Padloc is an open-source, end-to-end encrypted password manager for Windows, macOS, Linux, iOS, Android, and major browsers that keeps passwords, credit cards, notes, and documents in vaults only the owner can read. It serves individuals, families, and teams that want transparent credential management with secure sharing and the choice between Padloc cloud sync and Docker self-hosting. Its appeal is audited transparency: an AGPL-3.0 codebase reviewed by three independent security groups, with unlimited items and devices on every plan.[1][2]
Quick verdict
Padloc suits individuals, families, and small teams that want an audited open-source vault with sharing, sync, and self-hosting flexibility. Its strength is end-to-end encrypted storage for many data types with unlimited items and devices, a built-in authenticator, and Docker-based self-hosting from an AGPL-3.0 codebase. The tradeoff is a smaller ecosystem than the biggest rivals: offline behavior is undocumented, there is no confirmed public API or SSO, and advanced team features sit on paid tiers. If transparent encryption with sharing and hosting choice decides for you, choose Padloc; if offline-first simplicity matters most, choose KeePassXC.[1][2][3]
Key features
End-to-end encrypted vaults Passwords, credit cards, notes, documents, and license keys are stored end-to-end encrypted so only the key holder can read them, with cloud sync across devices.[1]
Many clients, one vault Native apps for Windows, macOS, Linux, iOS, and Android plus Chrome and Firefox extensions and a web app share the same encrypted vaults from one account.[1]
Secure sharing and organizations Shared vaults let families, friends, and colleagues exchange sensitive data, with groups and permission management on the Team and Business tiers.[1]
Built-in authenticator and MFA One-time passwords are generated inside the vault and multi-factor authentication guards every plan, including the free Personal tier.[1]
Encrypted file storage Documents and files are stored encrypted up to plan quotas, from shared vaults on Personal to 20GB on Business and unlimited on Enterprise.[1]
Markdown notes and security reports Rich-text notes with markdown support sit beside logins, and security reports flag weak or reused credentials on every plan.[1]
Directory sync and provisioning Team and Business tiers offer directory sync with automatic provisioning, covering up to 10 groups on Team and 20 groups on Business.[1]
Open codebase and Docker self-hosting The AGPL-3.0 repository ships Docker server images with a compose file for self-hosting, and the project reports audits by three independent security groups, most recently Radically Open Security.[1][2]
Who will love it
Families sharing logins Households that share passwords and documents get shared vaults and a Family plan covering up to 5 users with straightforward sharing.[1]
Teams wanting hosted or self-hosted choice Groups that need shared vaults, groups, and provisioning can start on the Padloc cloud or run the Docker server themselves.[1][2]
Open-source buyers Shoppers who require an auditable AGPL-3.0 codebase with published independent audits get full transparency plus a free Personal tier.[1][2]
Who should avoid it
Offline-first minimalists People who want a vault with no cloud account should choose KeePassXC, since Padloc is presented around cloud sync and offline use is undocumented.[1]
Shoppers needing confirmed SSO or API Buyers whose purchase requires single sign-on or a public developer API should wait, as neither is confirmed in the inspected official sources.[1][2]
Enterprises needing stated data regions Organizations that must pin data to named regions get no vendor region statement here, so a rival with documented residency fits better.[1]
How the reports read
No inspected sample: the G2 reviews URL for Padloc returned HTTP 403 and the Reddit search endpoint returned HTTP 403 in this pass (October 2026), so no user reports could be read and the community section records the gap instead of a pattern.
1 cited community source. No Reddit or G2 user reports were inspected in this pass, so no community sentiment pattern is claimed. Statements below describe the evidence gap, not user opinion.
What the reports suggest No pattern is claimed: G2 and Reddit both returned access errors in this pass, so there is no inspected user sample to summarize, and the section stays a documented gap rather than a finding.[1]
Compatibility and migration
Client and server compatibility Desktop installers ship for Windows, macOS, and Linux from GitHub releases with Android, iOS, Chrome, Firefox, and web clients against the same account, and the server runs from Docker images with a compose file. Imports from rival managers are not documented in the inspected sources, so migration tooling stays unknown.[1][2]
Questions worth asking
What is the best Padloc alternative for non-technical users?
Bitwarden suits non-technical users better: its large hosted service syncs across devices with mature clients, while Padloc asks users to choose between cloud plans and Docker self-hosting. Bitwarden's free individual tier covers unlimited passwords and devices with the same ease. Users who specifically want Padloc's simpler plan structure and audited open codebase will still prefer Padloc.[1][2]
Is Padloc really no-code?
Yes for everyday use. The desktop, mobile, browser, and web apps are fully graphical: creating vault items, sharing, and enabling MFA need no code. Setup means installing an app and creating an account, both covered by the official site without scripting. Docker self-hosting is the only path needing operational skill, and it is optional.[1]
How much does Padloc cost per month?
Personal is free at $0 per month with unlimited vault items and devices. Premium costs $3.49 per month or $34.90 per year, Family costs $5.95 per month or $59.50 per year, Team costs $3.49 per month or $34.90 per year, and Business costs $6.99 per month or $69.90 per year, with Enterprise priced on request. Pricing was checked against the official site in October 2026; a free licence does not cover hosting or support choices.[1]
Can you self-host Padloc?
Yes: the padloc/padloc repository ships server Docker images with a docker-compose.yml, so operators can run the Padloc server themselves. The technical docs server section is currently a TBD stub, so deployment detail comes from the repository rather than a hosting guide. A repository alone never proves a supported setup, and managed-cloud plans remain the documented no-operations path.[1][2]
Sources and editorial review
Source research. Reviewed on October 12, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
No inspected sample: the G2 reviews URL for Padloc returned HTTP 403 and the Reddit search endpoint returned HTTP 403 in this pass (October 2026), so no user reports could be read and the community section records the gap instead of a pattern. No Reddit or G2 user reports were inspected in this pass, so no community sentiment pattern is claimed. Statements below describe the evidence gap, not user opinion.
- Padloc official site
official · Observed October 12, 2026
Official site presenting Padloc as an open-source, end-to-end encrypted password manager across desktop, mobile, browsers, and web, with cloud sync, sharing, three independent audits, and Personal through Enterprise plans with stated prices. Read October 2026.
- Padloc technical docs
official · Observed October 12, 2026
Official technical docs index linking reference, server, apps, development, and security whitepaper sections; the server section is a TBD stub. Read October 2026.
- padloc/padloc repository
official · Observed October 12, 2026
Repository padloc/padloc describing a modern open-source password manager for individuals and teams, listing Dockerfile-server, Dockerfile-pwa, and docker-compose.yml. Read October 2026.
- padloc/padloc LICENSE text
official · Observed October 12, 2026
Repository LICENSE file containing the GNU Affero General Public License version 3 text. Read October 2026.
- Padloc discovery lead page
official · Observed October 12, 2026
Discovery lead page linking the official site and padloc/padloc repository, recording AGPL-3.0 and positioning against LastPass, Keeper, and 1Password. Read October 2026.
- Padloc community access attempts (blocked)
community · Observed October 12, 2026
G2 reviews URL for Padloc returned HTTP 403 and the Reddit search endpoint returned HTTP 403 in this pass, so no community user reports could be inspected. Read October 2026.
Compared with these products
No explicit proprietary baseline is recorded.