1Password vs Bitwarden

1Password

The security page names AES-GCM-256, PBKDF2-HMAC-SHA256, a 128-bit Secret Key and the SRP protocol, links a Security Design White Paper, and states the vendor has no way of decrypting secure data; ISO 27001/27017/27018/27701, SOC 2 type 2, a public HackerOne bug bounty and published unaltered audit reports (ISE 2020, Onica) are all on the record. Before going higher I'd want the field-by-field encryption scope including URLs and metadata, incident history, and client source code I can read myself.

Bitwarden

The security whitepaper names the design end to end — AES-CBC 256 with HMAC-SHA256, PBKDF2 at 600,000 iterations or Argon2id, RSA-OAEP for sharing — and states servers only ever store encrypted data, with third-party reviews at least yearly and SOC 2 Type 2 results published annually, a HackerOne vulnerability disclosure program, and open source to read. What I could not find on the captured pages is a field-by-field statement of what is and is not encrypted including metadata, or any published incident history, so I stop short of the top band.

1Password

Vaults shared with team members, groups and single-vault guests, five item-level permissions on Business plus a separate Manage Vault permission, client settings that can switch off password viewing, export, printing and sharing outside 1Password, and recovery documented in real depth — new Secret Key and account password, 2FA reset, bulk recovery through the CLI, self-recovery codes and per-domain notification routing. I found no public information on time-limited or one-time sharing with external parties or an emergency-access waiting period.

Bitwarden

Sharing runs through organizations with collections, groups and member roles, and Enterprise account recovery is documented down to the key model: the member's encryption key is wrapped with the organization's public key, the old master password is never visible to anyone, and enrollment, resets and withdrawals are logged, with the owner-versus-admin recovery hierarchy spelled out. Emergency access via trusted contacts exists on paid plans. I found no public information on hiding a password while still allowing autofill, an emergency-access waiting period, or approval workflows for sensitive items, which holds this below the top.

1Password

Unlock with SSO runs over OpenID Connect with PKCE against a long list of identity providers and describes the device-key model for the unlock, while automated provisioning from named providers creates users and groups, syncs access, and suspends people on deprovisioning — with provisioning deliberately excluded from groups holding account-wide cryptographic permissions. I found no public information on FIDO2 or hardware-key MFA in the captured pages, which holds this below the top band.

Bitwarden

SSO over SAML 2.0 and OIDC is documented with three decryption paths — master password, device-stored keys through trusted devices, and a self-hosted Key Connector server — and the pages state plainly that the identity provider never holds the decryption key. SCIM and a Directory Connector handle user and group provisioning, just-in-time provisioning is documented, and a PRF-capable passkey can both log in and decrypt the vault. Group sync driving vault permissions is implied by the organization model, but immediate revocation on deprovisioning with a log entry and conditional access are not spelled out in the captured pages.

1Password

Events reporting pushes sign-in attempts, item usage and audit events to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, with a documented Events API for building your own client, configurable token expiry and revocation, and data retention control — that is pipeable into my stack. Breach, device, usage and developer-secrets reports exist, but the pages say most of them sit in the Business plan only, and I found no public information on enforceable master-password or MFA policies or browser-extension policy controls.

Bitwarden

Over sixty event types are logged for Teams and Enterprise, retained indefinitely with a 367-day view window, and reachable through the web app, CSV export and a public events API, with native integrations to Splunk, Microsoft Sentinel, Elastic, Panther, Rapid7 and Sumo Logic. The policy catalogue is long — master password minimums, mandatory two-step login, removal of export, Send control, session timeout, autofill behaviour — plus Have I Been Pwned checks and weak and reused password reporting. The vendor itself notes the logs may not suffice for legal forensics for all organizations, and I found no public information on tamper-evident storage or an auditor role without secret access.

1Password

Client coverage is complete for my purposes — macOS, Windows, Linux, iOS, Android, browsers and a CLI — the vault region is customer-selectable between EU, US and Canada, and export and import are documented down to the field, including migration from named competitors. But the export is stated to be stored in plaintext, CSV drops security questions, linked items and custom fields, passkeys export only from iOS and Android, and an SSO unlock blocks export until an admin turns it off; I found no public information on a self-hosted vault, high-availability deployment, or vault access continuing during a vendor outage.

Bitwarden

Self-hosting is documented properly: Docker or Kubernetes with a Bitwarden-developed Helm chart in standard or lite deployments, installable on Windows or Linux, compatible with every client including Linux desktops, with the source open to audit — this is the deployment story I want for my own data centre. Export covers plaintext and encrypted JSON plus CSV, the encrypted export is password-protectable or account-restricted, the CLI can drive it for pipelines, and a zip export includes attachments. But that zip is individual-vault only, no format carries trash items or Sends, individual exports exclude organization data, and the captured pages give nothing on offline access during a vendor outage, a status page, or a documented high-availability configuration for self-hosting — so a lossless exit is not proven.

1Password

The contracting entity is AgileBits Inc. of Toronto under Ontario governing law, customer support and email services run in the United States and Canada, and AWS appears in a third-party audit description of the infrastructure. An EU vault region is selectable, a DPA is published, and standard contractual clauses, adequacy decisions and binding corporate rules are cited for transfers — but no EU contracting entity and no subprocessor list with locations appear in the captured pages.

Bitwarden

The contracting party is 8bit Solutions LLC under California law, wholly owned by Delaware-incorporated Bitwarden Inc., subject to FTC enforcement and leaning on the Data Privacy Framework — the contracting chain is US throughout. The privacy policy names storage primarily in the European Economic Area and the United States, and a documented self-hosting option can remove the vendor from the data path, which keeps this off the bottom. Ownership and subprocessor exposure are marked unknown here; a subprocessor list is referenced but its locations are not shown on the captured pages.

1Password

The pricing page itself states that pricing is tailored to the organization's needs and requires a sales quote, and I found no published price figure anywhere in the captures. The terms document the mechanics — per-user fees in US dollars, monthly or yearly billing, 30-day payment terms, taxes separately invoiced and fees non-refundable — but nothing on these pages lets me compute an annual invoice.

Bitwarden

The business tiers are priced plainly — Teams at $4 per month per user and Enterprise at $6 per month per user, billed annually in USD with taxes not included — with a 30-day refund on paid services and 30 days' notice of price changes in the terms. What I cannot compute from the captured pages: seat minimums, self-hosted licensing, the Secrets Manager add-on, and the Families plan price, so a complete annual invoice is not derivable from public pages alone.