1Password vs Bitwarden

1Password

The security page names AES-GCM-256 authenticated encryption, PBKDF2-HMAC-SHA256 key derivation and the 128-bit Secret Key combined with the account password, and the terms state the vendor has no way of decrypting Secure Data. Independent assurance is strong — ISO 27001/27017/27018/27701, SOC 2 Type 2, a dated 2020 ISE penetration test and code review, annual pentest reports published unaltered through the Trust Center, and a public HackerOne bug bounty. We found no public information on a field-by-field statement of what is and is not encrypted, on documented incident history, or on open-source clients or cryptography.

Bitwarden

The security whitepaper names the ciphers and key derivation in detail — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at a 600,000-round default or optional Argon2id, RSA-OAEP for sharing — states the zero-knowledge model with local encryption before upload, and yearly third-party reviews with results published annually, a HackerOne vulnerability disclosure program and open-source clients and server are all documented. We found no public information on a field-by-field statement of what is and is not encrypted including URLs and metadata, on the names of the auditing firms, or on past security incidents, so I cannot place it on the highest anchors.

1Password

Shared vaults carry five granular item permissions in the Business plan, with a Manage Vault permission deliberately separated from viewing and editing, and account recovery is documented down to its key model: a new Secret Key and account password, 2FA reset, CLI bulk recovery, and recovery delegated to custom groups. Client settings can be enforced for viewing and copying passwords, export, import, move, print and sharing outside 1Password. We found no public information on time-limited or one-time sharing with external parties, or on emergency access with a waiting period.

Bitwarden

Organizations with collections, projects, groups and member roles are documented, and Enterprise account recovery is published with its key model — the member's encryption key wrapped with the organization's public key — with recovery events logged, a stated role hierarchy, and emergency contacts on paid plans. We found no public information on hiding the password while allowing autofill, time-limited or one-time sharing with external parties, the emergency-access waiting period, or documented offboarding of a leaver's shared items.

1Password

Unlock with SSO is documented with named identity providers over OpenID Connect using Authorization Code Flow with PKCE, and its key handling is described — encrypted credentials and a device key replace the account password, with the Owners group excluded to prevent lockout. Automated provisioning with Entra ID, Okta, Google Workspace, JumpCloud and OneLogin creates users and groups, grants and revokes group access, and suspends members on deprovisioning, while account-wide cryptographic permissions are deliberately kept out of automated hands. Device trust policies and passkeys are documented; we found no public information on MFA hardware-key options.

Bitwarden

SSO over SAML 2.0 and OIDC with SCIM and Directory Connector provisioning is documented, and the unlock key model is unusually well published — master password, trusted devices with device-stored keys, or a self-hosted key connector — with the vendor stating the identity provider never holds the decryption key and passkey unlock via PRF-capable passkeys supported. We found no public information on hardware-key two-step methods, automated suspension on deprovisioning, or conditional access and device policies.

1Password

Events Reporting delivers sign-in attempts, item usage and audit events to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, with bearer tokens whose expiry and event scopes are configurable, data retention control, custom alerts, and a path to build a custom client through the Events API. Reports cover Watchtower, domain breaches with notification of affected users, devices, developer secrets and twelve months of usage, while Business client settings enforce export, import, copy, share and print behaviour. We found no public information on an enforceable master-password or MFA policy, or on compliance reporting aligned to ISO 27001 or NIS2 control sets.

Bitwarden

Event logs with over 60 event types are available through the web app and a public API endpoint with CSV and JSON export, native integrations to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, indefinite retention with a 367-day viewable window, and a broad enforceable policy set covering master password requirements, two-step login, export removal, Send management, session timeout and browser-extension autofill behaviour. The vendor itself states the logs may not suffice for security, legal forensics or auditing purposes because client events reach the server only every 60 seconds, and we found no public information on logging of individual views or copies, tamper-evident storage, or an ISO 27001 certification statement — only a security programme based on that standard.

1Password

Clients cover macOS, Windows, iOS, Android, Linux, the CLI and the major browsers, Secure Data hosting is customer-selectable across the EU, US and Canada, and a status page is named in the terms. Export is documented in detail but plaintext — the 1PUX and CSV paths are stated to be unencrypted, CSV drops everything but Login and Password items with the excluded fields named, and export is blocked for accounts unlocked with SSO until an administrator turns it off. We found no public information on a self-hosted vault deployment or an encrypted full-fidelity export covering all item types.

Bitwarden

Self-hosting is thoroughly documented for Windows, Linux, Docker and Kubernetes with standard and lite deployments, a Helm chart and a fit into existing high-availability strategies, alongside Linux clients and a multi-format export including an encrypted JSON and a ZIP with attachments. The captured pages note exclusions from export — trash items and Sends, and attachments ZIP for the individual vault only — and we found no public information on a selectable EU cloud region, a status page, or continued access during an outage of the vendor's cloud, though the privacy policy states storage primarily within the European Economic Area and the United States.

1Password

The contracting entity is AgileBits Inc. of Toronto under Ontario governing law, while Secure Data hosting is customer-selectable in the EU, US or Canada, a DPA is published, item-sharing data is stored in the EU, and direct billing runs through a 1Password.eu website. Customer support and email are hosted primarily in the United States and Canada, the payment processor is unnamed, and AWS appears only inside a third-party audit description rather than a declared subprocessor list. We found no public information on an EU contracting entity or representative, on ownership, or on a subprocessor list with locations.

Bitwarden

The contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., under California governing law, processing on Microsoft Azure — proven non-EU on entity and governing law — while a self-hosted option that can take the vendor out of the data path and a published subprocessor list URL are documented. Parent ownership, confirmed data residency and subprocessor locations are unknown in what we captured, so one European element with the rest unstated is the level the evidence reaches.

1Password

The captured pricing page routes every purchase through a sales quote — Unified Access pricing is tailored to the organization and the buyer is told to contact the sales team to receive a quote — and we found no public per-user price or priced tier in any captured page. The terms do document the commercial mechanics: per-user fees quoted and payable in US dollars, monthly or yearly billing cycles, thirty-day payment terms, quarterly reconciliation for additional users, taxes borne by the customer and separately invoiced, non-cancelable and non-refundable fees with discretionary refunds, and AWS Marketplace as a purchasing channel.

Bitwarden

Both business tiers are publicly priced per user with the billing period and tax treatment stated — Teams at "$4 per month / per user billed annually" and Enterprise at "$6 per month / per user billed annually", in USD with taxes not included — and tier gating is traceable across the help pages, with SSO and account recovery Enterprise-only and event logs from Teams upward. We found no public information on seat minimums, add-on prices such as Secrets Manager, or self-hosted licensing, which keeps a full annual invoice from being computable.