Bitwarden vs Proton Pass Comparison

• Premium (individual, annual): $19.80/year
• Families (up to 6 users, annual): $47.88/year

• Pass Plus (individual, annual): $35.88/year
• Pass Family (up to 6 users, annual): $59.88/year

Penetration test and source-code audit of the Bitwarden core application

Source-code review and gray-box testing of the browser extensions, mobile and desktop apps, and CLI

600,000 PBKDF2-HMAC-SHA256 iterations by default on the client, plus more server-side (700,000 total for the master password hash); Argon2id is available as an alternative KDF. Item names, notes, URIs, custom field names, TOTP secrets and card/identity data are all encrypted client-side. Vault metadata — which account an item belongs to, the number of items — is not.

Vault and item data are encrypted with 256-bit AES-GCM under 32-byte random keys; the user key is protected by a bcrypt hash of the account password. Authentication uses a hardened SRP implementation; sharing uses OpenPGP with ECC (Curve25519). Every field is encrypted client-side — usernames, URLs and notes included — so Proton cannot see which services you hold accounts with. Offline access on paid plans uses Argon2 for the local hash.

Private US company based in Santa Barbara, California; the parent company of 8bit Solutions LLC. Founded by Kyle Spearrin, who remains Chief Innovation Officer.

Proton AG, Geneva, Switzerland. Since June 2024 the primary shareholder is the non-profit Proton Foundation, which the founders endowed with Proton shares in an arrangement they describe as irrevocable. Proton began as a 2014 crowdfunding campaign.