Cloud password managers ask you to trust a server. TuaPass asks you to keep a folder. Here's the comparison, point by point, without slogans.
Trust in a password manager isn't bought with a padlock on the homepage. It's earned by answering three uncomfortable questions.
Where the files live, when the computer is off?
Who can derive the key, besides you?
What's left to steal, if someone enters from the provider's side?
Almost all serious products use AES-256 and claim to be "zero knowledge". The real difference is the model: provider's cloud, local file, or in TuaPass's case, your folder, encrypted, no account.
This article compares TuaPass with Bitwarden, 1Password, Proton Pass, LastPass, KeePassXC, and Google's password manager. Competitor data is from public sources as of 2026. TuaPass data comes from the product: Argon2id, AES-256-GCM, folder-based vault, no server holding vaults.
The point others can't copy
TuaPass has no vault cloud. There's no TuaPass account. There's no database of yours with your encrypted passwords. The only network call to us is update verification (a JSON with version and, if you accept, an MSI with SHA-256 hash).
If a judge, an attacker, or a rogue employee asked "hand over the users' vaults", the honest answer is: we don't have them.
Cloud managers (official Bitwarden, 1Password, Proton Pass, LastPass) encrypt locally and send a copy to their server. It's convenient. It's also a single target: millions of vaults in the same place. LastPass, in 2022, showed what happens when that place gets copied: encrypted vaults leak, plaintext URLs help pick targets, and weak master passwords — or a too-light KDF on old vaults — become a problem for years, not days.
TuaPass isn't "immune to attacks". It's immune to that type of attack. Your risk remains the PC, the backup, the emergency kit, the master password. Not our datacenter.
Three architectures, three bets
Provider's cloud. Works on phone, tablet, and browser without you thinking about storage. In exchange you accept an account, a jurisdiction, a recovery policy, and the fact that someone keeps a copy. Bitwarden and Proton Pass mitigate with open code and audits. 1Password adds a 128-bit Secret Key the server doesn't have. LastPass has already paid the price in the news.
Single local file (KeePass / KeePassXC). Data is yours. No vendor honeypot. The practical price: a .kdbx put in Dropbox or OneDrive, touched by two PCs, produces conflicts. KeePassXC wins on verifiable trust (open source, community, audits). Loses on the real life of someone who already has a file cloud and two computers.
TuaPass folder. Same philosophy as KeePass — files on your disk — with a format designed for third-party services. Every modification doesn't overwrite a database: it writes a new, immutable operation file, already encrypted (*.op.enc). Dropbox copies distinct objects; TuaPass reassembles them in memory. We don't ask for a second cloud. We ask you to use the one you already have.
Comparison table
Criterion | TuaPass | KeePassXC | Bitwarden | 1Password | Proton Pass | LastPass | Google Password Manager |
|---|---|---|---|---|---|---|---|
Where the vault lives | Folder on your disk, NAS, or cloud you choose | Local | Bitwarden server (or self-host) | 1Password cloud | Proton cloud | LastPass cloud | Google account |
Provider account | No | No | Yes (official cloud) | Yes | Yes | Yes | Yes |
Vendor has a copy | No | No | Yes, encrypted | Yes, encrypted | Yes, encrypted | Yes, encrypted; already exfiltrated | Yes |
KDF | Argon2id (64 MiB, 3 iterations) | Configurable Argon2 | Argon2id or PBKDF2 | PBKDF2 + Secret Key | Argon2id | PBKDF2 (historically weak on old vaults) | Proprietary |
Encryption | AES-256-GCM | AES-256 / ChaCha20 | AES-256 + HMAC | AES-256-GCM | AES-256-GCM | Classic AES-256-CBC | Proprietary |
Password recovery from vendor | Impossible | Impossible | No backdoor; optional Emergency Access | No: Secret Key also required | Proton recovery codes | Account-based flows | Google account recovery |
Sync across PCs | Your storage; anti-conflict format | DIY; single file, conflict risk | Cloud or self-host | Cloud | Cloud | Cloud | Google account |
Browser extension | Local only, signed native host | Plugin / local proxy | Yes, via service | Yes, via service | Yes, via service | Yes, via service | Integrated in browser |
Biometrics | Windows Hello; keys only on that PC | Depends on OS / plugin | Yes | Yes | Yes | Yes | Yes |
TOTP (2FA codes) | Yes | Yes | Yes | Yes | Yes | Yes | Limited |
Passkeys for sites | Not yet | Limited | Yes | Yes | Yes | Yes | Yes |
Open source | No | Yes | Yes | Partial | Client yes | No | No |
Published third-party audit | Not published | Community / audits | Yes, recurring | Yes | Yes | After incidents | Google internal processes |
Mass theft from vendor | No honeypot | No honeypot | None known on vaults | None known on vaults | None known | 2022: backups stolen | Depends on account |
The row that matters for trust isn't "AES-256". Almost all have it. The row that matters is "vendor has a copy".
