Every manager here encrypts your vault on your device. What differs is what the server learns at login, and what happens when quantum computers arrive.
| Feature | Icosahedron | 1Password | Bitwarden | Dashlane | LastPass | NordPass |
|---|---|---|---|---|---|---|
| End-to-end encrypted vault the vendor cannot readTable stakes, and every one of them clears it. | Icosahedron: Yes — End-to-end encrypted vault the vendor cannot read | 1Password: Yes — End-to-end encrypted vault the vendor cannot read | Bitwarden: Yes — End-to-end encrypted vault the vendor cannot read | Dashlane: Yes — End-to-end encrypted vault the vendor cannot read | LastPass: Yes — End-to-end encrypted vault the vendor cannot read | NordPass: Yes — End-to-end encrypted vault the vendor cannot read |
| Master password never reaches the server — not even hashedIcosahedron uses OPAQUE; 1Password uses SRP. Both are augmented PAKEs, so neither server ever sees a password-derived value it could attack offline. The others send a derived authentication hash. | Icosahedron: Yes — Master password never reaches the server — not even hashed | 1Password: Yes — Master password never reaches the server — not even hashed | Bitwarden: No — Master password never reaches the server — not even hashed | Dashlane: No — Master password never reaches the server — not even hashed | LastPass: No — Master password never reaches the server — not even hashed | NordPass: No — Master password never reaches the server — not even hashed |
| Post-quantum-ready key exchangeML-KEM-768 hybrid, at the transport and again around the app’s own messages. 1Password has published a migration plan but not a shipped hybrid exchange. | Icosahedron: Yes — Post-quantum-ready key exchange | 1Password: Partly — Post-quantum-ready key exchange | Bitwarden: No — Post-quantum-ready key exchange | Dashlane: No — Post-quantum-ready key exchange | LastPass: No — Post-quantum-ready key exchange | NordPass: No — Post-quantum-ready key exchange |
| Memory-hard key derivation on by defaultArgon2id. Bitwarden offers Argon2id but ships PBKDF2 by default; 1Password and LastPass use PBKDF2. | Icosahedron: Yes — Memory-hard key derivation on by default | 1Password: No — Memory-hard key derivation on by default | Bitwarden: Partly — Memory-hard key derivation on by default | Dashlane: Yes — Memory-hard key derivation on by default | LastPass: No — Memory-hard key derivation on by default | NordPass: No — Memory-hard key derivation on by default |
| Primitives named in public, not described as “bank-grade”Argon2id · XChaCha20-Poly1305 · Ed25519 · ML-KEM-768. | Icosahedron: Yes — Primitives named in public, not described as “bank-grade” | 1Password: Yes — Primitives named in public, not described as “bank-grade” | Bitwarden: Yes — Primitives named in public, not described as “bank-grade” | Dashlane: Yes — Primitives named in public, not described as “bank-grade” | LastPass: Partly — Primitives named in public, not described as “bank-grade” | NordPass: Partly — Primitives named in public, not described as “bank-grade” |
A password manager fills a login box; an agent needs a credential handed to a process, scoped, and taken back.
