The best Enpass alternatives, compared honestly
Enpass sells one promise and it is a real one: your vault is an encrypted file in storage you already own, and the company never holds it. Nobody leaves because that promise is false. They leave at its edges. For a team, "storage you already own" means Microsoft 365 or Google Workspace and nothing else, which makes the paid Business plan strictly narrower than the free personal app that syncs to seven clouds, WebDAV or a folder on disk. And "Enpass stores nothing" is true of vault contents, not of you: Enpass Hub still holds names, device identifiers, IP addresses and the path to each vault inside your business cloud. This page compares the seven credible alternatives on those two axes, plus the licence of whatever you would end up running yourself.
The best Enpass alternative depends on which edge you hit:
- You run neither Microsoft 365 nor Google Workspace → Bitwarden: Teams at $4 per user per month annually, cloud or your own server, no tenant requirement anywhere.
- You want zero licence cost and own the box → Vaultwarden: AGPL-3.0, organizations, policies, event logs and OIDC free, though there is no SCIM.
- You only ever wanted the encrypted file → KeePassXC: a GPL-licensed
.kdbxyou sync however you like, including the backends Enpass Business will not accept. - You are under ten people and need SSO and audit logs → Psono: On-Premise Enterprise is EUR 0 up to 10 users with the complete feature set, on an Apache-2.0 server.
Why teams look elsewhere
What pushes teams off Enpass
Enpass did not get worse at storing passwords. Its cryptography is AES-256 with 320,000 rounds of PBKDF2-HMAC-SHA512 on SQLCipher, it publishes ISO/IEC 27001:2022, ISO/IEC 27701 and SOC 2 Type II across all five Trust Services Criteria, and the Business plan is one of the cheapest published prices in the category. Four specific things send people looking anyway, and each one is a boundary of the product rather than a defect in it.
The team plan supports two clouds
Enpass Business stores vaults in Microsoft 365 or Google Workspace, and the help centre has exactly those two variants. The free personal app supports Dropbox, Google Drive, OneDrive, iCloud, Box, WebDAV and Nextcloud, plus Wi-Fi and Folder Sync. Paying makes your storage options narrower, not wider.
The restriction is enforced, not advised
Enpass documents the failure mode itself: "Activation error: First vault must be on organization's Cloud", explained as the organization requiring your first vault to sit on business OneDrive. The documented fix is to erase everything and start again from the Business tab. There is no supported way to point a business vault at Nextcloud or a NAS.
Enpass Hub still holds metadata
Hub runs on Enpass infrastructure and stores name and email, device name, identifier, OS, language, country and IP address, the vault name, the path to each vault in your business cloud, encrypted vault and recovery keys, and an event log with IPs. It cannot decrypt anything. It is still a record of who opened what, from where, and when.
Audited is not the same as auditable
The storage engine, SQLCipher, is open source and peer reviewed, and Enpass states it writes no proprietary cryptography. The clients and Hub are closed. Even the self-hosted Hub, which Enpass offers on Enterprise plans rather than the $1.99 Business tier, ships as a closed image, public.ecr.aws/enpass/hub-server:latest, from a sample repo with no licence file whose last push was 2023-12-05.
Free stops at 25 items on the phone
The free tier is generous on desktop, with unlimited items and vaults on Windows, macOS and Linux, but mobile has been capped at 25 items since Enpass introduced subscriptions in its announcement of 2019-11-19. For anyone whose password manager lives on a phone, free is an evaluation, not a plan.
The shortlist
7 Enpass alternatives worth evaluating
Password managers split into two jobs that get confused constantly: keeping one person's secrets on their own devices, and giving an organization shared vaults with provisioning, recovery and an audit trail. Enpass is unusual in that its free personal product is more flexible than its paid team one, so the right replacement depends on which job you were actually buying. This ranking optimises for the team job first, since that is where Enpass hits its ceiling, and it names the storage each tool allows and the licence you would inherit. Every pick lists one honest strength and one real weakness.
