Enpass Password Manager Review | PCMag

Using the same simple password everywhere is convenient, but it also sets you up to be hacked. A better strategy is using a password manager like Enpass to create a unique, strong password for every site. We like Enpass’ easy-to-use interface and reasonable pricing. The app can also store your passwords locally or via a cloud storage option, though that same feature makes syncing credentials between devices less than seamless, which might be a roadblock for new users. If you’re looking for a free, open-source password manager to easily sync credentials across devices, consider our Editors’ Choice winner, Bitwarden.

How Much Does Enpass Cost?

Desktop users on Windows, macOS, and Linux devices can use the free Lite edition of Enpass. On those platforms, you get all of Enpass’ features and full syncing capabilities between desktop devices. There’s also a portable version you can run from a USB drive.

If you want to sync your passwords to a mobile device, you can do so for free with up to 25 items. If you exceed those limits, you must subscribe to one of the paid Enpass plans. Other free password managers, including Editors’ Choice winner Bitwarden, do not restrict the number of vault entries you can sync across platforms. Bitwarden also syncs your passwords to the cloud for storage and syncing.

The Individual Enpass plan costs $23.99 per year. With an individual plan, you can store and sync an unlimited number of vaults and entries across an unlimited number of devices. You also get security alerts of any website breaches. In addition, Enpass will identify any accounts in your vault that support multi-factor authentication.

A family plan offers the same features for up to six users at $47.99 annually. Alternatively, you can pay a one-time fee of $99.99 to unlock all of the premium features for a single user forever.

Enpass’ prices are pretty low compared to the competition. 1Password’s Premium tier is $35.88, Keeper is $35, and LogMeOnce is $30 annually. There are a few password managers with lower-priced premium tiers, though. Bitwarden, for example, charges $10 per year for its Premium subscription, and Proton Pass costs $21.88 per year.

Simple Tricks to Remember Insanely Secure Passwords

Getting Started With Enpass

Enpass offers apps for Android, iOS, Linux, macOS, and Windows, as well as browser extensions for Brave, Chrome, Edge, Firefox, Opera, Safari, and Vivaldi. We primarily tested the Enpass app on a Windows 10 laptop and an iPhone 12 mini.

Download and install the app, then provide and confirm your email address. Next, create a master password, which encrypts all your data. This password should be memorable but not guessable by anyone else. Enpass rates your master password and offers specific advice for improving a bad one—noting, for example, that what you’ve typed contains a name or a common password. Your master password is irrecoverable, so make sure to write it down in a safe place.

(Credit: Enpass/PCMag)

Enpass handles credential storage differently than many password managers. After you log in to the app, Enpass asks you to choose where to keep your password vault data. You can store your passwords locally on your device or in a third-party cloud storage account. This means that if you want to use the password manager app on multiple devices, you will need to sync your credentials using a third-party cloud provider or a Wi-Fi connection.

To store your credentials using a third-party cloud storage service, go to Settings > Vaults in the desktop app, select the vault you want to sync, and choose Set Up Sync. Then, you need to give Enpass permission to set up a folder in your Box, Dropbox, Google Drive, iCloud, or OneDrive account. You can also use a shared network folder.

In testing, we didn’t have trouble setting up storage and syncing credentials among devices using a third-party cloud account. However, we encountered some setbacks when attempting to sync credentials stored locally on a device to another device. The server and your target devices must be connected to the same Wi-Fi network for this feature to work. The benefit of this setup is that your data never leaves your home network. We could not fully test this feature because the desktop computer we use for testing does not connect via WiFi.

Most other password managers make syncing easier because the vendors use their cloud servers to seamlessly sync data between customer devices. However, these servers are juicy targets for hackers, so storing your data locally whenever possible is an attractive option.

After choosing how to store your vault data, Enpass offers a cool twist on the typical new user onboarding materials. The company allows users to upload a few “Sample Items,” which are prefilled vault entries to help users understand what types of information can be stored in the password manager vault. To try them out, click the “Sample Items” toggle in the Quick Start menu after logging into your vault for the first time.

(Credit: Enpass/PCMag)

After checking out the sample items, it’s time to populate your vault with your passwords. Enpass imports credential lists from 14 competing apps, including 1Password, Bitwarden, Dashlane, and RoboForm. If your old password manager isn’t on the list, never fear. You can export your list from your old app to a CSV file and import it into your Enpass vault.

