A password-manager ranking becomes useful when it explains what happens after you lose your phone. Until then, it is mostly a list of logos.
The Reddit thread that prompted this comparison presents Bitwarden and Proton Pass as the leading choices. Its ranking comes from ten AI models voting on twelve products. That tells us what those models recommended; it does not establish market share, resistance to attack, or which app will reliably fill a login on your phone. Replies also describe conflicting experiences with autofill and pricing. Those are useful questions to investigate, not a controlled benchmark.
I would start most people with Bitwarden, consider Proton Pass especially seriously when email aliases matter, and put Authier on the shortlist when controlling which devices join a vault is the specific problem. The reasons—and the limits—matter more than the order.
This is a comparison of public documentation checked on 25 October 2026, not a hands-on penetration test or an autofill performance benchmark. Recommendations below are my assessment of the documented tradeoffs.
The practical comparison
| Decision | Bitwarden | Proton Pass | Authier |
|---|---|---|---|
| Free storage | Unlimited passwords and devices | Unlimited logins and devices; 10 email aliases | 40 login credentials and 3 TOTP secrets |
| Paid personal option | Premium: US$19.80/year | Pass Plus: US$35.88/year at the displayed annual rate | US$1/month for 250 additional credentials; US$1/month for 100 additional TOTP secrets; US$2/month for both |
| Passkeys for website sign-in | Supported | Supported | Supported in the browser extension |
| Codes generated inside the vault | Integrated authenticator requires Premium | Integrated authenticator requires a paid plan | Included, subject to TOTP capacity |
| Email-alias approach | Integrations with alias services | Aliases built into the product | No equivalent advertised in the reviewed feature list |
| My strongest reason to consider it | Broad everyday coverage and value | Making a different email address part of each signup | Configurable approval of new devices |
Feature and price sources: Bitwarden plans, Proton Pass plans, Authier pricing and Authier features. Prices are the displayed US-dollar figures, before any applicable tax; Proton shows an annual discount, and checkout and renewal terms should be checked. Authier's payments buy additional capacity, not unlimited storage.
Authier's extension can create and use passkeys on compatible websites and synchronize them through the encrypted vault. Its extension 1.2.13 and Android 0.1.5 release notes distinguish browser support from Android: that Android release synchronizes the encrypted records but does not create or use passkeys for sign-in.
The integrated authenticator row means generating codes for other websites inside the password vault. It does not mean that free users cannot protect the password-manager account with two-factor authentication.
Bitwarden: the starting point for an ordinary, untidy digital life
Bitwarden's appeal is straightforward: the free account covers passwords across multiple devices, while Premium adds useful extras without requiring a large annual commitment. Its official plans include browser, mobile and desktop clients, passkey management, encrypted exports and sharing with one other user. Premium includes emergency access and the integrated authenticator. Bitwarden's feature breakdown makes the distinction between free essentials and paid convenience reasonably clear.
For someone moving out of browser-only password storage, that is a sensible baseline. I would evaluate it first on the devices and websites used every day. A free plan is valuable only if it is comfortable enough that you stop reusing passwords.
It would be misleading to describe Bitwarden as having no device checks. Its new-device login protection can require an emailed verification code for eligible logins without two-step login, with documented exceptions. It also offers Log in with device, where an existing session approves a request after the user checks a matching fingerprint phrase. That is a login option; Authier presents device approval as a configurable enrollment policy. Similar-looking approval buttons do not automatically enforce identical rules.
My reservation is evidential rather than cosmetic: a substantial audit history deserves attention, but it does not settle every question about the encryption protocol. The 2026 findings below belong in any serious recommendation.
Proton Pass: a strong fit when the email address matters too
Passwords are only one identifier handed to a website. Proton Pass makes email aliases part of the same workflow: its free plan provides ten, while Pass Plus removes that numerical limit. The current plan comparison also includes passkeys across devices and limited free vault sharing; it would be inaccurate to say that all sharing requires payment. Proton's detailed plan table is more useful here than a headline feature card.
My practical case for Proton is someone who wants a separate address for shops, newsletters and other accounts without treating alias management as a second project. That benefit can justify paying more than Bitwarden Premium. If aliases barely interest you, the case is weaker.
There is an account-design question for people already using Proton Mail. By default, the Proton Account password signs into Proton's services, including Pass. Proton documents an optional extra password specifically for Pass. That gives the vault another access requirement, but it also gives you another secret to preserve. I would plan recovery before enabling it.