| Feature | Icosahedron | 1Password | Bitwarden | Dashlane | LastPass | NordPass |
|---|---|---|---|---|---|---|
| Secrets injected into a process at runtime — no .env on diskBitwarden does this through Secrets Manager, a separately licensed product, not the password manager. Dashlane’s command line can pass secrets to a command’s environment. | Icosahedron: Yes — Secrets injected into a process at runtime — no .env on disk | 1Password: Yes — Secrets injected into a process at runtime — no .env on disk | Bitwarden: Partly — Secrets injected into a process at runtime — no .env on disk | Dashlane: Partly — Secrets injected into a process at runtime — no .env on disk | LastPass: No — Secrets injected into a process at runtime — no .env on disk | NordPass: No — Secrets injected into a process at runtime — no .env on disk |
| Per-agent scoped access, grantable and revocableEach agent gets its own grant, set and revoked per agent. 1Password service accounts and Bitwarden machine accounts scope to a vault or project, not to an individual agent run. | Icosahedron: Yes — Per-agent scoped access, grantable and revocable | 1Password: Partly — Per-agent scoped access, grantable and revocable | Bitwarden: Partly — Per-agent scoped access, grantable and revocable | Dashlane: No — Per-agent scoped access, grantable and revocable | LastPass: No — Per-agent scoped access, grantable and revocable | NordPass: No — Per-agent scoped access, grantable and revocable |
| First-party command-line interfaceAnother near-parity row: Dashlane, LastPass and NordPass each document an official command line. | Icosahedron: Yes — First-party command-line interface | 1Password: Yes — First-party command-line interface | Bitwarden: Yes — First-party command-line interface | Dashlane: Yes — First-party command-line interface | LastPass: Yes — First-party command-line interface | NordPass: Yes — First-party command-line interface |
| SSH keys stored, with an agent that signs for youThe key stays in the vault and the agent hands back only the signature. 1Password and Bitwarden offer an SSH agent too. | Icosahedron: Yes — SSH keys stored, with an agent that signs for you | 1Password: Yes — SSH keys stored, with an agent that signs for you | Bitwarden: Yes — SSH keys stored, with an agent that signs for you | Dashlane: No — SSH keys stored, with an agent that signs for you | LastPass: No — SSH keys stored, with an agent that signs for you | NordPass: No — SSH keys stored, with an agent that signs for you |
| Agent uses a secret without ever being handed its valueIcosahedron’s agents ask by name and the app acts, so the value never reaches them. 1Password’s agentic autofill and Bitwarden’s agent SDK cover part of this; Bitwarden’s MCP server does hand the value to the agent. | Icosahedron: Yes — Agent uses a secret without ever being handed its value | 1Password: Partly — Agent uses a secret without ever being handed its value | Bitwarden: Partly — Agent uses a secret without ever being handed its value | Dashlane: No — Agent uses a secret without ever being handed its value | LastPass: No — Agent uses a secret without ever being handed its value | NordPass: No — Agent uses a secret without ever being handed its value |
| An agent’s change applies only after you approve it on your own screenEvery agent change is a proposal you approve in the desktop app before it applies. 1Password and Bitwarden ask before an agent gets access, but the approval covers a session or a grant, not each change. | Icosahedron: Yes — An agent’s change applies only after you approve it on your own screen | 1Password: Partly — An agent’s change applies only after you approve it on your own screen | Bitwarden: Partly — An agent’s change applies only after you approve it on your own screen | Dashlane: No — An agent’s change applies only after you approve it on your own screen | LastPass: No — An agent’s change applies only after you approve it on your own screen | NordPass: No — An agent’s change applies only after you approve it on your own screen |
| API keys, tokens and env vars as real entry typesElsewhere these live as a secure note or a custom field on a login. | Icosahedron: Yes — API keys, tokens and env vars as real entry types | 1Password: Partly — API keys, tokens and env vars as real entry types | Bitwarden: Partly — API keys, tokens and env vars as real entry types | Dashlane: No — API keys, tokens and env vars as real entry types | LastPass: No — API keys, tokens and env vars as real entry types | NordPass: No — API keys, tokens and env vars as real entry types |
Storing a credential is the easy half. The half that costs you a Saturday is the one that expired while you were not looking.
