The short answer. MacPass and Keeweb are the KeePass clients: a local encrypted database in an open format, which means the file outlives the app. Keyzer is the simple one that saves portable password files. SafeInCloud is the cross-platform manager with its own sync, which is local-first but not file-based in the same way. NoxKey is the different one: API keys and tokens in the Keychain with Touch ID, which is a developer secret store rather than a password vault. The dividing question is whether the secret is a password a human types or a token a program uses, because the second has different requirements — rotation, scoping and a place in a build pipeline.
This guide covers 5 local secret managers for macOS. Every fact below is drawn from the same verified records that back each app’s own page. The recommendations are our editorial judgment, not payment.
Quick comparison
| App | What it is | Pricing | Licence | Version |
|---|---|---|---|---|
| Keeweb | security tool | Open source | not published | 1.18.7 |
| Keyzer | security tool | not published | not published | — |
| MacPass | security tool | Open source | not published | 0.8.2 |
| NoxKey | security tool | Open source | not published | — |
| SafeInCloud | security tool | not published | not published | 25.3.5 |
What actually decides this
- Password or token. A password is entered by a person and reused across a login. A token is pasted into a config file and rotated on a schedule. A vault designed for the first is awkward for the second, and a Keychain-backed store is not a password manager.
- Whether the format is open. A KeePass database can be opened by several applications on several platforms. A proprietary vault can be opened by one. For a file you will need in ten years, the open format is the whole point of the category.
- Where the file syncs. A database in a folder you already sync is simple and has conflict risk. A built-in sync service is convenient and depends on the vendor. Two devices editing the same file is the failure mode to plan for.
- What the unlock is. A master password, a key file, Touch ID or a combination. The second factor is often a file that must be backed up separately, and losing it is the same as losing the vault.
- Whether it can fill a password field. A vault that requires a copy and paste is used less often, which is a security problem in itself. Browser integration and auto-type are what make a local vault practical for daily logins.
- Whether the app is still being maintained. A vault is a format plus a reader, and the reader has to keep up with the operating system. An abandoned client on a new macOS release is a database you can still see and cannot open. Checking the last release date matters more here than in any other category, because the file is the thing you cannot replace.
Our picks
- MacPass — Its record describes an open-source KeePass client for macOS, which is the native case. Choose it when you want a native KeePass client on the Mac.
- Keeweb — Its record describes a free, cross-platform manager compatible with KeePass, which is the cross-platform case. Choose it when you want to open the same database on several platforms.
- Keyzer — Its record describes a simple manager that saves portable password files, which is the minimal case. Choose it when you want a simple portable password file.
- SafeInCloud — Its record describes cross-platform password management at a low cost, which is the sync case. Choose it when you want cross-platform sync without a subscription.
- NoxKey — Its record describes a Keychain-based secret manager for API keys and tokens with Touch ID, which is the token case. Choose it when the secrets are API keys rather than passwords.
The apps
Keeweb
Keeweb is a security tool for macOS. Free, cross-platform password manager compatible with KeePass. It is open source.
What it does. Free cross-platform password manager compatible with KeePass.
Keeweb is listed with current version 1.18.7.
Full profile and verified facts for Keeweb →
Keyzer
Keyzer is a security tool for macOS. Simple password manager that supports saving portable password files. Its pricing is not published.
Full profile and verified facts for Keyzer →
MacPass
MacPass is a security tool for macOS. Open-source KeePass Mac OS client. It is open source.
MacPass is listed with current version 0.8.2.
Full profile and verified facts for MacPass →
NoxKey
NoxKey is a security tool for macOS. Keychain-based secret manager for API keys and tokens with Touch ID. It is open source.
Full profile and verified facts for NoxKey →
SafeInCloud
SafeInCloud is a security tool for macOS. Cross Platform password management, low cost app! Its pricing is not published.
What it does. No more hacks and forgotten passwords. Safe securely stores them and helps you log in with one click.
SafeInCloud is listed with current version 25.3.5.
Full profile and verified facts for SafeInCloud →
How to choose
- No licence fee, source available. Keeweb, MacPass and NoxKey — the source can be read and, under the terms of each licence, reused.
- Pricing not published in our data. Keyzer and SafeInCloud — check the developer’s own site before assuming anything about cost.
Open source: Keeweb, MacPass and NoxKey (3 of 5).
Common mistakes
- Storing API tokens in a password vault and pasting them into config files by hand.
- Losing the key file and assuming the master password is enough.
- Syncing a database through a service that resolves conflicts by overwriting.
- Choosing a proprietary vault for an archive you expect to keep for a decade.
- Picking a client that has not shipped a release since the last major macOS version.
How this guide was put together
Each app’s facts come from its own record: the developer’s own pages and repository, the App Store listing where one exists, and the documentation, each with a source grade and an access date. Where a fact rests on the developer’s own statement rather than on something we verified independently, the sentence says so. Where our data has no value for something, the guide says “not published” instead of guessing.
A price appears here only where the record carries one from a stated source; the guide never estimates one, and it records the pricing model alongside so the two can be read together. Prices change and vary by region, so each app links to its own page for the current detail.
The facts and the recommendations are kept apart on purpose. Everything in the app entries, the comparison table and the answers above is composed from the records. The short answer, the criteria and the picks are our editorial judgment: they reflect what we would choose and why, and they are not paid for. Where we make a recommendation we name the condition it applies under, because we do not call anything “the best” without explaining the criteria.
Frequently Asked Questions
How do I choose between these local secret managers?
There is no single answer — it depends on what you need. This guide covers 5 local secret managers: Keeweb, Keyzer, MacPass, NoxKey and SafeInCloud. They differ mainly in pricing model, licence and the trade-offs each one carries. Pick by the trade-off you care about rather than by rank.
Are these local secret managers free?
Pricing across this group: open source (Keeweb, MacPass and NoxKey) and not published (Keyzer and SafeInCloud). Where we list pricing as not published, the developer does not state a model we could verify — check their own site before assuming anything about cost. We quote a price only where the record carries one from a stated source, and we never estimate one. Prices change and vary by region and by store, so always check the developer’s own page for the current figure.
Which of these local secret managers are open source?
Keeweb (not published), MacPass (not published) and NoxKey (not published) are open source.
Do these local secret managers support Apple Silicon?
Our data does not carry an explicit Apple Silicon statement for any app in this group, so we do not claim one. The absence of a statement is not the same as the absence of support.
How do I choose between them?
Start with how you pay: the guide groups these apps by pricing model, because the budget is the constraint most people actually have. Then check the trade-offs listed for each app: the limitations are the part that decides most people’s choice, because they describe what the app will not do for you.
