Bitwarden vs 1Password 2026: Open Code or Secret Key
Bitwarden is open source, audited yearly, and free enough that many never pay. 1Password is closed but adds a 128-bit Secret Key and the most polished apps around.
Published September 8, 2026· By Juan Martinez
Bitwarden and 1Password are the two password managers most people have actually heard of, and the scores here are close — 8.7 against 8.5. They are separate, independently owned companies, so this isn’t a “same owner, different bet” comparison. It’s a straight difference in trust model. Bitwarden asks you to trust code you can read and audits anyone can download. 1Password asks you to trust a closed but heavily documented design, and hands you a second secret — a 128-bit Secret Key — that means guessing your password alone gets an attacker nowhere. One is free enough that many people never pay; the other has no free plan at all and the smoothest apps in the category.
| Bitwarden | 1Password | |
|---|---|---|
| Rating | 8.7 | 8.5 |
| Renewal price (individual) | $1.65/mo ($19.80/yr) | $3.99/mo ($47.88/yr) |
| Free Tier | full | none |
| Open Source | full | closed |
| Second secret | — | ✅ |
| Encryption | AES-256-CBC, PBKDF2 | AES-256-GCM, Secret Key + PBKDF2 |
| Est. | 2016 | 2005 |
Bitwarden vs 1Password on trust: readable code vs a documented design
This is the core of the decision. Bitwarden’s entire codebase — server included — is on GitHub, mostly under AGPL-3.0, and it has commissioned a third-party assessment every year since 2018, most by Cure53, covering source review and penetration testing across the apps, browser extension and web vault. The 2025 round added a cryptography audit by ETH Zurich’s Applied Cryptography Group conducted under the assumption of a fully malicious server. Every report is a plain PDF with no login.
1Password’s client and server code is not open. The security design white paper is public and detailed, but you are trusting a description, not the thing itself. It holds SOC 2 Type 2 and ISO 27001:2022, and the last independent audit you can freely download is Independent Security Evaluators’ 2020 penetration test and code review. Newer annual pentests exist, but since November 2025 they sit behind the 1Password Trust Center’s request-access gate rather than open downloads — a step back on the “verify, don’t trust” axis at exactly the point where the open-source competitor is strongest.
Neither company has ever had user vault data breached. Both have an incident on the record that is worth knowing but wasn’t a vault breach: a malicious Bitwarden CLI package was published to npm for about 90 minutes in April 2026 as part of the wider Checkmarx supply-chain campaign (the distribution channel, not the source or the servers; fixed the same day), and 1Password’s own Okta tenant was accessed in October 2023 as a downstream effect of Okta’s support-system breach (its IT stack, no user data or product systems). Both responded fast and disclosed publicly.
The Secret Key: 1Password’s real architectural edge
1Password derives your vault key from your account password with PBKDF2-HMAC-SHA256 at 650,000 iterations, then combines it with a 128-bit Secret Key that is generated on your device and never sent to 1Password’s servers. The practical effect: an attacker who somehow gets your encrypted data and guesses your account password still cannot decrypt anything without the Secret Key, which only exists on your devices and in your Emergency Kit. Nothing in Bitwarden’s mainstream design matches this — its vault is protected by your master password alone (600,000 PBKDF2 iterations on the client by default, more added server-side; Argon2id available if you switch it on).
The trade-off runs both ways. The Secret Key raises the floor against a server-side breach, and it makes the Emergency Kit — the document that holds it — your single point of failure for recovery. Lose it with no family or team recovery set up, and the vault is gone. Bitwarden has the same “forget the master password and it’s over” property, just without the extra document to keep safe.
On the encryption primitive itself, 1Password uses AES-GCM-256, a modern authenticated-encryption mode. Bitwarden uses AES-256-CBC with HMAC-SHA-256 — an older encrypt-then-MAC construction that is conservative rather than weak, and which the ETH Zurich audit examined directly.
What each one encrypts, and what it doesn’t
Bitwarden encrypts item names, notes, URLs, custom fields, TOTP secrets and card data on your device. What it does not encrypt is vault metadata — which account an item belongs to, how many items you hold. Bitwarden calls this “administrative data” and says it can access it. If hiding the shape of your vault from the host matters to you, that’s the gap.
1Password’s security model keeps vault contents end-to-end encrypted too, and AgileBits states it cannot read the data. Its weaker category in our review is Privacy & Trust, but for a different reason than metadata — it’s the closed source plus the newer audits moving behind an access gate, and telemetry that is somewhat broader than the leanest competitors (the privacy policy lists performance metrics and analytics that may be shared with service providers for support and internal marketing).
Features and polish: 1Password sets the bar, Bitwarden covers the essentials
1Password has the most complete and most refined feature set of the mainstream managers. Watchtower flags breached, weak and reused logins and sites missing two-factor. Travel Mode removes selected vaults from your devices when you cross a border. Passkeys work both ways — store and autofill site passkeys, or use one to unlock the 1Password app itself. The apps are native on every platform, onboarding is gentle, and it’s the manager other managers are measured against on feel.
Bitwarden’s free tier already covers what most people need: unlimited passwords on unlimited devices, passkey storage and use, encrypted export, Bitwarden Send, and item sharing with one other person. Paid tiers ($19.80/year Premium) add an integrated TOTP authenticator, file attachments, Emergency Access and vault health reports. The apps are functional and occasionally clunky — the desktop client is Electron, mobile autofill setup is fiddlier than the paid-only competition — but nothing there is a dealbreaker once configured.
Email aliases are a wash in capability, different in setup: Bitwarden has built-in integration with the major alias services on the free tier; 1Password generates Masked Emails inline but needs a separate paid Fastmail account to do it.
Price: not close
Bitwarden’s free tier is genuinely complete for one person, so many users never pay. If you do, Premium is $19.80 a year and Families is $47.88 a year for six accounts — with no introductory rate that jumps at renewal. 1Password has no free plan at all, only a 14-day trial; Individual is $3.99/month at the renewal rate (an introductory year runs $2.99), billed $47.88 annually, and Families is $71.88 for six. 1Password’s renewal price is mid-range for a paid manager — the point isn’t that it’s expensive, it’s that there’s no free option to fall back on. You commit to paying from day one for the Secret Key architecture and the polish.
What we didn’t compare, and why
Business and Teams tiers. Both sell per-seat plans for organisations, and both reviews name those tiers without scoring them — the focus is personal use. The choice at company scale turns on admin and deployment details this comparison doesn’t cover.
Self-hosting depth. Bitwarden can be self-hosted with its own server software, and that is a real point in its favour for a technical user — but “how good is the self-host experience” is a question for the full Bitwarden review, not a head-to-head axis, because 1Password has no equivalent to weigh it against.
Recovery mechanics. Both are zero-knowledge: neither company can reset your master password. Bitwarden’s fallback is an Emergency Access contact; 1Password’s is the Emergency Kit document plus family or team recovery. The practical difference is small and covered in each review — it doesn’t tip the choice on its own.
Bottom line
Read the full Bitwarden review if you want code you can verify, an audit every year with every report public, a free tier with no real limits for one person, and the option to self-host — and you can live with functional-not-polished apps and unencrypted vault metadata.
Read the full 1Password review if the Secret Key’s dual-key protection and the best apps in the category are worth paying for from the first day, and you’re comfortable trusting a closed codebase whose newest audit reports now require requesting access.