1Password vs Bitwarden

1Password

The security pages name AES-GCM-256 authenticated encryption, PBKDF2-HMAC-SHA256 key derivation, the 128-bit Secret Key combined with the account password, and SRP, and state that end-to-end encryption keeps Secure Data unreadable to the vendor. The independent work is real: ISO 27001, 27017, 27018 and 27701 plus SOC 2 Type 2 certifications, a 2020 ISE penetration test and code review, an Onica architecture audit, unaltered reports published through the Trust Center, and a public HackerOne bug bounty. We found no public information on a field-by-field statement of what is and is not encrypted, on disclosed incident history, or on open-source clients, so it sits just short of the top band.

Bitwarden

The security white paper names the full crypto stack — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at 600,000 iterations with an Argon2id option, RSA-OAEP for sharing — and states data is encrypted on the local device before anything is sent, with servers storing only encrypted data. Third-party reviews run at least yearly with results and SOC 2 material published annually, a HackerOne vulnerability disclosure program exists, and the code is open for anyone to inspect. We found no public information on which fields such as URLs or metadata are or are not encrypted, or on past incidents and their impact.

1Password

Shared vaults carry five item permissions plus a separate manage-vault right that cannot view or edit items, groups, guests confined to a single vault, and business client settings that can switch off export, copy and share, print and item history per vault. Account recovery is documented with its key model: a new Secret Key and account password, two-factor reset, and recover-accounts groups deliberately excluded from automated provisioning to prevent account-wide cryptographic access. We found no public information on time-limited or one-time sharing with external parties or emergency access with a waiting period.

Bitwarden

Sharing runs through organizations with collections, projects, groups and member roles, and moving an item into the organization transfers ownership to it, so shared items stay with the company. Enterprise account recovery is documented down to the key model — the member's encryption key wrapped with the organization's public key as the Account Recovery Key — with role limits on who can recover whom, event logging of recovery actions, and trusted emergency contacts supported. We found no public information on hiding a password while allowing autofill, waiting periods on emergency access, or approval workflows for sensitive items.

1Password

This is close to what I run in Entra ID: Microsoft Entra ID, Okta and Google are named for both OIDC Unlock with SSO using Authorization Code Flow with PKCE and SCIM automated provisioning, deprovisioning in the identity provider suspends the team member, group access is granted and revoked automatically, and email address changes are managed in the provider first. The SSO unlock is described as using encrypted credentials and a device key with no account password, under an overall design in which the vendor states it has no way of decrypting Secure Data. We found no public information naming FIDO2 or hardware security keys for sign-in or passkey unlock of the vault itself, and the SSO key model reads as one sentence rather than a published derivation.

Bitwarden

This is what I judge first, and it is documented properly: SSO speaks SAML 2.0 and OIDC, and the unlock key model is written down — members decrypt with the master password, a device-stored key via trusted devices, or a self-hosted Key Connector — with the vendor stating the identity provider never holds the decryption key and zero-knowledge is retained. SCIM and the Directory Connector keep users and groups in sync with the directory, just-in-time provisioning over SSO is documented, and passkeys can log in to the vault itself and decrypt it when PRF-capable. We found no public information on automated suspension of a member's vault the moment their account is disabled in the directory, which is the piece I would want spelled out before relying on deprovisioning.

1Password

Events Reporting sends sign-in attempts, item usage and audit events to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, with bearer tokens whose expiry and event types are configurable, data retention control, custom dashboards and alerts, and an Events API for anything unlisted, and client policies can enforce export, copy and share, print and item history. Business reports cover sign-in attempts, vault and device usage over twelve months, Watchtower security issues, domain breaches with affected-user notification, and developer-secrets discovery. We found no public information on a master-password or MFA policy, browser-extension policy detail, or compliance report packs aligned to ISO 27001 or NIS2.

Bitwarden

Event logs cover over sixty event types, are retained indefinitely with a 367-day view window, export as CSV or JSON from a public events endpoint, and feed named SIEM targets including Splunk, Microsoft Sentinel and Elastic. Enterprise policies are deep and enforceable — master password requirements, two-step login, SSO, export removal, session timeout, autofill and Send behaviour — and the compliance program is based on an ISO 27001 ISMS with SOC 2 Type 2. The vendor itself cautions that event logs may not suffice for security, legal forensics or auditing purposes for all organizations, and we found no public information on tamper-evidence or alerting on anomalous access.

1Password

Clients cover macOS, Windows, iOS, Android, Linux, the CLI and the browser, hosting is customer-selectable between the EU, US and Canada, offline unlock is available through biometrics, and import paths exist from named competitors including Bitwarden, Dashlane, KeePass and LastPass. Export is the weak point: the captured pages state exported files are stored in plaintext, the CSV path covers only Login and Password items, and unlocking with SSO blocks export until an administrator turns it off for the account. We found no public information on a self-hosted or on-premises vault option or an encrypted full-fidelity export covering all item types including attachments.

Bitwarden

Self-hosting is documented thoroughly — Docker, Kubernetes with a vendor Helm chart, Windows and Linux, standard and lite deployments — described as fitting an existing high-availability and recovery strategy, with clients for Windows, macOS, Linux, ChromeOS, Android, iPhone and iPad. Export covers plaintext and encrypted JSON, CSV, and a zip with attachments for individual vaults, decrypted locally before export, with the exclusions honestly listed (trash items and Sends in no format, organization data only via admin or collection-permission export). We found no public information on a status page with incident history or on vault access continuing through an outage of the cloud service.

1Password

The vendor is proven Canadian: AgileBits Inc. of Toronto, governing law Ontario, with customer support and email hosted primarily in the United States and Canada, and AWS appearing only in a third-party audit description rather than a subprocessor list. There are genuine European elements: vault data can be hosted in the EU at the customer's choice, item sharing data is stored in the EU while shared, a Data Processing Agreement is published, and standard contractual clauses, a DPO contact and a GDPR complaint right are offered. The contracting entity's jurisdiction and ownership are not confirmed on the captured pages, and we found no public information on an EU contracting entity or a published subprocessor list with locations.

Bitwarden

The chain is American at the top: the contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., governed by California law, subject to FTC enforcement, hosted on Microsoft Azure, and certified under the EU-U.S. Data Privacy Framework. The European elements are real but secondary — storage within the European Economic Area and the United States is stated, SCCs are offered as a transfer mechanism, a subprocessor list page is published, and self-hosting on your own infrastructure is described as true data sovereignty. We found no public information on the parent's ownership or on subprocessor locations.

1Password

The captured pricing page publishes no prices and asks buyers to contact the sales team to discuss their environment and receive a quote, so an annual cost cannot be computed from public pages alone. The terms of service describe a per-user model in US dollars billed monthly or yearly with thirty-day payment terms and customer-borne taxes, but the actual amounts sit in an order form rather than on a public page.

Bitwarden

The business tiers are priced publicly — Teams at "$4 per month / per user billed annually" and Enterprise at "$6 per month / per user billed annually", in USD with taxes not included — and the tier placement of the features I care about is discoverable: SSO and enforced policies are Enterprise, event logs start at Teams, and Enterprise includes a free Families plan for all users. A 30-day refund on all paid services and 30 days' notice of price changes are stated in the terms. We found no public information on seat minimums, add-on prices, or licensing for the self-hosted deployment.