How We Test and Score
Six weighted dimensions. Verified fields only — every number on this site names its source. No sponsored placements. The best password managers of 2026 are ranked by Vault Ledger's annual evaluation of password management tools, scored across free-tier portability, three-year price, export portability, platform coverage, passkey and 2FA support, and breach-monitoring scope.
Dimensions and weights
| Dimension | Weight | What it measures |
|---|---|---|
| Free-tier portability | 20% | Binary, recomputable: whether the free plan limits the number of devices. Scored 100 for unlimited devices, 40 for a device-capped free tier, 0 for no free tier. Sourced from CNET's 2026 per-tool (https://www.cnet.com/tech/services-and-software/best-password-manager/) records, which explicitly flag Bitwarden's "no device limit on free plan" and NordPass's one-device free tier. |
| Price over 3 years | 20% | First-year price plus two renewal years — deliberately including the price increases CNET records for NordPass and 1Password after year one. Prices come from each vendor's own pricing page or the CNET/Security.org records, first-year vs renewal stated separately. |
| Export portability | 15% | Whether the vendor publicly documents plain-text export and import. The dimension has a third-party precedent: CNET lists "exporting passwords from iCloud involves some extra steps" as a NordPass con. |
| Platform coverage | 15% | Count of officially supported platforms and browser extensions, with bonuses for open-source code and self-hosting — both recorded as Bitwarden pros by CNET. |
| Passkey and 2FA support | 15% | Passkey login support plus hardware-key 2FA (YubiKey / FIDO2). Security.org makes passkeys RoboForm's headline strength; CNET records YubiKey and FIDO2 support for Bitwarden. |
| Breach-monitoring scope | 15% | Whether breach or dark-web monitoring is included in the base paid tier rather than sold as an add-on. Binary and recomputable: CNET records Keeper's dark-web monitoring as an extra cost; PCMag records free ongoing monitoring for LastPass and included monitoring for Proton Pass. |
Scoring formula
Each dimension is normalised to 0-100, then combined:
Untested dimensions — for example encryption strength — are never self-scored. Where third-party test benches have published scores (CNET's 10-point scale, PCMag's 5-point scale, Security.org's SecurityScore), this site restates those scores with attribution instead of inventing its own. The three scales are never averaged or converted into one number.
Category discipline: password manager ≠ SSO ≠ passkey ≠ authenticator
The phrase spans four markets: password managers that store and fill credentials (ranked on this site's main list), enterprise single sign-on (its own page), passkeys as passwordless credentials, and authenticator apps that generate 2FA codes (their own page). Mixing the four would score unlike products against each other, so the main list admits password managers only.
Why first-year price alone is never quoted
CNET's 2026 retest records that both NordPass and 1Password raise prices after the first year, so a first-year figure systematically understates cost in this category. Every price on this site is therefore written as "first year vs renewal" where both figures are verified, and carries its access date. Where only a first-year or promotional figure is verifiable, the renewal field is left unstated.
Data coverage
Published orderings reflect verified fields only. Verified in the 2026 run: CNET's per-tool scores and pros/cons from its July 2026 retest of 13 managers, PCMag's 2026 ratings and Best For picks, Security.org's September 2026 edition (scores, ranks and categories), and official pricing for Bitwarden, 1Password and Proton Pass; and, checked 2026-10-14, the Aura Individual plan price and the Total Password official site. Renewal prices for RoboForm and Keeper were verified on their official pages, and the verified field for each tool is listed in the table below. Not yet verified: a renewal price for NordPass, a personal price for Dashlane (its official pricing page lists business plans only), and a personal price for LastPass. Those fields add 0 points to a score and are listed as not verified. Scores are lower bounds over verified dimensions (see Scores below); a full six-dimension Index Score is not published yet (see the current run status).
Scores: lower bound from verified fields (run 2026.10-r1)
A score on this page is a lower bound. It is the sum of each verified dimension's score times its weight. A dimension that is not verified adds 0 points and is listed as "not verified". Coverage is the number of the six dimensions that are verified. A full six-dimension Index Score is not published yet, because no tool has all six verified.