Teams is $4 per user per month billed annually with event logs, SCIM and Directory Connector already included; Enterprise at $6 adds SAML and OIDC single sign-on. The server is AGPL-3.0 apart from a proprietary bitwarden_license directory, so the same product runs in Bitwarden's cloud or on your hardware, and nothing anywhere requires you to own a Microsoft 365 or Google Workspace tenant. The Enpass json export is a listed importer, so the move is an afternoon. Weakness: single sign-on sits in the $6 tier rather than the $4 one, and Bitwarden's own licensing page states that self-hosting is free while some features must be unlocked with a registered licence file, so "self-hosted" and "free of the vendor" are not the same thing.
An AGPL-3.0 reimplementation of the Bitwarden server that speaks to the official Bitwarden clients, at v1.37.2 on 2026-08-22 with 66,655 stars and a push on 2026-08-29. Organizations, collections, groups, policies, event logs, admin password reset, Directory Connector and OIDC single sign-on are all there, unlimited and unpaywalled, on anything that runs a container. Weakness: it is explicitly not associated with Bitwarden, Inc., there is no SCIM, its own documentation notes that "a master password will still be required and not controlled by the SSO", and you carry every upgrade, backup and outage yourself.
A local .kdbx database and nothing else, licensed GPL-2.0 or GPL-3.0 at your option, at v2.7.12 since 2026-03-10 with 28,645 stars and a push on 2026-09-01. If what you liked about Enpass was owning the file, this is the purest version of that: sync it through every backend Enpass personal supports and the several its Business plan refuses, with no vendor holding metadata because there is no vendor. Weakness: no admin console, no SCIM, no audit log, no managed recovery, and sharing means KeeShare, which is a file-swapping convention rather than a team feature.
The On-Premise Enterprise edition is EUR 0 for up to 10 users with the complete feature set: LDAP, SAML and OIDC single sign-on, audit logging, policies and the SSH, RDP and VNC gateway. The server is Apache License 2.0 and runs wherever you put it, so a small team gets everything Enpass Business gates behind a tenant, for nothing. Weakness: the step off free is steep, since paid is EUR 2 per user per month billed annually with a 25-seat minimum, and the ecosystem around it is small.
Community Edition is free for unlimited users under AGPL-3.0, and Pro is $4.9 USD per user per month billed annually for LDAP provisioning, single sign-on with Microsoft, Google, OpenID and AD FS, SCIM, the activity log, account recovery and a VM appliance. The unusual part is stated on the pricing page itself: "Passbolt pro is distributed under AGPL V3", so the subscription buys support and updates rather than code access. Weakness: the security features are Pro and Pro carries a 10-seat floor, so a four-person team pays for ten.
The exact opposite trade to Enpass: you do not choose where the vault sits, you choose whose law covers it, which is Swiss. Essentials is $1.99 per user per month billed yearly with a three-user minimum, and Professional is $4.49 with single sign-on, SCIM, detailed activity logs, enterprise policies, a CLI and an SSH agent. Weakness: Essentials has no SSO, no SCIM and no logs at all, so the real comparison price is $4.49, and there is no self-hosting at any tier.
Included as the honest opposite pole rather than as a value pick. The clients are the best-regarded in the category and the sharing model is genuinely well designed, but everything lives in the vendor's cloud. Business is $8.99 per user per month billed annually and is the cheapest tier that turns on SSO, SCIM and SIEM streaming; the Teams Starter Pack is $24.95 a month for ten members annually and has none of the three; Enterprise carries no published price. Weakness: it is four and a half times the price of Enpass Business for the features Enpass includes at $1.99, and there is no self-hosted edition at any tier.
Deliberately left off: Keeper and Dashlane, both competent, but neither offers a self-hosted vault backend, which is the question that brings people to this page; Keeper does self-host its Connection Manager, which is a different product, and Dashlane stopped offering self-hosted SSO and SCIM setup after October 2025; and browser-built-in managers, which have no shared vaults, no provisioning and no audit trail.