Authentication Options

Enpass doesn’t offer the typical multi-factor authentication (MFA) options for its apps, such as codes generated by mobile authenticator apps or authentication via hardware security keys. According to an Enpass spokesperson, the reason is as follows: “Enpass users store their vaults in spaces they control, [and] there are already multiple extra layers of authentication between those vaults and anyone trying to access them.”

We asked PCMag lead security analyst Neil Rubenking for his opinion on Enpass’ approach to MFA, and he told us, “Multi-factor authentication isn’t just a matter of numbers. It involves selecting authentication factors from at least two different types out of these three: something you know (a password), something you have (a token or app), or something you are (biometrics). Enpass describes a system where your data is protected by two passwords, your master password and the password for your personal cloud storage account.”

What Is Two-Factor Authentication?

Enpass does not offer multiple forms of authentication since a third-party cloud storage account could, in theory, decrypt using a password. We agree that since Enpass isn’t storing user data on its servers, requiring MFA for the Enpass apps isn’t necessary. Enpass’ lack of MFA does not affect the product’s score.

Data Privacy and Security With Enpass

Before we review and test a password manager, we send questions to the password management company about its privacy and security practices. We want consumers to have plenty of information about the companies handling their data. We’ve included Enpass’ responses to our questions below.

Has your company ever had a security breach?

No.

What unencrypted information does the password manager store in user vaults?

Everything in Enpass vaults is encrypted.

What is the company’s policy regarding master passwords?

For Enpass personal users, because Enpass does not store any user data, empowering users to choose their own safest storage for their vaults, Enpass has no way to offer master password recovery.

For Enpass Business, an optional feature called Enpass Hub enables additional functionality—including access recovery and master password reset—by storing limited, encrypted metadata either on a client-hosted server or an Enpass-hosted server.

What is the company’s policy regarding user data collection and data sales?

Enpass collects almost no user data except names, email addresses (to authenticate subscriptions), and limited technical data (as outlined in our Privacy Policy) and does not share or sell this information.

How does your company protect user data?

Enpass vaults are 256-bit AES encrypted, using the peer-reviewed, open-source encryption engine SQLCipher and 320,000 rounds of PBKDF2-HMAC-SHA512.

Enpass does not collect or store any user data, except for the limited metadata that Enpass Business clients that choose to use the Enpass-hosted version of Enpass Hub, which is encrypted via the same methods as vault data.

How does your company respond to requests for user information from governments and law enforcement?

We recognize our legal obligations to comply with valid legal requests from authorized law enforcement agencies, including subpoenas and court orders. Having said that, when complying with such requests, the data available for Enpass to disclose is very limited. By design, Enpass has no access at all to users’ vaults, master passwords, or decryption keys, so it’s basically just names, emails, and some technical data, as outlined in our privacy policy.

Enpass’ answers are thorough and in line with the company’s privacy policy. PCMag encourages anyone in the market for a new password manager to browse privacy policies to learn more about how companies collect, sell, or store user data. Decide how comfortable you are with data collection and act accordingly.

What Notable Security Features Do You Get With Enpass?

(Credit: Enpass/PCMag)

We like Enpass’ vault audit functions, which identify breached, compromised, identical, weak, and 2FA-supported logins in your vault. RoboForm offers a similar password hygiene feature.

Another interesting security feature is the Erase Everything setting. Located in the Advanced Settings menu, it erased users’ vault data from the device. Vault data stored via third-party cloud storage on a USB drive or other device will not be affected. It’s helpful if you think your device has been compromised and want to keep your data out of the wrong hands.

(Credit: Enpass/PCMag)

You can open Enpass mobile apps using biometrics, such as a fingerprint or face scan. Set up app timeouts and unlocking methods by visiting the Settings menu and choosing the Security option.

Hands On With Enpass

We tested Enpass’ functionality using the Windows desktop app, iOS app, and the browser extension for Google Chrome.

Windows Desktop Application

(Credit: Enpass/PCMag)

The Windows app vault features a white, grey, and blue color scheme by default, but you can change it to a dark theme in the Settings menu. Vault data categories and audit features are located on the left side of the window. The desktop app is easy to navigate, and we didn’t have trouble using it to test Enpass’ credential capturing and replay functions. It was ease to create new username and password combinations, store them in the Enpass vault, and use the credentials to log in.

