A 1Password alternative with no account and no copy on a server

If you want logins filled in for you on your phone and your computer, and a family or a team sharing vaults, stay with 1Password: Keep has no browser extension and no app of its own on a phone, and it shares only a single item or a package you hand over. If you would rather no company held a copy of your vault, even an encrypted one, and want passports, policies and wills kept beside the passwords, Keep does that in a browser tab, encrypted with Argon2id and AES-256-GCM before anything is stored. It is part of OBSCURA Pro.

What 1Password is

1Password is a password manager sold by subscription, to one person, a family or a business, with apps for Windows, macOS, Linux, iOS and Android and extensions for the main browsers. A vault is encrypted on your device under a key made from your account password and a 128-bit Secret Key that 1Password never sees, and the encrypted vault is kept on 1Password’s servers so that every device you sign in on has it. Watchtower flags weak, reused and breached passwords; families and teams share vaults; Travel Mode takes chosen vaults off a device while you cross a border. Outside firms have tested it, and it holds SOC 2 Type 2 and ISO 27001 certification.

There is no free plan; a new account starts with a trial. Prices change with offers and from country to country, so none are given here, and 1Password’s own pricing page is the place to check. Nothing on this page argues that 1Password is unsafe. Its design is careful and published. The difference is where the encrypted copy lives.

Side by side

1Password’s entries are from its own pages on its security model, its audits, its features and its plans, checked on 6 October 2026. Keep’s are from its threat model and its code.

What 1Password has that Keep does not

• Logins filled in for you. This is the largest difference, and for many people it decides the matter. Keep has no browser extension, so every login is a copy and a paste.
• Apps on every device, with sync that needs no thought. Keep runs in a phone’s browser, but keeps itself in step automatically only through a folder in Chrome or Edge on a computer.
• Sharing with the people you live or work with. Shared vaults, with someone to manage who sees what. Keep can share a whole second Keep through a folder you both use, but everyone with its passphrase sees all of it: there are no roles and no one to manage access.
• Passkeys. Keep does not store them.
• Outside audits and certification. Keep has had none: no penetration test and no SOC 2, as /trust says. What it has is a threat model written in plain words, and its own tests of the cryptography against published test vectors.
• Travel Mode, and the years of use and support behind a large company’s product.

What Keep adds

• No copy anywhere you did not put one. There is no Keep server and no account. A sync company sees only the sealed .okeep file, and OBSCURA never holds your Keep, your passphrase or your recovery key, so there is nothing for us to lose or hand over.
• A memory-hard passphrase. Argon2id makes every guess cost 64 MiB of memory and three passes, so trying a list of likely passphrases is slow.
• Your papers beside the passwords. Passports, wills, deeds and policies of any file type, in eleven life categories, previewed inside Keep and found by the words inside a PDF; records for a passport, a card, a policy or a pension with their files attached; a photograph from a phone’s camera kept as a PDF.
• Every date that matters on one timeline, with the expiries and renewals from your records, and a calendar file for your own calendar.
• If something happens to you. A letter, and a package of chosen papers for one person under its own passphrase, which they open read-only at /keep-open with no account and no subscription.
• One subscription for several jobs. The same Pro plan covers every OBSCURA application, from PDF Studio to Roots; /apps lists them.

Moving from 1Password

1. In 1Password, export your data in its own .1pux format, which keeps every kind of item; its CSV keeps only logins. Converting a .1pux export says what is in one.
2. In Keep, choose Import from a password manager and pick the file. Logins come in with their vault as a folder, their tags, favourites and password history, and a login’s one-time password secret becomes a two-step code beside it. Cards, identities, passports, bank accounts, SSH keys and the other kinds Keep has a record for come in as that record, each field in its place and any other field kept beside it; secure notes, and kinds Keep has no record for, come in as notes carrying their fields. Archived and deleted items are left out, and listed.
3. You see everything before it is added. Files attached to items in 1Password are not read from the export: save them and add them to Keep as documents.
4. Delete the export. It holds every password in the clear.
5. Make the recovery key and print the emergency kit, then choose a sync folder if you want one. Without the passphrase or the recovery key, nobody can open the Keep, OBSCURA included.

What it costs

Keep on its own is US$2 a month or US$19 a year; all of OBSCURA Pro is US$5 a month or US$48 a year. Each comes with 7 days free first. For a team, each person needs a plan of their own. There is no free version of Keep with features held back, but a package somebody left you opens free at /keep-open.

See it before you pay. Keep’s page shows it at work with an invented demo, and lists what it cannot do yet. The threat model says what it protects against, and what it does not.