow or block it in one click, with encrypted DNS and built in filter lists under the GPLv3.

CryFS is an open source encrypted filesystem for cloud folders: it splits files into encrypted blocks, scrambles names and directory structure, and gives you a normal mounted folder on the desktop while the cloud only ever stores unreadable chunks.

Cryptomator is an open-source tool that encrypts files in a local vault with AES-256 before they sync, so a cloud provider only ever stores unreadable data.

Eraser overwrites the sectors behind a deleted file on Windows so routine recovery fails, and it also cleans the free space left over from earlier deletions.

A two-factor app with no account to create: approve the login on your phone and the code lands in the browser by itself, keys stay local by default, and an encrypted export is there before you need it.

Almost every password manager is a commercial service with the passwords on somebody else's machine, and asking to run the server yourself usually gets nowhere. This one, published under the AGPL, keeps both roads open: the official cloud is free for one person, or the whole thing can be deployed on your own hardware so that the data really stays with you. Client and server code are both public, and every platform behaves the same.

Emptying the bin only takes the entry out of the index; the bytes stay on the disk. This free open source program for macOS writes over them again and again until nothing is left to recover, offers a faster three pass standard when thirty-five is more patience than the job deserves, and lets the algorithm, the sound and the icon be changed. It is at its most dependable on a mechanical disk, and it says so.