Passbolt is an open source credential platform for teams, with the vault running on your own server or inside the firewall. A browser extension, mobile apps and a command line tool share one encrypted set of data, sharing uses OpenPGP public keys, and private keys stay on the client.

Microsoft's own authenticator app for phones, handling second-factor checks and passwordless sign-in, with a built-in one-time passcode generator that also works offline, and room for accounts from Microsoft and from other providers alike.

A mobile password manager that hands encrypted storage to the phone s dedicated security chip and never reaches the network while running. The free edition holds 20 accounts across 17 templates, and forgetting the master password can be resolved with help from friends rather than a server.

A password and passkey manager built on zero knowledge encryption: scrambling and unscrambling happen on the local device and the service stores only ciphertext. Extensions and native desktop and mobile clients all open the same vault, while the free tier caps at ten records and one mobile device.

A multi-platform security subscription for personal use that puts virus, malware and ransomware protection in the same licence as system performance tools, covering five desktop and mobile systems. A 30-day trial has replaced the old long-running free edition.

One encrypted file on your own disk, no cloud sync, no telemetry, no account: a password vault whose trust model is a file and a master password, nothing else.

Emptying the recycle bin leaves the data where it was. This old utility overwrites it, handles free space and whole disks, and puts a confirmation step in front of an operation you cannot undo.

The idea that made it popular is still the idea worth having: tokens encrypted and synced, so a new phone gets forty accounts back instead of forty support tickets. The desktop app is gone, the mobile one works.

Every signup form asking for your real address is a small wager on somebody else data handling. SimpleLogin hands out a separate forwarding address per site, passes the mail to your real inbox, and lets you switch off whichever alias starts receiving nonsense.

Google Authenticator is the most classic of the two-factor tools: a minimal interface that produces a rolling code, support on most major sites, cloud sync so a new phone does not lose the keys, and no cost and no distractions. The simplest first step into better account security.

WARP encrypts everything from the device to the nearest edge node over WireGuard, sends lookups through an encrypted resolver, needs no account and has no traffic limit. Free on every platform, with post quantum crypto added in 2026.

Enpass has no server holding your vault: the encrypted file stays on your devices, syncs through a cloud account you already own, and unlocks with a key that never leaves your head.

Cryptomator is an open-source tool that encrypts files in a local vault with AES-256 before they sync, so a cloud provider only ever stores unreadable data.

NordPass keeps passwords, passkeys, cards and secure notes in a vault encrypted with XChaCha20 under a zero-knowledge design, and the free tier sets no limit on how many items you store.

A two-factor app with no account to create: approve the login on your phone and the code lands in the browser by itself, keys stay local by default, and an encrypted export is there before you need it.