Enpass

Is Enpass safe?

Mostly, yes, especially if you want your vault kept away from a password company's servers. Enpass encrypts everything on your device and keeps the file there or in a cloud account you already own, so a breach at Enpass could not hand over your passwords. We score it 81/100, just behind NordPass and RoboForm (both 82).

The weaker part is openness. The code is closed. In 2025 Enpass took down the page listing its outside audits, and its privacy notice says the apps use no analytics while both app stores say they do.

Where Enpass keeps your passwords

This is what makes Enpass different. Most hosted managers, such as 1Password or Bitwarden, keep an encrypted copy of your vault on their servers. Enpass says it does not: your data stays on your device unless you sync it through iCloud, Google Drive, OneDrive, Dropbox or a WebDAV server. Each device downloads the encrypted file, decrypts and merges changes locally, then uploads it again, so the cloud only ever stores scrambled data.

The vault is a SQLCipher database encrypted with 256-bit AES. Your master password, plus an optional key file, is stretched with 320,000 rounds of PBKDF2-HMAC-SHA512. That is above the 220,000 rounds the security project OWASP recommends for this method, though it is still an older approach than the Argon2 used by KeePass apps.

The trade-off is that security partly moves to you. Anyone who gets into the cloud account that holds your vault still faces the encryption, but only your master password stands in their way.

Audits, flaws and a vanished page

Enpass has had more outside testing than many small rivals. The Berlin firm Cure53 tested the Windows app in May and June 2022 and reported a "positive impression": two low-rated memory bugs and some hard-coded encryption material, but nothing critical or high. The same project found a high-rated licence bypass in the business system, and a 2023 Cure53 test of Enpass Hub, the business sharing server, found a high-rated way to steal vault keys through the recovery feature. VerSprite tested the Windows and Android apps in 2018.

Until 2025 Enpass listed all four reports on its website. Users noticed in August 2025 that the page had gone, and an Enpass staff member replied that audit reports would come back on a new Trust Center. As of October 2026 that Trust Center offers ISO 27001 and 27701 certificates and a SOC 3 summary, but none of the penetration test reports, which are still on Enpass's download server.

Flaws have turned up between audits. In 2024 the US vulnerability database recorded CVE-2024-26362, which let a crafted note run HTML in the Windows and Linux desktop app 6.9.2, and a minor issue that left data in memory, fixed in 6.10.1. In April 2025 researcher Marek Tóth told Enpass that a malicious page could trick its browser extension into filling data with one click; Enpass fixed it in extension 6.11.6 on 13 August 2025, four days after he presented the research. The extension's one-minute auto-lock limited the risk. Enpass takes bug reports by email and credits finders, but pays no bounty.

What Enpass collects

Apple's label lists your name, email address, user ID, device ID and product interaction, all linked to you and used for analytics and app functions, with nothing used for tracking. Google Play shows a similar list and says nothing is shared.

The privacy notice, effective 11 July 2025, says Enpass collects only your name and email, but its own list of device data goes further: install ID, IP address, device name and country, which features you turn on and the size range of your vault. It also says "We do not use analytics in our apps", which matches neither the store labels nor its own device-data section, where that data is gathered "to analyze apps usage". And it allows Enpass to share your details with its subprocessors so they can tell you about their own products. Your vault contents are never part of this.

How to use Enpass safely

1. Pick a long master password you use nowhere else. Enpass cannot reset it.
2. Add a key file for extra protection, and never keep it in the same cloud folder as the vault.
3. Turn on two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary sign-in for the cloud account that stores your vault.
4. Keep an offline backup of the vault, since Enpass holds no copy.
5. Keep the desktop app and extension updated to get the 2024 and 2025 fixes.

How we scored it

Privacy (82) gains from keeping vaults off Enpass servers and loses for a store label and notice that collect more account and device data than rivals such as Keeper. Security (79) balances strong local encryption and real audits against high-rated findings in the business parts, several desktop and extension flaws and no bug bounty. Transparency and control (77) is the weakest factor: closed code, the removed audit page and the analytics contradiction. For a local vault with open code, see KeePassXC.