Bitwarden vs KeePassXC Comparison

• Premium (individual, annual): $19.80/year
• Families (up to 6 users, annual): $47.88/year

Penetration test and source-code audit of the Bitwarden core application

First-level security certification of KeePassXC 2.7.9 on Windows — full source-code review, penetration testing of every security function, and cryptographic and random-number-generator analysis

600,000 PBKDF2-HMAC-SHA256 iterations by default on the client, plus more server-side (700,000 total for the master password hash); Argon2id is available as an alternative KDF. Item names, notes, URIs, custom field names, TOTP secrets and card/identity data are all encrypted client-side. Vault metadata — which account an item belongs to, the number of items — is not.

The database is encrypted with AES-256 by default (Twofish and ChaCha20 are also selectable) in the KDBX 4 format, with an HMAC-SHA-256 integrity check that detects tampering. The master key is derived with Argon2d by default — a memory-hard function that resists GPU and ASIC cracking — with the older AES-KDF still available. The composite master key can combine a password, a key file, and a YubiKey or OnlyKey challenge-response secret.

Private US company based in Santa Barbara, California; the parent company of 8bit Solutions LLC. Founded by Kyle Spearrin, who remains Chief Innovation Officer.

Volunteer, community-run open-source project under the keepassxreboot organization on GitHub — no company and no venture funding behind it. Development is paid for by donations. Forked from KeePassX in 2016; the KeePass lineage goes back to 2003.