Bitwarden

Bitwarden is the password manager most people should try first. It is fully open source, the free plan has no meaningful limits for personal use, and you can run the whole thing on your own server if you want to. The trade-off is a product that feels engineered rather than designed — it does everything, but a few corners are less polished than the paid-only competition.

Security

Bitwarden encrypts your vault on your device with AES-256 in CBC mode, authenticated with HMAC-SHA-256, before anything reaches its servers. Your encryption key is derived from your master password using PBKDF2-HMAC-SHA-256 at 600,000 iterations on the client by default — the current OWASP recommendation — with more iterations added server-side. Argon2id is available if you prefer a memory-hard function; it is off by default, so switching to it is a deliberate choice.

The AES-CBC-then-HMAC construction is a more conservative choice than the single-pass authenticated-encryption modes (AES-GCM, XChaCha20-Poly1305) some rivals have moved to. The 2025 ETH Zurich audit examined these core cryptography operations directly, under the assumption of a fully malicious server, and Bitwarden publishes the report.

The zero-knowledge model is real and it is strict: Bitwarden states plainly that its employees and systems have “no knowledge of, way to retrieve, or way to reset your master password.” That is the security you want and the risk you accept — forget the master password with no Emergency Access contact set up, and the vault is gone.

Security claims here are unusually well-tested. Bitwarden has commissioned a third-party assessment every year since 2018, most of them by Cure53, covering source code and penetration testing across the core application, browser extension, desktop app and web vault. The 2025 round added the ETH Zurich cryptography audit mentioned above, plus a mobile assessment by Unit 42. Every report is published as a plain PDF with no login, which is not true of every audited competitor.

Privacy & Trust

The codebase — server, clients, browser extension, CLI — is on GitHub, mostly under AGPL-3.0, with a slice of enterprise-only code under a proprietary Bitwarden License. Anyone can read it, and the annual audits mean people with the right skills actually do. The cloud service runs on Microsoft Azure in the US or EU.

What client-side encryption does not cover is metadata. Item names and even URLs are encrypted, which is better than some rivals, but the server still knows which account an item belongs to and how many items you hold — Bitwarden calls this “administrative data” and says it can access it. If hiding the shape of your vault from the host matters to you, that is the gap.

In April 2026 a malicious version of the Bitwarden CLI (2026.4.0) was published to npm for roughly 90 minutes as part of the wider Checkmarx supply-chain campaign. What this actually was: the npm distribution channel for one client was compromised, not Bitwarden’s source code, servers, or stored vaults. Bitwarden’s investigation found no evidence any vault data was touched; the zero-knowledge architecture meant a distribution compromise could not reach vaults regardless; a CVE was issued; and a clean 2026.4.1 shipped the same day. It is a reminder that the npm install path is a real attack surface, and Bitwarden’s response to it was fast and public — but it is not a breach of user data.

Bitwarden, Inc. is a private company in Santa Barbara, California, founded by Kyle Spearrin, who still works there. It holds SOC 2 Type 2, SOC 3, ISO 27001 and a HIPAA compliance audit.

Bitwarden does not document client-side telemetry the way it documents encryption. What is visible: the marketing site runs Google Analytics, and the server necessarily holds administrative data like your item count. The vault contents themselves stay out of reach, but that gap in documentation is why the telemetry picture here is less clear-cut than “collects nothing.”

Features

The free plan already covers what most people need: unlimited passwords on unlimited devices, a password generator, encrypted export, Bitwarden Send for sharing a secret or file directly, and item sharing with one other person. Passkeys work three ways — Bitwarden can store and autofill passkeys for the sites you log into, use a passkey to log in and (with PRF-capable hardware) unlock the vault itself, and act as a passkey for two-factor. Email alias integration with the major alias services is built in on the free tier too.

Paid tiers add depth rather than essentials. Premium ($19.80/year) brings an integrated TOTP authenticator, file attachments, Emergency Access, vault health reports, and two-step login with up to 10 hardware security keys plus Yubico OTP and Duo. Families ($47.88/year) puts six Premium accounts and shared collections under one bill.

Two-factor for unlocking the vault is a genuine strength: TOTP apps, hardware keys, Duo and email are all supported, and hardware-key support is not paywalled to a single key.

Usability & Platforms

Bitwarden runs everywhere that matters: native desktop apps for Windows, macOS and Linux, mobile apps for iOS and Android (with an F-Droid build), browser extensions for every mainstream browser, a full command-line interface, and a web vault. Sync is automatic across all of them.

The apps are functional and occasionally clunky. The desktop client is Electron, autofill on mobile is reliable but fiddlier to set up than the paid-only competition, and the interface exposes a lot of settings rather than hiding them. None of this is a dealbreaker — it is the difference between “works well once configured” and “works well immediately.” Bitwarden is also widely deployed in large organizations, which is a fair signal of how it holds up at scale.

Price & Value

On price, Bitwarden is hard to argue with. The free tier is genuinely complete for a single user, so the honest question is whether Premium’s $19.80 a year is worth it — and for the integrated authenticator, Emergency Access and hardware-key support, for most people it is. Families at $47.88 a year for six accounts undercuts almost everything comparable. There is no introductory rate that jumps at renewal; the price you see is the price you keep paying.

Bitwarden also sells per-seat Teams and Enterprise plans for organizations, which this review does not score — the focus here is personal use.

Pros

• Fully open source, with the entire codebase — server included — on GitHub
• Free tier has no practical limits for one person: unlimited passwords and devices, passkeys, email aliases, encrypted export
• Independent third-party audit every year since 2018, all reports public without a login; 2025 added a malicious-server cryptography audit by ETH Zurich
• Official, extensively documented self-hosting using Bitwarden’s own server software
• Item names and URLs are encrypted client-side, not just passwords
• Strong vault two-factor: hardware keys, TOTP, Duo — not paywalled to one method
• Cheap: $19.80/year Premium, $47.88/year for a family of six, no renewal price jump

Cons

• Vault metadata — item counts, which account an item belongs to — is not encrypted and is accessible to Bitwarden
• Apps are functional rather than polished; mobile autofill setup is fiddlier than paid-only rivals
• The integrated TOTP authenticator, file attachments and Emergency Access are Premium-only
• April 2026 npm supply-chain incident affecting the CLI distribution channel (no vault data exposed, fixed same day)
• Vault encryption uses AES-CBC-then-HMAC rather than a modern authenticated-encryption mode
• No “second secret” beyond the master password — recovery depends entirely on you not losing it

Our Rating

Bitwarden is the default recommendation for a reason: it is open, audited harder than most of its competitors, free enough that many people never need to pay, and self-hostable if you want full control. The apps could be more refined and the server still sees your vault’s metadata, but for the overwhelming majority of people looking for a first password manager, this is the one to beat.

Rating: 8.7/10