KeePass

KeePass stores credentials in an encrypted database file that lives wherever you put it: a local drive, a network share, a USB stick or a folder synced by a service of your choice. The database is unlocked by a master password, a key file, a Windows user account, or a combination of these. Encryption uses AES-256, ChaCha20 or Twofish, and the master key components are hashed with SHA-256. There is no vendor account and no server component, so nothing is uploaded anywhere unless you arrange the synchronisation yourself.

Entries are organised into a hierarchy of groups and can carry usernames, passwords, URLs, free-form notes, expiry dates and attached files. The built-in generator creates passwords to configurable rules. Auto-Type watches the title of the active window and types the matching credentials into a login form, which covers desktop applications as well as browsers. Drag and drop and clipboard handling with an automatic clear timer round out day to day use. Import is supported from a long list of competing formats, and export goes to TXT, HTML, XML and CSV, so the data is not locked in.

A portable package runs from removable media without installation and writes nothing to the host system or its registry, which makes it a common choice for technicians and for locked-down machines. Installer and MSI packages are also published for x86, x64 and ARM64, the latter aimed at administrators deploying across a network. A plugin interface extends the program with extra import filters, backup routines and integrations. The interface is translated into more than forty-five languages.

Official builds target Windows, with Mono allowing the same code to run on Linux, macOS and BSD; independent community ports cover Android, iOS and browsers, sharing the same database format. The trade-off is that KeePass gives you no hosted sync, no team sharing and no polished browser extension out of the box, and its interface is functional rather than modern. People who want a managed cloud vault with device sync handled for them will be happier with a commercial service; people who want full control of the file and its encryption will find little reason to look elsewhere.