1Password vs Bitwarden

1Password

A Security Design White Paper, named algorithms (AES-GCM-256, PBKDF2-HMAC-SHA256, SRP), a 128-bit Secret Key combined with the account password, ISO 27001 and SOC 2 Type 2 certifications, an ISE penetration test with 2020 dates, a public HackerOne bug bounty and a stated policy of publishing unaltered annual pentest reports — that is a serious, largely provable posture. I stop short of the top band because I found no public information on which fields are and are not encrypted (including URLs and metadata), on past security incidents and their impact, or on reviewable client source code, and the only named, dated assessment is from 2020.

Bitwarden

The security whitepaper names AES-CBC 256-bit with HMAC-SHA256, key derivation by PBKDF2 with 600,000 iterations or Argon2id, local encryption before anything reaches the servers, and a zero-knowledge claim; SOC 2 Type 2, third-party reviews at least once per year with results published annually, a HackerOne vulnerability disclosure program, and open-source code are all on the record. We found no public information stating which fields are and are not encrypted including URLs and metadata, naming the auditing firms with dates, or documenting past security incidents and their impact.

1Password

Vault sharing with groups and guests, five granular item permissions on Business plus client settings that can conceal passwords while allowing other actions, and account recovery documented down to key rotation (new Secret Key, new account password, two-factor reset, bulk recovery via CLI), with deprovisioning-based suspension for leavers. I found no public information on time-limited or one-time sharing with external parties, emergency access with a waiting period, or delegated administration per team or location; access requests appear only as a feature name on the homepage.

Bitwarden

Organizations, collections, projects, groups and member roles with permission levels are documented, and Enterprise account recovery is described down to its key model — the member's key wrapped with the organization's public key, the old master password never visible, and recovery actions logged. Emergency access contacts, ownership transfer on sharing, and reclaim paths for shared items are stated; we found no public information on time-limited one-time sharing with external parties, hiding the password while allowing autofill, or approval workflows for sensitive items.

1Password

Unlock with SSO over OIDC with PKCE, a described encrypted-credentials-and-device-key model, named providers (Entra ID, Okta, Google, Duo, Ping among others), provisioning that suspends users on deprovisioning with immediate confirmation, and explicit guardrails keeping automated provisioning away from account-wide cryptographic access. Weaker spots: I found no public information on MFA with FIDO2 or hardware keys; the pages state only one identity provider can be configured, SSO unlock requires an internet connection (biometrics allowed for offline), and Owners cannot use SSO at all; passkey support surfaces only as an export restriction on iOS and Android.

Bitwarden

SSO over SAML 2.0 and OIDC for Enterprise organizations, SCIM and the Directory Connector for user and group provisioning, and passkey login that decrypts the vault on PRF-capable keys are all documented. The SSO unlock is published with three decryption options — master password, trusted devices, and a self-hosted key server — together with the statement that the identity provider never holds the decryption key; we found no public information on automated suspension at deprovisioning, conditional access or device policies, or an independent review of the SSO key model.

1Password

An Events API covering sign-in attempts, item usage and audit events, native integrations to sixteen named SIEM providers including Splunk, Microsoft Sentinel and Elastic, bearer tokens with configurable expiry and event scopes, retention control, Watchtower and domain breach reports, and Business client settings that can block export, printing and sharing outside the product. I found no public information on enforceable master-password or MFA policies, on browser-extension behaviour policies, or on compliance reports a customer could use in an ISO 27001 or NIS2 audit; most reports and the audit log are Business-plan features.

Bitwarden

Over sixty event types for Teams and Enterprise, export as CSV or JSON through the public API, native SIEM integrations named to Splunk, Microsoft Sentinel, Elastic and others, a stated retention of indefinite with a 367-day view window, and enforceable policies for master password, two-step login, export and browser autofill behaviour are documented, with an ISO 27001-based ISMS and SOC 2 Type 2 stated. The vendor itself writes that its event logs may not suffice for security, legal forensics or auditing purposes, and we found no public information on tamper-evident logs or an auditor role that can read them without access to secrets.

1Password

Clients for macOS, Windows, iOS, Android, Linux, browsers and CLI, a customer-selectable EU, US or Canada region, a status page, and documented export plus import from named competitors give real portability. The export path is where I hesitate: the pages state exported files are not encrypted and are stored in plaintext, CSV covers only Login and Password items with named excluded fields, export is blocked while SSO unlock is on, and passkeys export only on iOS and Android; I found no public information on a self-hosted vault option, status-page incident history, an encrypted full-fidelity export, or access during a vendor outage.

Bitwarden

Self-hosting is documented in depth — standard and lite deployments across Windows, Linux, Docker and Kubernetes with a Helm chart — alongside clients for Windows, macOS, Linux, ChromeOS, Android and iPhone plus a CLI, and export in four formats including an encrypted JSON option and a ZIP with attachments. The export documentation itself states that no format includes trash items or Sends, that cards, identities and stored passkeys travel only in JSON, and that ZIP export covers individual vaults only; we found no public information on an EU cloud region choice, a status page with incident history, or vault access continuing during a vendor outage.

1Password

The contracting entity is AgileBits Inc. of Toronto under Ontario and Canadian law, with support and email hosted primarily in the United States and Canada — but EU hosting is customer-selectable, item-sharing data is stored in the EU while an item is shared, a Data Processing Agreement is published, and transfer safeguards include SCCs, adequacy decisions and binding corporate rules. I found no public information on an EU contracting entity or representative or on a published subprocessor list with locations; AWS appears only inside a third-party audit description rather than a declared list.

Bitwarden

The contracting party is 8bit Solutions LLC under California law with Delaware-incorporated Bitwarden Inc. as parent, the service runs on Microsoft Azure, and the vendor is subject to FTC enforcement; a self-hosted option and storage of collected information in the EEA and the United States are stated, giving one European element. Ownership, vault data residency and subprocessor locations are unknown on the captured pages, which show only a link to a subprocessor list and SCC or Data Privacy Framework transfer mechanisms.

1Password

The pricing page itself states that pricing is tailored to the organization and a sales quote is required — no per-user figure for any tier is public, so a buyer cannot compute an annual cost from what I read. The terms do document the commercial model in detail: per-user fees quoted in US dollars, monthly or yearly billing, net-thirty payment terms, quarterly reconciliation for added users, taxes borne by the customer and separately invoiced, non-refundable fees, automatic renewal and a suspension right after thirty days overdue.

Bitwarden

Both business tiers carry public per-user prices — $4 per month / per user billed annually for Teams and $6 per month / per user billed annually for Enterprise — shown in USD with taxes not included, plus a 30-day refund policy and 30-day notice of price changes. We found no public information on seat minimums, add-on prices such as Secrets Manager or a self-hosting licence, or a full feature breakdown per tier on the pricing page; which features sit in which plan must be pieced together from the help documentation.