Bitwarden vs RoboForm Comparison

• Premium (individual, annual): $19.80/year
• Families (up to 6 users, annual): $47.88/year

• Premium (individual, 1-year): $29.88 per year
• Family (5 accounts, 1-year): $47.75 per year

Penetration test and source-code audit of the Bitwarden core application

600,000 PBKDF2-HMAC-SHA256 iterations by default on the client, plus more server-side (700,000 total for the master password hash); Argon2id is available as an alternative KDF. Item names, notes, URIs, custom field names, TOTP secrets and card/identity data are all encrypted client-side. Vault metadata — which account an item belongs to, the number of items — is not.

The vault is encrypted client-side with AES-256 using a key derived from the Master Password via PBKDF2 with SHA-256 and a random 32-byte salt, at 1,000,000 iterations by default — the same order of magnitude as the highest iteration counts in this category, though PBKDF2 remains a non-memory-hard KDF unlike Argon2. Only a one-way, server-side password derived from the Master Password is ever sent to RoboForm's servers; all encryption and decryption happens locally.

Private US company based in Santa Barbara, California; the parent company of 8bit Solutions LLC. Founded by Kyle Spearrin, who remains Chief Innovation Officer.

Privately held and independently operated since RoboForm's original 2000 release; not venture-backed and never acquired. Headquartered in Fairfax, Virginia, led by CEO Vadim Maslov. Siber Systems also makes GoodSync, a file-synchronization product, alongside RoboForm.