Best Password Managers 2026

A security audit or penetration test is an outside firm trying to break a product and reporting what it found. The table lists the most recent audit each company has published for anyone to read, checked on 5 October 2026. Certifications such as SOC 2 and ISO 27001 check a company's internal controls rather than the app itself, so they are noted separately and not counted as a public audit.

1Password says that since 3 November 2025 its annual penetration test reports are distributed through its Trust Center rather than published openly, and that it holds SOC 2 Type 2 and ISO 27001 certifications (1Password security audits page). NordPass lists ISO 27001 and SOC 2 Type 2 on its security page.

A published audit shows that an outside firm examined the product at a point in time and that the company was willing to show the result; it does not prove the product is free of flaws today, and an older report says little about features added since.

User ratings show how people who chose to leave a review felt about a company or app. They are useful for spotting patterns, such as repeated complaints about billing, renewals or support, but they are not a measure of how well a product works: happy customers review less often than unhappy ones, some companies invite reviews more actively than others, and a score built on a few dozen reviews can move a lot with a handful more.

Trustpilot rates the company behind a product, usually for all of its products and services, and often reflects buying and billing experiences. Apple App Store ratings cover one iPhone and iPad app in the US store, so they say little about a desktop or web version. An App Store rating is shown only when the app is published by the vendor itself. The two scores come from different groups of reviewers and are not combined here.

"Not listed" means no page or app from the vendor itself was found. Ratings change daily.