Enpass

Enpass
Developer	Enpass Technologies Inc.
Operating system	Windows, Windows Phone, macOS, Linux, ChromeOS, iOS, Android, Wear OS, WatchOS
Platform	Chrome, Safari, Edge, Firefox and Brave
Type	Password manager
License	Freemium
Website	enpass.io

Enpass is a freemium password manager and passkey manager from Enpass Technologies, available for MacOS, Windows, iOS, Android and Linux,¹ with browser extensions for all major browsers,²³ and pricing plans for both personal use and business.⁴⁵⁶

Enpass stores and syncs encrypted password vaults on users’ personal cloud accounts, or within a business's internal cloud infrastructure, ²⁷⁸ as opposed to keeping vault data on company servers.⁹¹⁰ The app is designed to comply with data sovereignty and data security regulations such as GDPR.¹¹

Features include¹²¹³¹⁴:

• Multiple vaults and vault sharing
• Customizable categories, tags, and data fields
• Customizable random password generation
• Biometric authentication
• Autofilling of login credentials, payment methods, and online forms
• Management of passkeys and two-factor authentication codes (TOTP) ¹⁵
• Password security auditing and breach monitoring ¹⁶
• Client-side encryption, using SQLCipher¹⁷ with a user-defined master password

Enpass vaults are usually stored on Google Drive, Box, Dropbox, OneDrive, iCloud, or on business's Microsoft 365 or Google Workspace storage. Enpass also supports self-hosted WebDAV solutions such as ownCloud and Nextcloud, as well as storing data on device and syncing via via Wi-Fi or folder sync.¹⁸¹⁹²⁰

Enpass is available in four editions: Personal, Family, Business, and Enterprise.²¹²² The Business and Enterprise plans include administrative controls, identity provider integration, security audit tools, security event logging, access recovery, and password-less vault sharing between invited co-workers.²³

The entire database is protected using AES-256 encryption. SQLCipher is used to technically implement the AES-256 encryption.²⁴

In addition, the encryption key is derived from the master password using PBKDF2-HMAC-SHA512 with 320,000 iterations, which makes brute-force attacks extremely difficult.²⁴

Enpass provides official security whitepapers²⁵ that explain the security architecture and encryption methods in more detail. These whitepapers are available for download on the Enpass website and are part of the official documentation on security and encryption.

A 2024 study by Hutchinson et al. examined the “password checkup” features of 14 password managers, including Enpass, using weak, breached, and randomly generated passwords. The authors found that the evaluated products reported weak and compromised passwords inconsistently and sometimes incompletely. No manager successfully flagged all known breached passwords. The study concludes that such inconsistencies may give users a false sense of security.¹⁶

Security researcher Marek Tóth presented a vulnerability in browser extensions of several password managers, including Enpass, at DEF CON 33 on August 9, 2025. In their default configurations, these extensions were shown to be exposed to a DOM-based extension clickjacking technique, allowing attackers to exfiltrate user data with just a single click.²⁶ The affected password manager vendors were notified in April 2025. According to Tóth, Enpass version 6.11.6 (released August 13, 2025) addressed this issue.²⁷