Keeper

Is Keeper safe?

Yes, for most people. Keeper encrypts your vault on your own device, collects less data in its iPhone app than almost any rival, and has no reported breach of user vaults. We score it 85/100, just behind 1Password (86) and Bitwarden (88).

What holds it back is how much you have to take on trust. The code is closed, the penetration test reports are not published, and the 2026 ETH Zurich study that tested other big password managers against a hacked server did not include Keeper. And when a journalist reported a flaw in 2017, Keeper's response was a lawsuit.

How Keeper protects your vault

Each vault is encrypted on your device with a randomly generated 256-bit AES key in GCM mode. Your master password is stretched with PBKDF2 using 1,000,000 iterations, which slows down anyone trying to guess it, and the result unlocks that key. Every record and shared folder has its own key, and items shared with other users are protected with public-key encryption. Keeper says the master password never leaves your device and that it has no way to decrypt vault contents.

Requests to Keeper's servers get an extra layer of AES encryption inside the normal TLS connection, as protection against interception. New devices need approval before they receive the encrypted data key.

PBKDF2 is the older choice here. Dashlane uses Argon2d, which is built to resist guessing on graphics cards. At 1,000,000 iterations Keeper is well above the 600,000 that LastPass and Bitwarden use by default, so this is a minor point.

Audits, certifications and bug reports

Keeper has the longest certification record among password managers. It says it has held SOC 2 Type 2 attestation for more than ten years, along with ISO 27001, 27017 and 27018. Its government cloud holds FedRAMP High and GovRAMP High authorisation, which required an assessment by an accredited third party and is renewed each year. Penetration tests run quarterly, with firms such as NCC Group and CyberTest.

These checks look at controls and processes, and their reports are shared with business customers rather than published. That is the gap compared with Bitwarden, whose code anyone can read, and 1Password, whose design was picked apart in public by ETH Zurich in 2026.

Outside researchers can report flaws through Keeper's public bug bounty on Bugcrowd, which has offered cash rewards since 2018. In 2025 researcher Marek Tóth showed that a malicious page could trick Keeper's browser extension, with hidden page elements, into filling in a saved login with one click and a 2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary code without any click; Keeper fixed it in version 17.2.0, before he presented the research in August 2025. The US vulnerability database lists one recent Keeper entry, CVE-2023-36266: a program already running on your computer could read passwords left in the memory of the desktop app and browser extension. Keeper disputes that this is a flaw, since such malware can read a logged-in session anyway, but changed the behaviour in version 17.2.

The 2017 flaw and the lawsuit

On 14 December 2017 Tavis Ormandy of Google Project Zero reported that the Keeper browser extension, which came bundled on some Windows 10 computers at the time, could be tricked by a malicious website into revealing a saved password. He noted it was close to a flaw he had reported in August 2016. Keeper released a fix on 15 December by removing the affected feature.

Ars Technica covered the flaw the same day under a headline saying Microsoft was "forcing users to install a critically flawed password manager". On 19 December Keeper sued Ars Technica's publisher and its security editor, Dan Goodin, in federal court in Chicago, claiming defamation and commercial disparagement. The defendants called it a suit meant to silence reporting. In April 2018 both sides agreed to dismiss the case with prejudice, each paying its own costs. A lawsuit is not a regulator finding, so we do not count it in the regulatory score, but it is worth knowing for a company whose product depends on outside researchers.

What Keeper collects

Apple's privacy label for Keeper is one of the shortest we have seen for a password manager: an email address and a user ID, linked to you and used only to make the app work. Nothing is listed as used for tracking. Google Play adds that device IDs are shared with another company for analytics, and the privacy policy says Keeper collects device type, operating system, a random device ID and your IP address, and that its websites use advertising cookies.

How to use Keeper safely

1. Pick a long master password you use nowhere else. Keeper cannot reset it for you.
2. Turn on two-factor authenticationTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, ideally with a security key or authenticator app.
3. Approve new devices only when you have just signed in on them yourself.
4. If you export your vault, use the encrypted KeePass format. CSV, JSON and PDF exports can be read by anyone who gets the file.
5. Be wary of emails asking you to sign in to Keeper. Open the app or type the address yourself.

How we scored it

The regulatory record (88) is the strongest factor: we found no fines or orders, but no regulator has examined the consumer app, so it stays below the 90s that 1Password and Bitwarden earn with public audits. Privacy (87) is next, helped by a very short App Store label. The weakest factor is transparency and control (82): closed code, unpublished audit reports and the 2017 lawsuit. Security (83) is held back by the lack of public outside testing of Keeper's design and by extension flaws, since fixed, rather than by any breach.