At a glance — how these 3 alternatives compare
Our read on each project's adoption, maintenance activity and commercial-use risk, derived from GitHub signals and SPDX license terms rather than star count alone. Sorted by stars. How we score.
| Project | Adoption | Maintenance | Commercial use |
|---|---|---|---|
| ★ 68,677 · Rust AGPL-3.0 | Flagship | Active | High risk Even a hosted/modified deployment can trigger source release |
| ★ 29,123 · C++ | Mainstream | Active | High risk Distributing a derived work obliges releasing its source. Split licence — this rates the core component; read the † text for the separately licensed parts |
| ★ 20,246 · C# | Mainstream | Active | High risk Even a hosted/modified deployment can trigger source release. Split licence — this rates the core component; read the † text for the separately licensed parts |
† Licenses marked † were read from the repository's LICENSE file on 2026-09-05 (linked, pinned to the commit we read) because the GitHub API returned no SPDX id for them. Unmarked licenses are the GitHub API's SPDX classification.
The alternatives
vaultwarden
Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs
dani-garcia/vaultwarden Updated 2026-10-07 KeePassXC is a cross-platform community-driven port of the Windows application “KeePass Password Safe”.
keepassxreboot/keepassxc Updated 2026-09-30 Bitwarden infrastructure/backend (API, database, Docker, etc).
bitwarden/server Updated 2026-10-08 Editor's take
Yusuke Morinaga · last revisited · star counts quoted in the text (≈) are as of that date; the cards above are refreshed daily
Leaving 1Password is less a software choice than a decision about who runs your sync server — and a license you should read first.
A password manager is the one tool where “self-hosted” carries real weight, because what you are self-hosting is your entire credential surface. So my framing for the 1Password question isn’t “which app feels nicest” — all three options below have competent extensions and apps — but “am I willing to own a sync server, and under what license.”
The license actually matters here. Vaultwarden (≈66.9k★, Rust) is AGPL-3.0, and the official Bitwarden server (≈20k★) repository ships both AGPL and Bitwarden-specific license files, so treat it as a manual legal read rather than a simple permissive license. A personal vault is unaffected, but if you’ll run it for a company and modify it, AGPL’s network clause is exactly the detail people skip and regret.
On who each candidate is for: Vaultwarden is my pick for the smallest footprint — it runs on a Raspberry Pi, which the official Bitwarden server, heavier on RAM, will not do comfortably. Choose the official server when you want upstream’s exact behavior and have the hardware to spare. KeePassXC (≈28.7k★) is a different category: file-based, so no sync server to run, but also no native real-time sync without your own cloud storage — a feature for the security-maximalist, a chore for a family.
The migration is the easy part; the gap analysis is the hard part. Bitwarden’s importer reads 1Password’s 1PUX format directly, so the data moves cleanly. What does not move: Travel Mode, Secrets Automation for CI/CD injection, and native macOS/iOS polish — budget a dedicated secrets tool if your team leaned on the latter.
As credential infrastructure, I’d treat the cutover as a checklist, not a single switch:
- Export first, verify second. Pull an unencrypted 1PUX and confirm Bitwarden’s importer ingests it before trusting it.
- Match the server to your hardware. Vaultwarden for a Pi-class box, the official server when you have RAM.
- List the unreplaced features as line items. Travel Mode, Secrets Automation, native polish — so nobody assumes they came across.
- Roll out in cohorts. A staged rollout surfaces broken sharing permissions while the blast radius is small; a big-bang cutover hides them until someone is locked out.
Get the export and the cohorting right and the rest is mechanical. The trap is treating this like any other SaaS swap — it isn’t, because the failure mode is people locked out of their own accounts.
Comparison notes
For the bread-and-butter job of storing credentials and sharing them across a team, two routes stand out: Vaultwarden, a Rust reimplementation of the Bitwarden server that is light enough to run on minimal hardware, and Bitwarden's own official server. Both ship the browser extensions and mobile apps you'd expect. Where they fall short of 1Password is around the edges: there's no equivalent to Travel Mode for hiding vaults at border crossings, no Secrets Automation for injecting credentials into CI/CD, and the native macOS/iOS experience is less refined. KeePassXC is worth a mention too, though it works on a different model entirely — file-based, with no built-in real-time sync unless you bolt on third-party cloud storage.