What TuaPass actually does
Not a buzzword list. It's what the application does on your Windows.
The key. From the master password (minimum 12 characters on creation) TuaPass derives 32 bytes with Argon2id, parameters aligned with OWASP guidelines: 64 MiB memory, 3 iterations. Argon2id costs RAM, not just CPU: a GPU brute-force attack becomes expensive. Data at rest is AES-256-GCM: encryption and integrity together. A wrong password doesn't "unlock a hash": it doesn't open the files.
No remote recovery. There's no "I forgot my master password, send a link". There's an emergency kit: the vault key in printable form, to keep offline and away from the vault folder. TuaPass refuses to save it in OneDrive, Dropbox, Google Drive, or inside the vault itself. Who has the kit and the files opens everything. Who has only the files, doesn't.
Windows Hello. Biometric unlock is a shortcut on that computer. The key wrap sits in Windows local data, not in the folder you sync. The third-party cloud doesn't receive fingerprints, faces, or PINs.
Daily use. UI lock and vault lock after inactivity. Clipboard: copied password disappears after 30 seconds, doesn't enter Windows Clipboard History and doesn't go to cloud clipboard. Unlock, list, edit, and kit windows are excluded from screenshots, Share, and GPU capture.
Browser. The extension talks to TuaPass on your PC (named pipe, current user only). The native host must be started by Chrome, Edge, Firefox, or Brave, and — in signed installation — have the same Authenticode public key as TuaPass.exe. The site you visit doesn't see the vault. We don't receive URLs, titles, or passwords.
Updates. You download an MSI from an allowed URL. If the SHA-256 hash doesn't match, the file is discarded. It's the only exception to the "TuaPass doesn't call home" rule.
Honesty: where TuaPass isn't ahead
A comparison that wins on every checkbox is marketing, not trust.
We're not open source. Bitwarden and KeePassXC can be read and audited by anyone. We can't, today. Who demands public code is right to prefer them.
We don't have a published third-party audit. We'll say so when there is one, not before.
We don't manage site passkeys yet. Cloud managers are ahead on this.
We were born on Windows. Who lives across iPhone, Android, and three browsers simultaneously finds a cloud service more convenient.
If you lose master password and kit, data is gone. It's the price of "no one can help them". It's not a slogan: it's your responsibility, and we say it during vault creation.
Malware on an unlocked PC reads passwords. True for TuaPass, KeePass, and 1Password. No software lock beats an already-compromised system.
Trusting TuaPass doesn't mean believing DEV74 is infallible. It means the damage from our compromise doesn't include your vaults, because they don't transit through us.
Who it's for, who it's not
TuaPass fits who already has Dropbox, OneDrive, a NAS, or a USB stick; who doesn't want a second subscription to open their own passwords; who works on multiple Windows PCs and has seen a "conflicted file"; who, after LastPass, decided that "encrypted copy on provider's server" isn't enough.
It fits less who wants passkeys everywhere, family sharing with roles, or the certainty of open source. For those, Bitwarden or KeePassXC remain honest answers. We don't fight them by inventing audits. We differentiate on the fact that files stay yours, without our account, and without breaking in sync.
TuaPass Standard is a perpetual and free license: install, use, keep. No recurring fee to keep reading a folder that's already on your disk.
Password managers ask for trust. TuaPass asks you to keep the files. It's the difference that still stands when the next provider hits the news.
Leave a Comment