ST — Sovereign topology & environment
20%- Local-first, offline, and airgap-friendly operation.
- No mandatory SaaS, subscription gate, or vendor account.
- Ability to build or sideload outside gatekept stores when needed.
A final, fully-audited scoring framework and ranking for Password Safe, KeePassDX, the KeePass / KeePassXC / Secrets KDBX family, KeePassium, Vaultwarden / Bitwarden, Psono, Nextcloud Passwords, Passbolt, Spectre, LessPass, and the pass ecosystem. The model prioritizes sovereign topology, attack surface, catastrophic-failure profile, openness, privacy, long-term survivability, and realistic daily operability.
Each system is scored from 0–100 on seven axes. Composite score is the weighted sum. The framework assumes latest stable builds, hardened settings, strong master secrets / keys, and local-only or self-hosted deployment wherever the system permits it.
Scores below reflect the final audited schema. The ordering separates core local primitives, mobile KDBX front-ends, stateless generators, and networked team stacks.
| # | System | Tier | ST | AA | CF | FO | PM | EL | UX | Composite |
|---|---|---|---|---|---|---|---|---|---|---|
| 1 | KeePass / KeePassXC / KDBX family | Tier 0 | 98 | 92 | 95 | 100 | 100 | 98 | 90 | 95.9 |
| 2 | pass ecosystem | Tier 0 | 100 | 92 | 92 | 100 | 95 | 97 | 88 | 95.1 |
| 3 | Password Safe | Tier 0 | 96 | 94 | 95 | 95 | 100 | 85 | 80 | 92.7 |
| 4 | KeePassium | Tier 1 | 88 | 85 | 92 | 95 | 95 | 95 | 95 | 91.0 |
| 5 | KeePassDX | Tier 1 | 90 | 85 | 90 | 95 | 90 | 90 | 90 | 89.5 |
| 6 | Spectre | Tier 1.5 | 100 | 95 | 60 | 100 | 100 | 80 | 80 | 89.1 |
| 7 | LessPass | Tier 1.5 | 100 | 85 | 60 | 100 | 100 | 80 | 80 | 86.9 |
| 8 | Vaultwarden / Bitwarden | Tier 2 | 80 | 60 | 80 | 95 | 80 | 90 | 92 | 79.9 |
| 9 | Passbolt | Tier 2 | 75 | 60 | 80 | 95 | 85 | 88 | 82 | 78.1 |
| 10 | Psono | Tier 2 | 75 | 60 | 80 | 95 | 85 | 87 | 80 | 77.8 |
| 11 | Nextcloud Passwords | Tier 2 | 75 | 50 | 75 | 95 | 80 | 75 | 75 | 72.4 |
These are the structurally cleanest systems in the set. They minimize network exposure, preserve portability, and remain legible under long time horizons.
This cluster includes KeePass,
KeePassXC,
Secrets, and other
KDBX-speaking clients. The model is simple: a local encrypted
.kdbx file, no inherent server, and no mandatory online account.
That topology is offline-friendly, airgap-capable, and easy to back up or move across machines.
The attack-surface score remains high because the core shape is a local application speaking to an encrypted file. Browser integration and most plugin expansion are optional rather than structural. KeePassXC also carries a significant external validation signal: version 2.7.9 received ANSSI's CSPN security visa after a full Synacktiv / ANSSI evaluation.
Catastrophic-failure handling is especially strong because blast radius can be segmented: independent databases are trivial, key files can be added, and different trust zones can be separated instead of centralized into one universal vault. Long-term survivability is equally strong because KDBX has become a de facto standard with multiple independent implementations.
The pass universe is the purest file-tree model in the list: secrets are just GPG-encrypted text files, optionally synchronized through Git. No server is implied, no browser extension is required, and the underlying data remains visible as ordinary filesystem structure.
Attack surface is slightly more complex than the shell wrapper alone suggests because the real trusted base includes GnuPG/OpenPGP, and operational discipline matters. Even so, there is no always-on service to expose, which preserves an enormous advantage over server-centric designs.
Catastrophic-failure profile is strong but not perfect: one compromised keypair can burn the secrets bound to that key. The architecture remains favorable because segmentation is natural — separate stores, separate recipients, separate hardware-backed keys. Long-horizon survivability is excellent because the format degrades gracefully into “encrypted text in a directory tree.”
Password Safe, originally associated with Bruce Schneier, is architecturally pure: a local encrypted file with no native server layer and a very conservative design posture. That drives very high topology, privacy, and attack-surface scores.
The tradeoff is ecosystem gravity. It remains open and durable, but it does not carry KDBX’s level of multi-client ubiquity or the same broad interoperability momentum. Daily operation is serviceable but more old-school, which mildly suppresses UX.