Migration tips
- Export your 1Password vault as an unencrypted CSV or 1PUX file from the desktop app before migration
- Bitwarden's importer natively supports 1Password 1PUX format, reducing manual cleanup
- Evaluate Vaultwarden vs. self-hosted Bitwarden based on your server resources — Vaultwarden runs on a Raspberry Pi, Bitwarden server needs more RAM
- Test browser extension functionality for saved form fills before decommissioning 1Password — some complex login flows require manual configuration
- Migrate team members in cohorts rather than all at once to catch sharing permission gaps early
Which alternative should you pick?
Replacing 1Password isn't a single call — it's a trade between license terms, team size, and how much early-stage roughness you can absorb. The 3 projects above split along those lines:
- You want the project with the most GitHub stars in this list → vaultwarden. 68,677★ — the most of the 3 projects here. Stars measure attention, not quality or maintenance; check the last-push date and the Editor's take before reading more into it.
- You want the project with the most recent push activity → server. Last push 2026-10-08 — the freshest activity in this list.
License & commercial-use notes
When replacing 1Password, the license usually decides more than the feature list — whether you can modify it, ship it inside a product, or host it as a service. The 3 projects here fall into:
- Strong copyleft (keepassxc) — GPL / EPL — distributing a derived work obliges you to release its source under the same terms. Fine for internal use; plan carefully before proprietary distribution.
- Network copyleft (vaultwarden, server) — AGPL / SSPL — the copyleft trigger extends to offering the software over a network, so a hosted deployment of a modified version can oblige you to publish your changes. Read the exact terms before building a paid hosted product on these.
Split licences: keepassxc (GPL-2.0 OR GPL-3.0); server (AGPL-3.0 + Bitwarden License v1.0 (bitwarden_license/ only)). These projects are grouped above by the core licence; the separately licensed directories (enterprise or EE parts) are not covered by that bucket — check which files you actually ship.
License fields come from the GitHub API's SPDX classification and can lag a relicense. Where the API returned no SPDX id, the license marked † was read from the repository's LICENSE file on 2026-09-05; the † links to the exact file and commit we read. The repository linked on each card is authoritative — confirm its LICENSE file before any license-sensitive deployment.
Maintenance health of these 3 projects
Of the 3 projects listed, 3 shipped at least one commit in the last 12 months. See how we rank for the full criteria and our self-hosting cost reality check, which apply across every comparison on this site.
Frequently asked questions
How do these 3 alternatives compare on maintenance health?
3 of 3 have shipped a commit in the last 12 months. At least one project here has 5,000+ GitHub stars. Always check the last-pushed date in the cards above and read the latest closed issues — those two signals are the fastest public check we know of.
How this page was compiled
- Repository facts (stars, license, language, last push) come straight from the GitHub public API and are linked on each card as the primary source. Where the API returned no SPDX id, the licence marked † was read from the repository's
LICENSEfile (linked, pinned to the commit we read, with the date checked). - Editorial analysis (the intro, comparison notes and migration tips) is Claude-drafted from 1Password's use case and the alternatives' repository metadata — in Claude Code sessions or scheduled routines run under the operator's account. Samples are spot-checked against the upstream repositories; entries are not individually reviewed unless they carry a signature. See what Claude drafts and what the operator writes.
- Editor's take is signed by Yusuke Morinaga. It was drafted in a Claude Code session the operator ran, then read and confirmed by Yusuke Morinaga before publication, and carries the date it was last revised. It is written from each project's README, LICENSE, release history and issue tracker — not from running the project in production; where that distinction matters, the take says so.
- Maintenance signal: 3 of 3 projects shipped a commit in the last 12 months as of the latest rebuild (most recent activity: ).
- Last editorial review: by Yusuke Morinaga.
- Spotted an error? Email [email protected] with the page URL (subject prefix
[correction]) — we ship corrections within 14 days.