17 rules in 5 groups, worth 100 points in all. They were set before any product was scored and apply the same way to all 10.
Version 1, published 8 Oct 2026
In short
Each rule is a yes-or-no fact, a list (such as the systems with an app) or a number with published thresholds, read from the vendor's own pages.
A fact the vendor does not publish earns nothing. A feature in beta or preview does not count.
The list follows the points. A tie goes to the lower price on "cheapest paid plan", then to the name.
Password managers for individuals and families that run on Windows. Business-only products are left out, and a line that says "on at least one plan" counts only plans for individuals and families.
Security and audits 35 points
Rule
What it takes
Points
End-to-end encrypted vault
The vendor documents that the vault is encrypted on your device before it syncs, so the vendor cannot read it.
8
Independent audit since 2024
A named outside firm audited or penetration-tested the product, and the vendor publishes the report or a summary dated 2024 or later.
8
SOC 2 Type II or ISO 27001
The vendor names a SOC 2 Type II report or an ISO/IEC 27001 certification for this product or the company running it.
5
Open-source apps
The source code of the apps is public under an open-source licence.
5
Public bug bounty
A public bug bounty programme, run by the vendor or on a platform such as HackerOne or Bugcrowd.
4
Security key for two-factor sign-in
You can protect the account with a FIDO2 or WebAuthn security key, such as a YubiKey, on at least one plan.
5
Apps and extensions 20 points
Rule
What it takes
Points
Apps
An app for each system (a desktop or mobile app, not only a browser extension). Each one earns 2 points.
10
Browser extensions
An official extension for each browser. Each one earns 2 points.
8
Web vault
You can open your vault in a web browser without installing anything.
2
Passkeys and sign-in 15 points
Rule
What it takes
Points
Stores passkeys
Saves passkeys and signs you in to websites with them, at least in desktop browsers.
8
Built-in two-factor codes
Stores two-factor (TOTP) secrets and fills the one-time codes, on at least one plan.
4
Log in with a passkey
You can log in to the password manager itself with a passkey instead of typing the master password.
3
Sharing and family 15 points
Rule
What it takes
Points
Family plan
A plan that covers at least five people, each with a private vault.
5
Share with other people
You can share single items or folders with other people, on at least one plan.
5
Emergency access
A trusted contact can request access to your vault if something happens to you.
5
Price 15 points
Rule
What it takes
Points
Free plan for a computer and a phone
A free plan (not a trial) with unlimited passwords that you can use on a computer and a phone at the same time.
7
Cheapest paid plan
The cheapest paid plan for one person at its regular price (not a first-year offer), in US dollars a month, billed yearly. A product that is entirely free counts as $0. $1 or less earns 8 points, $2 or less 6, $3 or less 4, $4 or less 2.