These systems inherit KDBX’s fundamental strengths but operate inside mobile platform constraints: app-store distribution, opaque mobile firmware, and more hostile OS assumptions.
KeePassium is the strongest Apple-facing projection of the KDBX model. It remains open-source, publishes its code on GitHub, and underwent a 2024 Cure53 audit.
The score penalty versus desktop KDBX tools does not come from format weakness but from environment: iOS and the App Store impose a locked-down supply chain and more opaque trust assumptions. Within that constraint, the app remains extremely strong and gives Apple platforms a clean bridge into the KDBX universe.
KeePassDX occupies the same structural role on Android: a local KDBX client with strong offline posture and no required cloud account. It inherits KDBX’s segmentation and portability benefits while offering a usable mobile path.
The penalty is again environmental. Android is more flexible than iOS in some deployment modes, but the platform remains more exposed than a hardened desktop Linux or BSD host. As a mobile front-end to a KDBX-centered architecture, however, it remains one of the cleanest options available.
These systems minimize stored state so aggressively that they nearly delete the vault category itself. The resulting privacy and topology profile is extraordinary; the catastrophic-failure profile is the trade.
Spectre describes itself as a password app that contains no passwords. Instead of saving secrets, it deterministically derives them from a master secret and site-specific inputs. This makes topology and privacy almost maximally clean: no vault to synchronize, no cloud to trust, nothing durable to steal at rest.
The reason Spectre does not rise above the mobile KDBX front-ends is catastrophic concentration: one compromised master secret can effectively burn the entire derived credential universe. Rotation is correspondingly painful because it requires systematic re-issuance rather than simple vault re-encryption.
LessPass follows the same fundamental pattern: a stateless generator that computes per-site passwords from a master password, site, and login. It eliminates synchronization and vault management almost entirely.
The lower composite relative to Spectre comes mostly from greater browser-centric exposure and a slightly less clean architectural feel. The core structural weakness is identical: extraordinary locality and privacy, but a single master secret remains dangerously central.
These tools are not “bad”; they are simply solving a different problem. Collaboration, sharing, policy, and browser-heavy workflows inevitably create a server and extension attack-surface tax.
Vaultwarden is an unofficial Rust implementation of the Bitwarden API designed for self-hosting with the official Bitwarden clients. This gives it major ecosystem and usability advantages: broad platform support, polished clients, and familiar workflows.
The ranking penalty is purely architectural. A permanently online service with user accounts, an HTTP stack, a database, mobile clients, and browser extensions is structurally more exposed than a local encrypted file or a stateless generator. Even with strong client-side encryption and a zero-knowledge model, metadata still exists and the service layer still has to be defended.
Passbolt is a team-oriented open-source credential manager, positioned around collaboration, access control, and secure sharing. It gains credit not only for openness but for visible external scrutiny: its 2025 public security update cites multiple audits and compliance reviews, including Cure53 and Quarkslab-linked work.
The reason it remains below Vaultwarden/Bitwarden is not trustlessness of the code but structural mass: browser extensions, multi-user coordination, policy, and organizational features enlarge the trusted base and the misconfiguration surface.
Psono occupies a similar structural band: open, self-hosted, team-aware, and extensively audited, including a 2025 Cure53 review. Its low placement is not a quality indictment but an architecture statement: server + browser add-ons + multi-user features are a heavier system than a single local encrypted artifact.
The small gap below Passbolt mainly reflects ecosystem gravity and comparative reach, not a dramatic security distinction.
Nextcloud Passwords solves credential storage inside the much larger Nextcloud platform. That convenience is precisely why it ranks last: the password system inherits the surface area of a general-purpose PHP application stack, database layer, web platform, and extension environment.
Privacy and control are also weaker in default server-side encryption models. According to the official Nextcloud encryption documentation, master-key mode means the administrator can decrypt data. That is structurally worse than genuinely client-held end-to-end models, and far worse than a local encrypted file or a stateless generator.
The table is not merely a list of “good tools.” It is a map of structural categories.
KeePass / KDBX, pass, and Password Safe are the roots of trust. They are the systems most aligned with local control, low attack surface, portability, and long-horizon survivability.
KeePassium and KeePassDX are mobile projections of KDBX. Spectre and LessPass are stateless tools with unusually clean locality but a harsher catastrophic-failure profile.
Vaultwarden / Bitwarden, Passbolt, Psono, and Nextcloud Passwords solve collaboration and always-on convenience problems. That adds value for teams, but it also adds unavoidable architectural weight.
All product names and audit references above are linked inline to official sites, repositories, documentation, and public audit material wherever available.