Security and privacy decision
Keeper
A technically capable developer can build a usable personal zero-knowledge password vault and browser autofill in-house, but reproducing Keeper’s enterprise PAM features, certifications (FedRAMP/FIPS), AI-driven threat detection and polished cross-platform apps is impractical for a small team.
Visit website↗Open-source builds that already do this
Every project below is open source and already does this job today. Fork one, self-host it, or take the parts you need — the build prompt further down assumes an empty file, and this is the shortcut past that. Licences differ; check the one on each card before you ship.
What a replacement has to do
- Store encrypted records in a zero-knowledge vault, generate and autofill passwords in the browser, sync encrypted vaults across devices, securely share individual records with another user
What it still won’t have
- Enterprise PAM features (session recording, remote browser isolation, agentless privileged sessions)
- FedRAMP/GovRAMP, FIPS and other formal certifications
- KeeperAI threat detection and automated risk responses
- Large-scale compliance reporting, SIEM integrations and audited logs at enterprise scale
- Polished multi-platform native mobile apps and managed 24x7 support
What remains hard
- Compliance and regulation
FedRAMP High Certified security for your organization
- Compliance and regulation
Leading certifications and compliance ISO 27001, 27017 and 27018 SOC 2 FedRAMP High Certified GovRAMP
- Brand trust
93,000+ business customers
First-year cost
Keep paying
Paying is—cheaper in year one.
On cash alone, building overtakes the subscription at 4 seats.
Money you would actually spend
Time you would spend
—
What you would spend
What we assumed
The verdict above measures whether you could build it. This one is only about money.
Runnable build prompt
Build a minimal zero-knowledge personal password manager using React (web UI + browser extension), Node.js + Express REST API, Postgres for metadata, S3-compatible object storage for encrypted blobs, WebCrypto for local encryption (AES-GCM, PBKDF2 or Argon2), and Docker for deployment. In scope: local vault encryption/decryption, account creation with client-side key derivation, record CRUD, password generator, browser extension autofill/login capture, server sync of encrypted blobs, basic record-sharing by encrypting records for recipient public keys, user-facing search, and a small admin UI for backups. Out of scope: mobile native apps, FedRAMP/FIPS certification, privileged session recording, remote browser isolation, and advanced enterprise integrations. Require input validation, retry and error handling for network calls, access-control checks on the server, unit tests for crypto and API layers, and end-to-end tests for the browser extension autofill flow.
How we checked
How the score was reached
- Partly verdict base52
- An open-source build was found+5
- 5 cited sources+3
- 3/3 assessment runs agreed+4
- Hard moats found in the evidence-3
- Evidence score61
The base comes from the verdict. Everything under it is a check that either happened or did not, and each one is a fact frozen in this record rather than a judgement made at render time — so the same evidence always produces the same number.
How scoring works →Cited sources · 5
Every page the run actually retrieved.
- official productKeeper Security | Identity Security for Humans, Machines and AI Agents
- official pricingFamily Password Manager - Keeper Security
- official docsKeeper Security Features for Passwords, Secrets and Access
- open sourcekeepassxreboot/keepassxc
- open sourcepassbolt/passbolt_api
Integrity checks
What held up, and what did not.