I cannot turn the Reddit comments into a reliable claim that Proton autofill is faster or more dependable. Try the same awkward login flows in both apps: a separate username page, a mobile app, and a site where several accounts share one domain.
Authier: make the device-admission rule explicit
Authier is interesting because its access model asks a concrete question: which existing device gets to admit the next one? Its documented policies allow immediate enrollment, approval by any trusted device, or approval specifically by the master device. The extra gate therefore depends on the policy you select. Authier's security explanation describes client-side encryption and approval before synchronization.
Its feature documentation also describes per-device TOTP synchronization controls and a cooldown for recovery-based master-device resets. For someone who wants passwords on a laptop but fewer authenticator secrets there, that is a useful control to investigate. It is not a guarantee against malware on an already unlocked device.
Platform coverage needs care. The current download page lists Chrome, Firefox and Edge extensions, Firefox for Android, and a native Android app distributed through GitHub Releases with Obtainium updates. It explicitly distinguishes these from historical desktop and iOS roadmap claims. I would verify a supported installation and update path for every required device before migrating; an old promise of an app does not count as a download.
My practical test for Authier would be a replacement-device rehearsal: request access, verify which existing device can approve it, and check what happens when that device is unavailable. The approval policy earns its place when you understand both the extra control it provides and the recovery steps it requires.
Read what the security reviews actually cover
Bitwarden publishes an index of security assessments covering different clients and components. The breadth is useful: readers can inspect scope and findings instead of trusting an unexplained badge.
It also faced a consequential challenge in 2026. Researchers at ETH Zurich reported attacks against Bitwarden and other managers under a malicious-server threat model: the researchers controlled a server that could deviate from the expected protocol. The findings concerned confidentiality and integrity protections. This was research using adversarial servers, not a report that Bitwarden's production service had been breached.
Bitwarden's February response grouped issues into resolved or ongoing remediation and accepted design decisions. That wording does not justify saying every issue was fixed. For a high-impact deployment, review the linked technical report and the status applicable to your clients and account configuration.
Proton's May 2026 announcement describes a Recurity Labs assessment conducted from January through April across browser extensions, mobile and desktop apps, and the command-line interface. Proton reports no remote exploits or encryption bypasses found in that assessment, and says desktop memory-handling findings were resolved in retesting. Those are bounded results, not a promise that future vulnerabilities are impossible.
These documents do not supply a common scoring system or establish a security ranking across all three products. Different scopes cannot honestly be flattened into a winner's podium.
Recovery is part of the comparison
Before choosing, write down the route back in after losing your main device. Then identify which step depends on a secret inside the vault you cannot open.
- Bitwarden: its two-step-login recovery code removes the configured second factors, but the recovery flow still requires the master password. Keep that distinction clear when preparing a recovery kit.
- Proton Pass: Proton distinguishes resetting an account password from recovering encrypted data. Its account-recovery documentation says a recovery phrase covers both, while several other methods cover only one. Configure recovery before a reset becomes necessary.
- Authier: confirm which device may approve enrollment and how the documented master-device recovery cooldown affects access. Its features page describes a master-device reset; do not read that as a promise to decrypt a vault after forgetting its password. Check the exact recovery procedure before relying on it.
Also decide where two-factor secrets belong. Keeping passwords and TOTP seeds together is convenient, but an attacker who compromises that unlocked vault may obtain both. Authier's FAQ explains this tradeoff and notes that its CSV exports are plaintext. For any manager, handle exports as secrets and keep an independent recovery route for important accounts.
Which would I choose?
Bitwarden is my default starting recommendation for someone who wants a broadly capable password manager with a generous free plan and a substantial public security record. Read the caveats, enable appropriate account protection, and test everyday usability.
Proton Pass is my preference when aliases are central to the job, or when its workflow fits an existing Proton setup. Its published audits make it a serious candidate; its recovery arrangements still need deliberate attention.
Authier is the specialist option I would investigate for device approval and selective TOTP synchronization. Check its storage allowances, supported installation paths and recovery procedure against your own devices and accounts before choosing it.
Before moving everything, test a new-device login, a difficult autofill form, an export and the recovery instructions with a small trial vault. Choose the manager whose access rules you can explain—and whose recovery plan still works when your phone is gone.
A thought worth keeping?