Side by side
Enpass alternatives compared
Prices as of September 2026, from each vendor's own pricing page. The column that decides most migrations is the third one: where a team's vault is allowed to physically live. Enpass is the only tool here that answers it with the name of someone else's SaaS tenant, and that single constraint is what makes an otherwise cheap, complete plan unusable for a company that runs neither. Enpass's own row is included as the baseline.
| Password manager | Type | Where a team vault can live | Cheapest plan with SSO | Free tier | Self-host / licence |
|---|---|---|---|---|---|
| Enpass | Proprietary app, your storage | Microsoft 365 or Google Workspace only | $1.99/user/mo yearly (only tier) | Desktop unlimited, mobile 25 items | ✗ proprietary; Hub image closed |
| Bitwarden | Cloud or self-hosted | Bitwarden cloud or any server you run | $6/user/mo yearly (Enterprise) | Free org, 2 users, 2 collections | ✓ AGPL-3.0, plus Bitwarden Licence v1.0 over one directory |
| Vaultwarden | Self-hosted only | Anywhere a container runs | Free (OIDC; no SCIM) | Everything, unlimited | ✓ AGPL-3.0, nothing gated |
| KeePassXC | Local file, no server | Any storage you can put a file on | Not applicable, no accounts | Everything, unlimited | ✓ GPL-2.0 or GPL-3.0 |
| Psono | Cloud or self-hosted | Your own infrastructure | EUR 0 up to 10 users, then EUR 2/user/mo | Enterprise on-premise, 10 users, full features | ✓ Apache-2.0 |
| Passbolt | Cloud or self-hosted | Your own infrastructure | $4.9/user/mo yearly, 10-seat minimum | Community Edition, unlimited users | ✓ AGPL-3.0, Pro included |
| Proton Pass | Vendor cloud, Swiss | Proton data centres in Switzerland | $4.49/user/mo yearly (Professional) | Personal free tier only | ✗ no self-hosting |
| 1Password | Vendor cloud | 1Password cloud only | $8.99 USD/user/mo yearly (Business) | Trial only | ✗ proprietary, no self-host tier |
Numbers that do not fit in cells: Enpass personal is $1.99 per month billed yearly for Individual and $3.99 for Family up to six, with one-time licences at $49.99 for three years and $99.99 for life. Psono's paid tier carries a 25-seat minimum. 1Password's Teams Starter Pack is $24.95 per month for ten members billed annually, with no SSO, SCIM or advanced logs. Pricing and free tiers change often; check each vendor for current terms. Compiled September 2026.
Official pages: Enpass · Bitwarden · Vaultwarden · KeePassXC · Psono · Passbolt · Proton Pass · 1Password · Enpass Hub documentation
A fair call
When Enpass is still the right choice
Most people who land on this page should stay where they are. Migrating a password manager is not a data export, it is re-enrolling every phone and browser in the company, rebuilding share groups by hand, and running two managers in parallel for a billing cycle while people forget which one has the wifi password. That cost is only worth paying if you have actually hit one of the two edges above, and the tenant requirement in particular flips from constraint to feature depending on a fact about your company that has nothing to do with passwords.
Enpass is still right if…
- You already run Microsoft 365 or Google Workspace. The restriction that pushes other teams away is the reason to stay: the vault inherits the conditional access, device trust and MFA you already enforce, and there is one fewer identity surface to secure.
- Price matters and you want nothing gated. At $1.99 per user per month billed yearly with SSO, SCIM, audit logs, SIEM and policy enforcement all in the only tier, it is under a quarter of 1Password Business and cheaper than Bitwarden Teams, which does not even include SSO.
- You want to own the file, personally. The $99.99 Lifetime licence is one of the last perpetual licences left in this category, and the free desktop app has no item limit at all.
- Compliance asks for certificates rather than source. ISO/IEC 27001:2022, ISO/IEC 27701, SOC 2 Type II across all five criteria, GDPR and TISAX are already in hand, which is more paperwork than most open-source options can produce.
Look elsewhere if…
- You run neither Microsoft 365 nor Google Workspace: Bitwarden gives you the same feature set with the vault wherever you want it.
- You want the vault on your own hardware at no licence cost: Vaultwarden, accepting that you become the operator and that SCIM is missing.
- Your team is under ten and you still need SSO and an audit log: Psono On-Premise Enterprise is EUR 0 for exactly that shape.
- You need the client itself to be auditable, not just the storage engine: KeePassXC for one person, Passbolt for a team, both fully licensed under GPL or AGPL.
- Your concern is jurisdiction rather than storage: Proton Pass Professional keeps everything in Switzerland, with SSO and logs included.
Common questions
Common questions about Enpass alternatives
What is the best Enpass alternative in 2026?
