Self-hosted Secrets, Passwords & Vaults tools

Vaultwarden is a lightweight, Bitwarden-compatible password manager server in Rust, designed for self-hosting with official Bitwarden clients.

AGPL-3.0Actively maintained

Alternative to:

Bitwarden+9

Infisical is an open-source platform to manage and deliver app secrets, certificates (PKI), SSH credentials, and encryption keys across teams and infrastructure.

Actively maintained

Alternative to:

HashiCorp Vault+9

KeePassXC is a secure, cross-platform password manager that stores credentials and sensitive notes in encrypted KeePass-compatible KDBX files with autofill and browser integration.

Actively maintained

Alternative to:

KeePassXC+10

Open-source, end-to-end encrypted platform for private photo backup, sharing, and authenticator (2FA) sync across devices, with optional self-hosting.

AGPL-3.0Actively maintained

Alternative to:

Google Photos+14

Bitwarden is an open-source password manager that stores, shares, and autofills credentials with zero-knowledge encryption; supports cloud or self-hosted deployments.

Actively maintained

Alternative to:

1Password+9

OpenBao is an open source secrets management platform to securely store, generate, lease, and revoke secrets, certificates, and encryption keys with auditing and access control.

MPL-2.0Actively maintained

Alternative to:

HashiCorp Vault+3

Passbolt is an open-source, security-first password and secret manager for teams, with end-to-end encryption, granular sharing permissions, and auditing.

AGPL-3.0Actively maintained

Alternative to:

Passbolt Cloud+11

Open-source web app to manage TOTP/HOTP 2FA accounts: scan QR codes, generate one-time codes, import/export tokens, and protect access with WebAuthn and optional encryption.

AGPL-3.0Actively maintained

Alternative to:

Google Authenticator+3

Open-source app that creates self-deleting secret links with audit logs.

Apache-2.0Actively maintained

Alternative to:

Onetime Secret+1

Open-source tool for sharing secrets and files via client-side OpenPGP encryption and one-time expiring links.

Apache-2.0Actively maintained

Alternative to:

Onetime Secret+3

Privacy-first, end-to-end encrypted password and email alias manager with passkeys, TOTP, apps and extensions, plus a built-in email server for self-hosting.

AGPL-3.0Actively maintained

Alternative to:

SimpleLogin+12

Open-source web and API service to create encrypted, single-view links for sharing secrets with configurable expiry and optional passphrase protection.

MITActively maintained

Alternative to:

Onetime Secret+6

On-prem password manager enabling secure sharing and fine-grained access control over credentials.

GPL-3.0Actively maintained

Alternative to:

Bitwarden+9

Databunker is a self-hosted vault that tokenizes and encrypts PII/PHI/KYC/PCI data, providing a secure API, consent management, and audit trails for compliance.

MITActively maintained

Alternative to:

Skyflow

Share sensitive text or files securely using client-side encryption, expiring links, view limits, and optional password protection.

Actively maintained

Alternative to:

Onetime Secret+3

Self-hosted one-time, self-destructing message service that stores secrets in HashiCorp Vault, with a lightweight web UI and optional TLS automation.

MITActively maintained

Alternative to:

Onetime Secret+1

Simple PHP app for one-time encrypted secret sharing. Stores encrypted secrets in SQLite, deletes on retrieval, and provides a curl API and Docker images.

MITActively maintained

Alternative to:

Onetime Secret+1

Tiny Flask app to create encrypted, expiring secrets shareable via private links. Secrets are encrypted and deleted after viewing, expiration, or max attempts.

MITSlowing down

Alternative to:

Onetime Secret+1

Self-hosted encrypted file sharing and vault. Client-side encryption, shareable expiring links, CLI and web UI, and storage backends (local, S3, Backblaze B2).

AGPL-3.0Slowing down

Alternative to:

WeTransfer+17

Client-side web app to encrypt or split secrets into QR codes and OCR-friendly printouts for offline recovery using AES and Shamir Secret Sharing.

Actively maintained

Alternative to:

Onetime Secret+1

Self-hosted Docker web app for generating secure passwords and passphrases with customizable options, haveibeenpwned checks, PWA support, and environment variable configuration.

Minimal, dependency-free browser password generator written in HTML, CSS and plain JavaScript. Customizable character sets, length, translations and a strength indicator.

GPL-2.0Likely dormant

Alternative to:

Microsoft Edge

Browser-based self-custodial crypto wallet that derives a private key from a password and passcode using scrypt and keccak256; no registration or seed phrases.

Kontoj loads a JSON services list to generate credentials, autofill signup forms via a userscript, and export generated credential emails for bulk account creation.

Passit is an open-source password manager to store passwords and secure notes, organize them in groups, and share access on self-hosted instances.

Activity unknown

Alternative to:

LastPass+9

Psono is a self-hosted, open-source password manager with client-side encryption, web & mobile clients, admin portal and a fileserver for encrypted file storage.

Activity unknown

Alternative to:

LastPass+9

Turtl is an end-to-end encrypted note-taking and bookmarking app with tagging, full‑text search, and optional self-hosted sync via Turtl Server.

Activity unknown

Alternative to:

Standard Notes+19