Package formats at a glance
Linux support is less about whether an app exists than about how it is packaged, because packaging decides updates, sandboxing and whether biometric or browser integration works. The table lists only formats each vendor names on its own pages.
| Bitwarden | 1Password | NordPass | KeePassXC | |
|---|---|---|---|---|
| Desktop formats named by vendor | AppImage, .deb, .rpm, Snap, Flatpak (com.bitwarden.desktop) | .deb or APT repo, .rpm or DNF/YUM repo, zypper repo, AUR, .tar.gz, Snap, Flathub | Snap (publisher NordPass) | Flatpak (recommended), AppImage, Snap, Ubuntu PPA, distro packages |
| CPU architectures | CLI native build is Linux x64; npm preferred for arm64 | x86_64 and arm64 via .tar.gz; Snap is x86 only | Not stated on the Snap page | AppImage for x86-64 and AArch64 |
| Command-line tool | bw (native, npm, Snap, or inside the Flatpak) | op (APT, DNF, Alpine, NixOS, zip) | Not covered | Not covered here |
| Self-hosting | Yes | Not documented in sources cited | Not documented in sources cited | Local file, no server |
| Price for Linux use | Free plan $0; Premium $19.80 a year | Requires a 1Password membership; Individual $3.99 a month billed annually | Not verified for this guide | Free, GPLv3 |
Bitwarden on Linux: desktop, CLI and self-hosting
Bitwarden's download page lists native Linux desktop apps and a CLI. Its desktop help names AppImage, .deb and .rpm, plus Snap, and the CLI page refers to the Flatpak build (com.bitwarden.desktop). Bitwarden's desktop guide says unlock with system authentication works with AppImage, .deb and .rpm once a polkit agent and a secret service such as GNOME Keyring are present (its biometrics page also lists Snap); the Flatpak build needs a polkit policy file copied in first. Snap users also have to run sudo snap connect bitwarden:password-manager-service and then sign out and back in.
The CLI, bw, installs as a native Linux x64 executable, through npm (npm install -g @bitwarden/cli, preferred on arm64), with sudo snap install bw, or from inside the Flatpak. You sign in with bw login, or bw login --apikey for scripts using the BW_CLIENTID and BW_CLIENTSECRET variables. API-key and SSO logins need bw unlock, which hands back a session key you export as BW_SESSION. Useful first commands are bw list items, bw get password followed by an item name, and bw generate, which makes a 14-character password by default.
Self-hosting is Bitwarden's distinctive Linux option. The documented minimum is an x64 1.4 GHz CPU, 2 GB RAM, 12 GB storage and Docker Engine 26 or later with Compose, with 4 GB RAM and 25 GB recommended. You need a domain pointed at the host, ports 80 and 443, and an installation ID and key requested from bitwarden.com/host. A license is only needed for paid features. Point the CLI at your server with bw config server followed by your address.
1Password on Linux: the most package choices, but paid
1Password lists the widest set of official Linux packages: .deb or an APT repository, .rpm or a DNF/YUM repository, a zypper repository for openSUSE, an AUR package, a .tar.gz archive, and Snap or Flathub builds. Its system requirements ask for 64-bit x86 or ARM with glibc 2.31, on CentOS 9, Debian 11, Fedora 32, RHEL 9, Ubuntu 20.04 (package) or Ubuntu 18.04 (Snap) or later. Gentoo and NixOS packages are community-maintained.
Pick the native package over Snap or Flatpak if you can. 1Password says the Snap and Flatpak versions do not support system authentication, the SSH agent, or locking and unlocking the browser extension through the app, and that Flathub is community-maintained and may update more slowly. The Snap also runs on x86 only.
The op CLI installs from the APT, DNF or Alpine repositories, NixOS configuration, or a GPG-verified zip. To have it unlock through the desktop app, turn on Unlock using system authentication under Settings, Security and Integrate with 1Password CLI under Settings, Developer; that needs a running PolKit authentication agent. Then op signin chooses an account and op vault list confirms access. 1Password for Linux requires a paid membership; there is a 14-day trial.
NordPass and browser-only setups
NordPass publishes a Snap under its own name. The Snapcraft listing describes password generation, breach scanning, autofill and encrypted storage for passkeys, cards, notes and files, lists distributions from Ubuntu and Debian to Fedora, Arch and openSUSE, and showed version 7.12.15 updated on 27 October 2026. NordPass's own download and plan pages were not reachable when we checked, so this guide does not list its other formats or prices.
If you live in the browser, you may not need a desktop app at all. Bitwarden lists extensions for Chrome, Firefox, Edge, Brave, Vivaldi, Opera, Tor and DuckDuckGo, among others. 1Password's extension needs Chrome, Firefox or Edge 140 or Brave 1.82, and 1Password says its Snap and Flatpak builds cannot lock and unlock the extension through the app, so pair the extension with a native package.
Who should pick which
- Pick Bitwarden if you want free sync across Linux and other devices, a scriptable CLI, or the option to run your own server.
- Pick 1Password if you already pay for it, want native .deb or .rpm repositories with system-authentication unlock, and use op for developer secrets.
- Consider NordPass only if you already use it elsewhere and are happy with the Snap.
- Pick KeePassXC if you want no cloud at all: it is free under GPLv3, recommends the Flatpak from Flathub, and has a KeePassXC-Browser extension for Firefox, Chrome and Edge. You handle syncing and backups of the database file yourself.
- Avoid Snap or Flatpak builds of 1Password if you rely on biometric or system unlock.
Questions before you decide
Does 1Password work on Linux without paying?
No. 1Password says its Linux app requires a 1Password membership. There is a 14-day free trial but no free plan.
How do I use the Bitwarden CLI with a self-hosted server?
Run bw config server followed by your server address before logging in. Bitwarden's CLI page documents this, and bw config server with no value shows the current server.
Should I use the Snap or Flatpak version of 1Password?
Only if you need the sandbox. 1Password says those builds lack system authentication, the SSH agent and extension unlock through the app, and the Snap is x86 only.
Sources & verification
Product details and prices can change. Check the linked provider before buying.
- Bitwarden download page Accessed 30 Oct 2026
- Bitwarden: getting started with the desktop app Accessed 30 Oct 2026
- Bitwarden: unlock with biometrics Accessed 30 Oct 2026
- Bitwarden: password manager CLI Accessed 30 Oct 2026
- Bitwarden: install and deploy on Linux (self-hosted) Accessed 30 Oct 2026
- 1Password: install 1Password on Linux Accessed 30 Oct 2026
- 1Password: system requirements Accessed 30 Oct 2026
- 1Password Developer: get started with 1Password CLI Accessed 30 Oct 2026
- Snapcraft: NordPass snap listing (publisher NordPass) Accessed 30 Oct 2026
- KeePassXC: download Accessed 30 Oct 2026
- Bitwarden pricing Accessed 30 Oct 2026
- 1Password: password manager pricing Accessed 30 Oct 2026
Sources link directly to providers. Product buttons may use separately labeled affiliate links. Read our disclosure.