For most teams it is Bitwarden. Teams costs $4 per user per month billed annually and already carries SCIM, Directory Connector and event logs; Enterprise at $6 adds SAML and OIDC single sign-on. The server is AGPL-3.0, so the vault can live in Bitwarden's cloud or on hardware you run, with no requirement to own a Microsoft 365 or Google Workspace tenant, and the importer reads the Enpass json export directly. If you want zero licence cost and can carry the operations yourself, Vaultwarden is the same client experience on your own server. If you only ever wanted a personal encrypted file, KeePassXC is closer to what Enpass actually is.
Why do teams leave Enpass?
Almost never because the vault model failed. The usual trigger is discovering that the Business plan stores vaults in Microsoft 365 or Google Workspace and nowhere else, while the free personal app syncs to Dropbox, Google Drive, OneDrive, iCloud, Box, WebDAV, Nextcloud, a Wi-Fi link or a plain folder. Teams that run neither tenant have no supported path. The constraint is enforced in the product: activation fails with the message that the first vault must be on the organization's cloud. The second trigger is auditability, since the app itself is proprietary even though the storage engine is not.
How much does Enpass cost in 2026?
The Business plan is $1.99 per user per month billed yearly, and it is the only business tier: single sign-on, SCIM provisioning, event and audit logs, the security audit dashboard, SIEM integration, UEM and MDM configuration and policy enforcement are all included at that price, with a 30-day trial and no card required. Above it Enpass lists only Contact Sales for large enterprises. On the personal side, Individual is $1.99 per month billed yearly, Family for up to six is $3.99 per month billed yearly, and there are one-time licences at $49.99 for three years and $99.99 for life.
Does Enpass really store nothing about me?
It stores no vault contents, and that part of the claim holds: vault keys are RSA-3072 encrypted on the client and Enpass never receives your Microsoft 365 or Google Workspace access tokens. Enpass Hub, the server component that makes sharing, recovery, the audit dashboard and event logs work, does run on Enpass infrastructure and does hold data about you: name and email, device name and identifier, operating system, language, country and IP address, the vault name, the path to that vault inside your business cloud, encrypted vault and recovery keys, and an event log carrying timestamps, actors and IP addresses. None of it decrypts a vault. All of it is custody of a different kind.
Can Enpass Hub be self-hosted?
Yes, but not on the plan this page prices: Enpass states that self-hosting the Hub is available on Enterprise plans, not on the $1.99 Business tier. Where it is available, Enpass documents it as a standard Docker deployment with guides for a standalone Linux host and for Azure App Services. It is worth knowing what that means in practice. The sample repository, enpass-inc/hub-server, is described as example configurations for Hub deployment, carries no licence file, and was last pushed on 2023-12-05; its compose file pulls the closed image public.ecr.aws/enpass/hub-server:latest alongside Postgres, nginx and Redis. Self-hosting Enpass Hub therefore means running someone else's binary on your hardware, which is a genuine data-residency win and not the same thing as running open-source code.
Is there a truly open-source Enpass alternative?
Several, and the licences are worth naming precisely because source-available is not the same as open source. Bitwarden's server is AGPL-3.0 by default, but its own LICENSE.txt carves out a second, proprietary Bitwarden License v1.0 covering everything in the bitwarden_license directory, which is why GitHub reports the repository licence as NOASSERTION. Separately, its licensing page states that self-hosting is free while some features must be unlocked with a registered licence file. Vaultwarden is AGPL-3.0 with nothing gated. Passbolt Community Edition and Passbolt Pro are both distributed under AGPL V3, so the subscription buys support and updates rather than code access. Psono's server is Apache License 2.0. KeePassXC is GPL-2.0 or GPL-3.0 at your option. Enpass itself is proprietary, on top of the open-source SQLCipher engine.
How do I migrate off Enpass without losing anything?
The records move easily, but only in one format: Enpass exports .json, and its own help article names no other. Bitwarden and Vaultwarden read that file directly, and so do Proton Pass and Psono, which both document the Enpass import as .json specifically. KeePassXC has no Enpass importer at all, so that one route needs a conversion to CSV first. What does not move is everything around the records: share groups, recovery configuration, identity provider mapping and any policy pushed through UEM or MDM. Plan for one billing cycle of overlap, rebuild the vault and group structure by hand, re-enrol every browser extension and phone, and then delete the plaintext export file, which is the single most dangerous artefact of any password manager migration.