| Feature | Icosahedron | 1Password | Bitwarden | Dashlane | LastPass | NordPass |
|---|---|---|---|---|---|---|
| Scheduled rotation — keys change on their ownDeadlines are built in (90 days for API keys, a year for passwords). Agent-driven rotation runs with an explicit ceiling and your confirmation. | Icosahedron: Yes — Scheduled rotation — keys change on their own | 1Password: No — Scheduled rotation — keys change on their own | Bitwarden: No — Scheduled rotation — keys change on their own | Dashlane: No — Scheduled rotation — keys change on their own | LastPass: No — Scheduled rotation — keys change on their own | NordPass: No — Scheduled rotation — keys change on their own |
| Expiry alerts before a credential diesCertificates, tokens, domains and cards all carry an end date. Nothing else on this page watches it. | Icosahedron: Yes — Expiry alerts before a credential dies | 1Password: No — Expiry alerts before a credential dies | Bitwarden: No — Expiry alerts before a credential dies | Dashlane: No — Expiry alerts before a credential dies | LastPass: No — Expiry alerts before a credential dies | NordPass: No — Expiry alerts before a credential dies |
| Breached-password alertsAnother parity row — the whole category has done this well for years. Icosahedron goes one step further and rotates the affected credentials instead of only listing them. | Icosahedron: Yes — Breached-password alerts | 1Password: Yes — Breached-password alerts | Bitwarden: Yes — Breached-password alerts | Dashlane: Yes — Breached-password alerts | LastPass: Yes — Breached-password alerts | NordPass: Yes — Breached-password alerts |
Desktop, browser and phone are settled ground. Whether the thing still works when the vendor is unreachable is not.
| Feature | Icosahedron | 1Password | Bitwarden | Dashlane | LastPass | NordPass |
|---|---|---|---|---|---|---|
| Desktop appAnother parity row: all six ship one. Icosahedron’s is where the vault lives and where every agent change is approved. | Icosahedron: Yes — Desktop app | 1Password: Yes — Desktop app | Bitwarden: Yes — Desktop app | Dashlane: Yes — Desktop app | LastPass: Yes — Desktop app | NordPass: Yes — Desktop app |
| Browser extensionAnother parity row: all six cover the major browsers. Icosahedron’s is called Octa and works with the desktop app. | Icosahedron: Yes — Browser extension | 1Password: Yes — Browser extension | Bitwarden: Yes — Browser extension | Dashlane: Yes — Browser extension | LastPass: Yes — Browser extension | NordPass: Yes — Browser extension |
| Full vault on mobile with no signal at allAnother parity row: all six keep a local copy, so the vault opens in airplane mode. Icosahedron’s mobile app is called Hexa. | Icosahedron: Yes — Full vault on mobile with no signal at all | 1Password: Yes — Full vault on mobile with no signal at all | Bitwarden: Yes — Full vault on mobile with no signal at all | Dashlane: Yes — Full vault on mobile with no signal at all | LastPass: Yes — Full vault on mobile with no signal at all | NordPass: Yes — Full vault on mobile with no signal at all |
| Keys held on your machine — no cloud can act for youBitwarden earns a half only because you can self-host the server. The rest require the vendor account to be reachable. | Icosahedron: Yes — Keys held on your machine — no cloud can act for you | 1Password: No — Keys held on your machine — no cloud can act for you | Bitwarden: Partly — Keys held on your machine — no cloud can act for you | Dashlane: No — Keys held on your machine — no cloud can act for you | LastPass: No — Keys held on your machine — no cloud can act for you | NordPass: No — Keys held on your machine — no cloud can act for you |
| Server secrets are useless if the files are copied off the machineA server build opens only on the machine it was enrolled to — the build is bound to that one machine. 1Password and Bitwarden service and machine tokens work from any host; the others have no server product. | Icosahedron: Yes — Server secrets are useless if the files are copied off the machine | 1Password: No — Server secrets are useless if the files are copied off the machine | Bitwarden: No — Server secrets are useless if the files are copied off the machine | Dashlane: No — Server secrets are useless if the files are copied off the machine | LastPass: No — Server secrets are useless if the files are copied off the machine | NordPass: No — Server secrets are useless if the files are copied off the machine |
| Extension holds no keys of its ownOctahedron reaches into the desktop vault for one item at a time. Everywhere else the extension carries an unlocked copy. | Icosahedron: Yes — Extension holds no keys of its own | 1Password: No — Extension holds no keys of its own | Bitwarden: No — Extension holds no keys of its own | Dashlane: No — Extension holds no keys of its own | LastPass: No — Extension holds no keys of its own | NordPass: No — Extension holds no keys of its own |
The reason you opened a password manager in the first place. Icosahedron does not get to skip any of it.