Chrome Browser Extension

(Credit: Enpass/PCMag)

The Enpass browser extension for Chrome is small and unobtrusive, which is appreciated. We were able to use it to log into sites automatically while browsing. The browser extension was easy to use.

A feature of note is the browser authentication settings within the Enpass browser extension. You can check the box to ask Enpass to authenticate a new browser session using a code each time you open the browser extension. This is one way to get around someone using your browser’s old authenticated session tokens to steal your credentials.

Password Generator

(Credit: Enpass/PCMag)

The Enpass password generator allows users to set a password length of 32 characters by default, which is an excellent standard. 100 characters is the maximum. Users can also include capital and lowercase letters, digits, and symbols.

Storage and Form Filling

Enpass can store various personal data and use it to fill in forms around the web. Options range from general address and contact data to credit cards and licenses. A collection of computer-related data templates includes details for databases, FTP servers, web hosting systems, and more.

The Miscellaneous category includes over two dozen types of data, each with a template for storing the relevant information. These include national ID numbers for various regions of the world, vehicle info, clothing sizes, and even eyeglass prescriptions.

You can also attach files and images to your vault entries. For example, you could add a photo of your driver’s license to the corresponding item. Your storage space is limited to the amount left on your local device or in the cloud storage account you set up. Keeper Password Manager & Digital Vault also emphasizes storing data in your digital vault, but you need to pay a fee for any serious storage capabilities.

Sharing and Emergency Access

We don’t normally advise sharing passwords, but there are relatively low-risk situations where sharing makes sense. To share a vault credential with another Enpass user, first create a preshared key (PSK) for the credential you want to share. The PSK is a password you create and send to the recipient or group before sending the password itself. The person you’re sharing passwords with must download the Enpass app to open the shared vault item.

Enpass does not currently offer any password inheritance or other emergency access features, which would facilitate the transfer of your credentials and other valuable information in the event of your untimely demise. Bitwarden, Dashlane, Keeper, and NordPass all offer digital inheritance methods.

What About Passkeys?

Passkeys are a new way to log into your accounts and include MFA by default. Like many of the other password managers we’ve reviewed, Enpass allows users to store passkeys in their vaults and log in with passkeys around the web.

Mobile App Experience

Unless you pay for Enpass’ Individual Plan, your mobile apps can only manage a single vault and the first 25 entries you add. You may hit that limit quickly, so it’s not as workable a solution as other free password mobile managers, such as Bitwarden, which does not restrict you to a certain number of entries.

On iOS, you can enable Face ID or Touch ID authentication. It supports the Autofill feature on both platforms. Enpass lets you connect to your Apple Watch or Android Wear, too.

(Credit: Enpass/PCMag)

We installed Enpass on an iPhone 12 mini. The app is comparable to the desktop version. You can access any vaults you’ve synced, manage tags, use all the password audit tools, and generate passwords. Auto-filling worked as expected in apps, as did filling TOTP codes. You can use the Enpass mobile app to scan QR codes to set up app-based multi-factor authentication methods.

Is Enpass Good for Business?

As with the regular individual or family Enpass accounts, Enpass Business (starting at $2.99 per user per month) stores data locally on employee devices, with an option to use cloud storage. You can also sign up for the Starter plan, which is $9.99 each month for up to 10 users. The Enterprise plan is $3.99 per user per month and adds security dashboard access, access recovery, vault sharing, free family plans for all users, custom branding options, as well as automatic user provisioning via SCIM from brands such as Azure AD and Okta.

As with competitors NordPass and Dashlane, Enpass Business features an audit system for users and a security dashboard for administrators. The reporting dashboard shows which employees have weak, reused, or old passwords in their vaults.

One helpful feature of Enpass Business is automatic offboarding. It allows an administrator to automatically delete data from employee devices and vaults when they leave the organization. Competitor Bitwarden has a similar function: admin users can remove team members from vaults at their discretion.

Reliable Password Management

Enpass Password Manager handles password capture and form-filling as expected, and we like that you can choose where to store your vault data. That said, credential syncing can be confusing for new users. A password inheritance feature like those offered by competitors like NordPass and LogMeOnce would be a welcome feature addition. Ultimately, our Editors’ Choice winner for password management is still Bitwarden since it is free and easy to use.