Qeva

Free plan APISelf-hostedWeb

What Qeva is

Qeva is an open-source password manager for individuals and teams, offered as a self-hosted web vault. It organizes passwords, logins, and secure notes in personal, team, and shared global vaults. Users can import from LastPass, 1Password, Bitwarden, and other sources, then identify weak, reused, or old passwords with its health checks. A password generator and vault security score are also included. Its timestamped activity log records sign-ins, shares, and edits, with filtering and export. Access tokens and a REST API let teams automate onboarding, offboarding, and access changes, with connections to identity providers, HR systems, or CI pipelines. Qeva says it uses AES-256 encryption, has no trackers or telemetry, and is licensed under AGPL. Its architecture page specifies AES-GCM, 150,000 PBKDF2 iterations per key, and ciphertext-only secrets at rest. Docker deployment keeps the service on infrastructure the user controls, according to the maker. The self-hosted plan is free, with unlimited users, teams, and vaults. The maker says no independent security audit has taken place yet. Qeva describes its current product as a web vault; browser and mobile clients are next.

Who it suits

It suits individuals, homelab users, teams, and companies prepared to deploy and manage a password vault on infrastructure they control. Its API and access tokens may also suit teams automating account changes.

What it does well

Unlimited users, teams, and vaults on the free plan
Imports from LastPass, 1Password, and Bitwarden
REST API and access tokens support automation
Activity log can be filtered and exported

What to know first

No independent security audit yet
Currently described as a web vault
Self-hosted deployment requires user-controlled infrastructure

Plans

Plan	Billed and limits	Price
Self-hosted	Free forever · Every feature included · Unlimited users, teams, and vaults · No seat limits or paywalls	Free
Sponsor	Optional sponsorship · Funds development and security audits	On request
Managed	Soon early access · Everything in self-hosted · Qeva handles updates and backups · Early-access list open	On request

As qeva.in lists them, read 11 Oct 2026. The maker's own page has the final word.

Verdict

Qeva combines self-hosting, shared vaults, password-health checks, and automation without seat limits on its free plan.

Facts from Qeva's own pages

Activity log: Its timestamped activity log records sign-ins, shares, and edits and can be filtered and exported. · qeva.in, 11 Oct 2026
Audience: The maker positions Qeva for homelab users, teams, and companies, with no seat limits. · qeva.in, 11 Oct 2026
Automation: Qeva provides access tokens and a REST API for scripting onboarding, offboarding, and access changes, with connections to an IdP, HR system, or CI pipeline. · qeva.in, 11 Oct 2026
Business admin controls: Yes · qeva.in, 16 Sept 2026
Current app availability: The maker describes Qeva as a web vault and says browser and mobile clients are next. · qeva.in, 11 Oct 2026
Deployment: Qeva can be deployed with Docker on infrastructure the user controls, and the maker says the data stays on that infrastructure. · qeva.in, 11 Oct 2026
Free plan: Yes · qeva.in, 16 Sept 2026
Imports: Qeva says users can import from LastPass, 1Password, Bitwarden, and more. · qeva.in, 11 Oct 2026
Independent audit: The maker says Qeva has not yet had an independent security audit and plans one once sponsorship covers it. · qeva.in, 11 Oct 2026
Integrations: The maker names LastPass, 1Password, Bitwarden, and Chrome in its import section, and says the API can plug into IdPs, HR systems, or CI pipelines. · qeva.in, 11 Oct 2026
Passkey support: Yes · qeva.in, 16 Sept 2026
Password health: It flags weak, reused, and old passwords and includes a password generator and vault security score. · qeva.in, 11 Oct 2026
Product: Qeva is an open-source, self-hosted password manager for individuals and teams. · qeva.in, 11 Oct 2026
Secure sharing: Yes · qeva.in, 16 Sept 2026
Security: The maker says Qeva uses AES-256 encryption, is open source under the AGPL, and has no trackers or telemetry. · qeva.in, 11 Oct 2026
Security architecture: The architecture page specifies AES-GCM authenticated encryption, 150,000 PBKDF2 iterations per key, and ciphertext-only secrets at rest. · qeva.in, 11 Oct 2026
Support: The self-hosted plan includes community support. · qeva.in, 11 Oct 2026
Supported platforms: web · qeva.in, 16 Sept 2026
Vaults: It supports personal, team, and shared global vaults for passwords, logins, and secure notes. · qeva.in, 11 Oct 2026

Where Qeva stands on Freedom251

Password Managers#40 of 104