Mapping rules
| Dimension | Weight | Rule |
|---|---|---|
| Free-tier portability | 20% | Unlimited devices on the free tier: 100. Device-capped free tier: 40. No free tier: 0. |
| Price over 3 years | 20% | 100 × (lowest 3-year cost among scored tools) ÷ (this tool's 3-year cost). 3-year cost = first year + two renewal years. The first year uses the promotional price where the vendor states one, otherwise the regular price (proxy, labelled on the table above). |
| Export portability | 15% | Plain-text export documented by the vendor: 100. Vendor states no plain-text export: 0. Not stated: not verified. |
| Platform coverage | 15% | 100 × (platform count) ÷ (highest platform count among scored tools). Count as defined in the verified-fields table. |
| Passkey and 2FA | 15% | Passkey and hardware-key 2FA both stated: 100. Only one stated: 50. Neither: 0. If either is not stated: not verified. |
| Breach monitoring | 15% | Included in the base paid tier (or the free tier): 100. Sold as an add-on or not included: 0. Not stated: not verified. |
Results
| Tool | Score ≥ | Coverage | Dimension scores (0–100) | Not verified |
|---|---|---|---|---|
| Bitwarden | 85.0 | 5 of 6 | free 100 · price 100 · export 100 · platform 100 · auth 100 · breach — | breach monitoring |
| RoboForm | 57.8 | 5 of 6 | free 40 · price 66 · export — · platform 44 · auth 100 · breach 100 | export portability |
| Proton Pass | 46.3 | 3 of 6 | free 100 · price — · export — · platform 75 · auth — · breach 100 | price over 3 years, export portability, passkey and 2FA |
| 1Password | 34.3 | 4 of 6 | free 0 · price 45 · export 100 · platform 69 · auth — · breach — | passkey and 2FA, breach monitoring |
| LastPass | 31.4 | 3 of 6 | free 40 · price — · export — · platform 56 · auth — · breach 100 | price over 3 years, export portability, passkey and 2FA |
| Keeper | 28.5 | 4 of 6 | free 40 · price 46 · export — · platform 75 · auth — · breach 0 | export portability, passkey and 2FA |
| NordPass | 18.3 | 3 of 6 | free 40 · price — · export — · platform 69 · auth — · breach 0 | price over 3 years, export portability, passkey and 2FA |
| Aura | 15.0 | 2 of 6 | free 0 · price — · export — · platform — · auth — · breach 100 | price over 3 years, export portability, platform coverage, passkey and 2FA |
Dashlane and Total Password are not scored: fewer than three of their six dimensions are verified. Scores with different coverage are not directly comparable. A tool with fewer verified dimensions can only be shown as a lower bound, and its true score may be higher.
Verified fields by tool (checked 2026-10-15)
Each cell records only what the vendor's own page or help document states on the check date. "Not stated" means the page does not say; it is not treated as a negative answer. Platform counts are the number of desktop, mobile, browser-extension, web and CLI entries on the vendor's download page.
| Tool | Price (first year / renewal) | Plain-text export | Platforms | Passkey / hardware key | Breach monitoring in base paid tier |
|---|---|---|---|---|---|
| Bitwarden | $19.80 / $19.80 per year (Premium, annual billing) | Yes (.json, .csv) | 16 | Passkey: yes. Hardware key 2FA: yes (Premium) | Not listed (vault health reports cover exposed passwords only) |
| 1Password | $35.88 / $47.88 (Individual; first year is promotional, renewal is the regular price used as proxy) | Yes (.1pux, .csv, stated as unencrypted) | 11 | Passkey: yes. Hardware key: not stated | Watchtower alerts for breached websites; scope of breach monitoring not defined on the page |
| RoboForm | $29.88 / $29.88 per year (Premium; renewal stated on the official page) | "Export / Import" listed; plain-text not stated | 7 | Passkey: yes. Hardware key 2FA: yes (Premium) | Yes: data breach monitoring for 5 emails (Premium) |
| Keeper | $42.99 / $42.99 per year (Unlimited; official help article, updated 2026-04-01) | Not stated | 12 | Passkey: yes. Hardware key: not stated | No: BreachWatch is sold as an add-on |
| NordPass | $23.88 for first 12 months (1-year promotional plan); renewal not verified | Help page not retrieved | 11 | Passkey: yes. Hardware key: not stated | No: Data Breach Scanner shown as not included in the Premium plan |
| Proton Pass | $35.88 per year (Pass Plus, $2.99/month billed yearly); renewal not stated | Not stated | 12 | Passkey: yes (free tier). Hardware key: not stated | Yes: Dark Web Monitoring in paid plans (not in Free) |
| Aura | $144 per year ($12/month billed yearly, Individual); renewal not stated | Not stated | Not stated | Not stated | Yes: account breach monitoring listed in Individual plan features |
| Dashlane | Personal price not published (business plans only) | Not stated | Not verified | Passkey: yes (business page). Yubico integration listed on business page | Not stated for personal plans |
| Total Password | No price stated on the official site | Not stated | Not stated | Not stated | A footnote mentions breach monitoring; scope not stated |
| LastPass | Personal price not captured | Not stated | 9 | Passkey: yes. Hardware key: not stated | Personal page mentions monitoring data breaches; scope not verified |
Independence and disclosure
This desk accepts no sponsored placements, and every tool entry links to its official site where one is verified. Vault Ledger is part of a network of independent review publications. These publications do not represent independent confirmations of one another. The full list of related publications is in /about.