AliasVault combines a zero-knowledge password manager with a built-in email alias server in a single self-hosted package. Credentials and aliases are end-to-end encrypted before they leave your browser, so the server never sees plaintext vault data. The alias server lets you generate per-site email addresses that forward to your real inbox, adding identity compartmentalization alongside password management.
Reviewed by Marco Wollank
AliasVault
aliasvault.net 4.8 (5)
Rate AliasVault: No account needed
Threat level
Hardened
A hardened pick. Worth the effort once you have chosen to shrink your footprint on purpose. Enough for most people. Threat levels
Our take
The combination of a password vault and email aliasing in one self-hosted install is a genuinely useful pairing: you get credential isolation and identity isolation together, without paying for separate services like Bitwarden plus SimpleLogin. Zero-knowledge E2E encryption means self-hosting does not require you to fully trust your own server security for vault confidentiality. The honest catch is maturity: AliasVault is actively developed but newer than established alternatives, and the AGPLv3 license requires source disclosure if you modify and host it publicly. For privacy-focused self-hosters comfortable running their own infrastructure, it is one of the more complete solutions available.
GitHub at a glance
aliasvault/aliasvault AGPL-3.0 aliasargon2idblazorbrowser-extensiondockerdotnetemail-serverpassword-managerreactsrpwasm
Stars
3,450
+130 this week
Forks
119
16 watching
Last commit
today
healthy
Latest release
0.31.1
20d ago, 86 total
Star history
Issues
84% closed
193
open
1,000
closed
+48 / -41
opened / closed, last 4 weeks
Opened vs closed, last 12 weeks
Commits, last 26 weeks
1,597 commits, active 26 of 26 weeks
15 contributors since May 2024
Languages
- TypeScript 45.3%
- C# 20.4%
- Rust 9.6%
- Other 24.7%
Updated daily from the GitHub API. Star tracking since Jun 22, 2026.
Website at a glance
aliasvault.net
B score 75
Solid website security headers
Graded by Mozilla HTTP Observatory, tested 4d ago
Inspect this site yourself
Measures the security configuration of the tool's own website, not the privacy of the product itself. A strong tool can still score low here.
AliasVault alternatives
NordPass Audited by an independent cybersecurity firm Cure53 in Feb 2020 and confirmed the security of NordPass. Offers browser extensions for Chrome, Firefox, Edge, Brave, Opera and…
Proton Pass Open-source, end-to-end encrypted password manager from the maker of Proton Mail, based in Switzerland. Stores logins, notes, and cards, with built-in email aliasing via SimpleLogin. Apps for Windows, macOS, Linux, Android, iOS, and the major browsers.
PrivacyNotes Encrypted notes, tasks, calendar, files, passwords and a journal with mood and medication tracking, all unlocked by one 12-word recovery phrase. Sign up with no email and no password. Open source.
KeePassXC Securely store passwords using industry standard encryption, quickly auto-type them into desktop applications, and use browser extension to log into websites. KeePassDX for…
Bitwarden Bitwarden is our top choice. You can import your previous passwords from other password managers with ease. Free for personal use. Available for Desktop, all Browsers, Android…
1Password 1Password is a commercial password manager for individuals, families, and teams, available on Windows, Mac, Linux, Android, iOS, and all major browsers. It uses a dual-key architecture combining your master password with a locally generated Secret Key.
AliasVault license, in plain English
AGPL-3.0 Strong copyleft · network
Free to use, even commercially. Changes must be published under the same license, and running a modified version as a network service counts as distributing it.
Permits
- Commercial use
- Modification
- Distribution
- Patent use
- Private use
Requires
- Disclose source
- Network use is distribution
- Same license
- State changes
- License and copyright notice
Does not provide
- Liability cover
- Warranty
Why it matters: The network clause is the point. Anyone who runs a modified version as a hosted service has to publish those changes, so the code handling your data stays inspectable. This is why privacy-first projects reach for AGPL.
Plain-language summary of the project's license, not legal advice. Read the full text for the exact terms.