Security and privacy decision
Dashlane
A narrow self-hosted replacement (browser extension + detection API + admin dashboard + basic encrypted vault) is buildable by a small team, but you cannot recreate Dashlane's proprietary phishing model, confidential-computing zero-knowledge infrastructure, enterprise polish, or compliance/certifications without significant effort and resources.
Visit website↗Open-source builds that already do this
Every project below is open source and already does this job today. Fork one, self-host it, or take the parts you need — the build prompt further down assumes an empty file, and this is the shortcut past that. Licences differ; check the one on each card before you ship.
What a replacement has to do
- Detect risky/compromised credentials and phishing in the browser, alert users, and surface organization-wide risk to an admin dashboard for remediation.
What it still won’t have
- Dashlane's proprietary AI phishing model and its training data
- Enterprise-grade confidential-computing / zero-knowledge infrastructure and certifications
- Polish, monitoring, and scale of a commercial SaaS (uptime SLAs, support, onboarding)
What remains hard
- Proprietary models
First-year cost
Keep paying
Paying is—cheaper in year one.
On cash alone, building overtakes the subscription at 42 seats.
Money you would actually spend
Time you would spend
—
What you would spend
What we assumed
The verdict above measures whether you could build it. This one is only about money.
Runnable build prompt
Build a minimal Dashlane-like credential protection service using Node.js (Express) backend, PostgreSQL, and a browser extension (Chrome/Chromium). In scope: (1) a browser extension that captures current page URL and basic DOM attributes when a user focuses login fields and sends them to a detection API; (2) a detection API that applies heuristics plus a small open-source model (or rule set) to classify phishing risk and returns alert text; (3) a simple admin dashboard (React) that ingests alerts, displays per-user and per-domain risk lists, and exposes a webhook forwarder to send events to a SIEM (Splunk or generic webhook); (4) user vault storage with client-side encryption (zero-knowledge key derivation from a user passphrase) and endpoints to store/retrieve encrypted entries; (5) logging, error handling, and test coverage for all endpoints and extension messaging. Out of scope: training proprietary ML models at scale, confidential-computing deployments, enterprise onboarding automation, and large-scale telemetry pipelines. Require: deploy scripts (Docker Compose), automated tests, input validation, rate-limiting, and documented security assumptions.
How we checked
How the score was reached
- Pay verdict base20
- An open-source build was found+5
- 5 cited sources+3
- 3/3 assessment runs agreed+4
- Hard moats found in the evidence-3
- Evidence score29
The base comes from the verdict. Everything under it is a check that either happened or did not, and each one is a fact frozen in this record rather than a judgement made at render time — so the same evidence always produces the same number.
How scoring works →Cited sources · 5
Every page the run actually retrieved.
- official productDashlane homepage
- official pricingDashlane pricing
- official docsDashlane Credential Protection
- open sourcekeepassxreboot/keepassxc
- open sourcepassbolt/passbolt_api
Integrity checks
What held up, and what did not.
