European alternatives to 1Password.

1Password is the most widely-adopted password manager for individuals, families, and small-to-mid-size teams, and it is operationally US-headquartered (AgileBits, Inc., Toronto and San Francisco) with US sub-processors and US-based venture capital. The cryptographic design (Secret Key plus zero-knowledge encryption) means the vendor cannot decrypt vault contents even when served with a US legal order, which is genuinely strong protection on its own terms. What still sends European buyers looking elsewhere is corporate ownership and vendor location rather than the cryptography, so this page checks four European alternatives against who legally owns the company, where the data physically sits, whether the vault is end-to-end encrypted, and whether the platform holds a recognised European compliance framework (ISO 27001, BSI C5, EUCS, SecNumCloud). Where EU-vendor preference is written procurement policy, the alternative search follows that policy rather than any technical compliance gap.

Before you move a single credential across: Passbolt is the strongest team-password-management pick with open-source code base and Luxembourg hosting (Luxembourg, Belvaux, EU-owned, EU-hosted, CLOUD Act exposure: None), Proton Pass is the smoothest individual-and-family alternative with the strongest privacy-flavoured ecosystem (Switzerland, Geneva, Swiss-owned, EU-hosted, CLOUD Act exposure: None), and Psono is the most self-hostable choice for organisations wanting maximum sovereignty (Germany, EU-owned, EU-hosted, open source + commercial cloud).

Most of what makes 1Password usable day to day survives the move intact:

• End-to-end encryption with zero-knowledge architecture; every alternative ships this as the default.
• Browser autofill across Chrome, Firefox, Safari, Edge. Proton Pass and Psono have polished extensions.
• Mobile apps with biometric unlock on iOS and Android.
• Password generation with customisable rules.
• Secure notes for non-credential secrets.
• 2FA / TOTP storage as part of the password entry.
• Vault sharing with role-based access.

A shorter list of things that do not yet carry over:

• 1Password Watchtower (the breach-monitoring and password-health-scoring feature). Proton Pass and Passbolt have basic password-health checks; the breach-monitoring feature is not yet at 1Password's depth.
• 1Password's Travel Mode (selectively hide vaults when crossing borders). No European alternative ships this specific feature; the workaround is to use separate vaults for travel-sensitive data and configure auto-sync exclusion.
• 1Password Developer Tools (SSH key handling with platform-native integration, CLI for secrets in scripts). Passbolt has a CLI; the SSH-key UX is not yet at parity.
• 1Password's brand recognition and the polished marketing material. European alternatives have less consumer-facing polish but the security model is comparable or stronger.

Moving a vault safely takes five steps, in this order.

1. Export your 1Password vault. In the 1Password desktop app, File → Export → All Items gives you the choice of 1pif (full fidelity) or CSV. Take both: 1pif preserves item types and metadata, while CSV is the import format most European alternatives accept. Encrypt the export file with a strong passphrase before storing it anywhere; export files contain plain-text credentials.
2. Audit which vault items are actually live. Most personal 1Password vaults have 200–500 items but the user actively uses 30–50. Use 1Password's "Last used" timestamp to identify the live set. For business vaults, the active set is typically larger but team-specific (engineering keys, third-party SaaS logins, customer-shared credentials).
3. Import into the new tool. Passbolt, Proton Pass, and Psono all accept CSV import. Passbolt's import preserves folder/category structure; Proton Pass imports into a single vault by default and requires manual re-organisation. For teams, plan to set up shared organisational vaults in the new tool before importing individual user vaults.
4. Migrate browser extensions and mobile apps. Install the new tool's browser extension across all team-member browsers and configure the mobile apps. Run both 1Password and the new tool in parallel for 2–3 weeks so users can adapt to the new autofill UX. The week-1 productivity dip is real; the second week is back to normal.
5. Keep 1Password active for 90 days minimum. A vault is the wrong place to be tidy: pause the old account rather than closing it outright. You will find a legacy item you forgot to migrate, a team-shared vault still accessed by a contractor, or a 2FA backup code stored only in 1Password. Pause the 1Password account at the lowest tier for 90 days, then export-and-delete completely after that period.