A Bitwarden alternative that keeps the vault off every server

If you want a free password manager that fills in logins on your phone and your computer, use Bitwarden. If what you want is that no server holds your vault, Bitwarden’s answer is to run its server yourself; Keep’s is to have no server at all, with the vault encrypted on your device and kept in step through a folder of your own. Keep also holds passports, wills and policies beside the passwords. It is part of OBSCURA Pro, and it has no browser extension.

What Bitwarden is

Bitwarden is a password manager with a web vault, browser extensions, desktop apps, a command line and apps for iOS and Android. Its code is published: the apps under the GPL 3.0, the server under the AGPL 3.0, and the features for businesses under a licence of Bitwarden’s own that lets the code be read but not freely reused. The server can be run on your own machine with Docker, so the encrypted vault need not be on Bitwarden’s servers at all.

The free plan keeps unlimited passwords on unlimited devices, stores passkeys, and lets you share with one other person. The paid plans add, among other things, a built-in authenticator for two-step codes, file attachments, emergency access, and sharing for a family. The key is made from your master password with PBKDF2 at 600,000 iterations by default, or Argon2id if you choose it. Cure53 and other firms test it each year, the Applied Cryptography Group at ETH Zurich has reviewed its cryptography, and the reports are published. Prices change, so none are given here; Bitwarden’s own pricing page is the place to check.

Side by side

Bitwarden’s entries are from its own pages on its plans, its key derivation and its audits, and from its code on GitHub, checked on 6 October 2026. Keep’s are from its threat model and its code.

What Bitwarden has that Keep does not

• A free plan that does the main job. Unlimited passwords, on unlimited devices, kept in step. Keep costs money from the eighth day.
• Open code and published audits. Anyone may read, build and run Bitwarden’s apps and server. Keep’s code is not open source, and it has had no outside audit, as /trust says.
• Logins filled in for you, in the browser and on the phone. Keep has no browser extension, so every login is a copy and a paste.
• Passkeys. Keep does not store them.
• Sharing with the people you live or work with, in collections, with roles for who may see and change what. Keep can share a whole second Keep through a folder you both use, but everyone with its passphrase sees all of it.

What Keep adds

• No server to trust or to run. Bitwarden encrypts the vault before it reaches the server, and a server of your own keeps it out of Bitwarden’s hands; but either way there is a server, an account and a copy on it. Keep has none of these. A sync company sees only the sealed .okeep file, and OBSCURA never holds your Keep, your passphrase or your recovery key.
• Your papers beside the passwords. Passports, wills, deeds and policies, previewed inside Keep; records for a passport, a card, a policy or a pension with their files attached; a photograph from a phone’s camera kept as a PDF; and every expiry and renewal on one timeline, with a calendar file for your own calendar.
• Two-step codes included, added from a QR code or brought in from Aegis and 2FAS backups.
• If something happens to you. A letter, and a package of chosen papers for one person, which they open read-only at /keep-open with no account and no subscription.
• One subscription for several jobs. The same Pro plan covers every OBSCURA application; /apps lists them.

Moving from Bitwarden

1. In Bitwarden, choose Export vault and the .json format, plain or password protected, or CSV. The account-restricted export is sealed with a key that never leaves Bitwarden, so Keep cannot read it, and says so if it is given one.
2. In Keep, choose Import from a password manager and pick the file. Logins come in with their folders, favourites and password history, and a login’s two-step secret becomes a code beside it. Secure notes come in as notes; cards, identities and SSH keys as records of their kind; custom fields as fields of their own, the hidden ones hidden. Anything Keep cannot read is listed rather than dropped, and you see everything before it is added.
3. Delete the export. It holds every password in the clear.
4. Make the recovery key and print the emergency kit, then choose a sync folder if you want one.

Leaving is as plain: Keep writes everything out as Bitwarden’s own JSON export, protected with a password you choose, or your logins as a CSV in the columns Bitwarden and Chrome read, warning you first that that file is not encrypted.

What it costs

Keep on its own is US$2 a month or US$19 a year; all of OBSCURA Pro is US$5 a month or US$48 a year. Each comes with 7 days free first. For a team, each person needs a plan of their own. There is no free version of Keep with features held back, but a package somebody left you opens free at /keep-open. If a free password manager on one computer is all you need, the site’s free password vault with no account does that.

See it before you pay. Keep’s page shows it at work with an invented demo, and lists what it cannot do yet. The threat model says what it protects against, and what it does not.