| Feature | Icosahedron | 1Password | Bitwarden | Dashlane | LastPass | NordPass |
|---|---|---|---|---|---|---|
| Autofill and save in the browserAnother parity row: every one of them fills and saves logins as you browse. | Icosahedron: Yes — Autofill and save in the browser | 1Password: Yes — Autofill and save in the browser | Bitwarden: Yes — Autofill and save in the browser | Dashlane: Yes — Autofill and save in the browser | LastPass: Yes — Autofill and save in the browser | NordPass: Yes — Autofill and save in the browser |
| Built-in two-factor codesAnother parity row: all six make the one-time code next to the login it belongs to. | Icosahedron: Yes — Built-in two-factor codes | 1Password: Yes — Built-in two-factor codes | Bitwarden: Yes — Built-in two-factor codes | Dashlane: Yes — Built-in two-factor codes | LastPass: Yes — Built-in two-factor codes | NordPass: Yes — Built-in two-factor codes |
| Passkeys stored and offeredAnother parity row: all six store passkeys and offer them at sign-in. | Icosahedron: Yes — Passkeys stored and offered | 1Password: Yes — Passkeys stored and offered | Bitwarden: Yes — Passkeys stored and offered | Dashlane: Yes — Passkeys stored and offered | LastPass: Yes — Passkeys stored and offered | NordPass: Yes — Passkeys stored and offered |
| Sharing with family or a teamAnother parity row: every one of them shares items with family or a team. | Icosahedron: Yes — Sharing with family or a team | 1Password: Yes — Sharing with family or a team | Bitwarden: Yes — Sharing with family or a team | Dashlane: Yes — Sharing with family or a team | LastPass: Yes — Sharing with family or a team | NordPass: Yes — Sharing with family or a team |
| Refuses to fill on a look-alike domainAnother parity row: each checks the exact site address before it fills, so a copy of the page gets nothing. | Icosahedron: Yes — Refuses to fill on a look-alike domain | 1Password: Yes — Refuses to fill on a look-alike domain | Bitwarden: Yes — Refuses to fill on a look-alike domain | Dashlane: Yes — Refuses to fill on a look-alike domain | LastPass: Yes — Refuses to fill on a look-alike domain | NordPass: Yes — Refuses to fill on a look-alike domain |
| Import from the other fiveIcosahedron imports 1Password, Bitwarden, Dashlane, Keeper, LastPass, NordPass and Proton Pass. | Icosahedron: Yes — Import from the other five | 1Password: Yes — Import from the other five | Bitwarden: Yes — Import from the other five | Dashlane: Partly — Import from the other five | LastPass: Yes — Import from the other five | NordPass: Partly — Import from the other five |
The laptop is gone. What can you do in the next five minutes?
| Feature | Icosahedron | 1Password | Bitwarden | Dashlane | LastPass | NordPass |
|---|---|---|---|---|---|---|
| Wipe a lost device from your phoneTriggered from your phone. 1Password can deauthorize a device on a business plan, which stops future sync rather than clearing what is already there. | Icosahedron: Yes — Wipe a lost device from your phone | 1Password: Partly — Wipe a lost device from your phone | Bitwarden: No — Wipe a lost device from your phone | Dashlane: No — Wipe a lost device from your phone | LastPass: No — Wipe a lost device from your phone | NordPass: No — Wipe a lost device from your phone |
| Seal the vault from another device, without deleting itLocking the vault on the device in front of you is standard everywhere. Sealing it remotely, from your phone, is not. | Icosahedron: Yes — Seal the vault from another device, without deleting it | 1Password: No — Seal the vault from another device, without deleting it | Bitwarden: No — Seal the vault from another device, without deleting it | Dashlane: No — Seal the vault from another device, without deleting it | LastPass: No — Seal the vault from another device, without deleting it | NordPass: No — Seal the vault from another device, without deleting it |
Get Ready For The Sensation When
You See Your Credentials Update Automatically
No Credit Card Required
Setup In Less Than 3 Minutes