1Password vs Bitwarden

1Password

The security page names AES-GCM-256, PBKDF2-HMAC-SHA256, a 128-bit Secret Key and SRP authentication, the privacy policy states the vendor cannot decrypt secure data, and the trust pages show SOC 2 Type 2, ISO 27001 plus a public HackerOne bounty and published ISE and Onica assessments. I found no public list of which fields are and are not encrypted, no incident history, no open-source clients, and the vendor states it may withhold a report it has not published.

Bitwarden

The whitepaper is real security documentation: AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at 600,000 iterations or Argon2id, RSA-OAEP for sharing, open-source code, and a HackerOne vulnerability disclosure program, with third-party reviews claimed at least yearly and results said to be published annually. What I did not find is the part post-mortems are made of: a stated list of which fields remain unencrypted, audit reports or summaries with dates and named firms, and any disclosed incident history — a blank record I treat as an answer, not an assurance.

1Password

Shared vaults with five permission levels, groups, guests, granular client settings down to concealing and printing passwords, and an admin recovery that reissues the Secret Key and account password are all documented. I found no statement of who holds which key while an account is mid-recovery, and no time-limited or emergency access with a waiting period on the captured pages.

Bitwarden

Collections, groups, roles and permissions are documented, and account recovery is unusually candid: the member's encryption key is wrapped with the organization's public key, every recovery step is logged, and the old master password is never visible to anyone including the executing administrator — that is a stated key model, and shared items transfer to the organization, so a leaver cannot take them. Emergency access exists but no waiting period is documented on these pages, and I found no public information on hide-password-but-autofill permissions, one-time or time-limited sharing with external parties, or approval workflows for sensitive items.

1Password

SSO over OpenID Connect with named providers, provisioning that creates users, suspends on deprovisioning and revokes group access, and device-trust checks are documented, with the SSO unlock described as encrypted credentials plus a device key. I found no published statement that the vendor cannot derive the vault key under SSO unlock, and no hardware-key MFA named anywhere I read.

Bitwarden

SSO over SAML 2.0 and OIDC with three decryption models documented — master password, trusted devices holding a device-stored key, and a self-hosted Key Connector — plus a flat statement that the identity provider never has access to the decryption key. SCIM and a directory connector handle user and group provisioning with just-in-time members, and passkeys can both unlock the vault (PRF-capable) and be stored in it. The pages leave open which identity providers are specifically supported and what deprovisioning actually revokes, and when.

1Password

Activity flows to sixteen named SIEM targets through an events API with configurable retention and selectable event types, client policies can block export, printing and sharing outside the app, and the reports include breach, Watchtower, adoption and twelve months of usage history. I found no claim that logs are tamper-evident and no auditor role that can read logs without access to secrets.

Bitwarden

Over sixty event types, CSV and JSON export, a public events API, native integrations with six named SIEM platforms, a stated retention of indefinitely with a 367-day viewable window, and a deep enforceable policy catalogue from master password requirements to export removal and browser autofill behaviour. I hold it below the top because the vendor's own documentation warns the event logs may not suffice for security, legal forensics or auditing purposes, with the majority of client events only transmitted every 60 seconds — an auditor should read that sentence twice.

1Password

EU, US or Canadian hosting is selectable, clients cover macOS, Windows, iOS, Android, Linux and the browser, and import paths from named competitors are documented. But the export formats are an unencrypted plaintext file and a CSV limited to Login and Password items, export is blocked entirely under Unlock with SSO, and I found no self-hosted option and no incident history behind the status page on the captured pages.

Bitwarden

Self-hosting is genuinely documented — Windows, Linux, Docker and Kubernetes installs, standard and lite deployments, a Helm chart, and compatibility with all clients — and export is documented down to its limits: plaintext and encrypted JSON, CSV, and a zip with attachments for individual vaults, with trash and Sends excluded and cards, identities and passkeys JSON-only. Clients cover every major platform including Linux. I found no public information on a selectable EU cloud region, a status page with incident history, or vault access continuing during a vendor outage.

1Password

The proven chain is Canadian end to end: AgileBits Inc. headquartered in Toronto, Ontario governing law, customer support and email hosted primarily in the United States and Canada, with AWS visible only inside a third-party audit description. The one European element is a selectable EU hosting region, with item-sharing data stored in the EU while the item is shared.

Bitwarden

Where the chain is proven, it is American: the contracting party is 8bit Solutions LLC under Delaware-incorporated Bitwarden Inc., California governing law, a Santa Barbara address, Microsoft Azure hosting, Data Privacy Framework certification and FTC jurisdiction. European elements exist — storage described as within the EEA and the United States, data processing terms, a published subprocessor list, and a self-hosted option that takes the vendor out of the data path — but ownership, subprocessor locations and residency as a customer choice are unstated on the captured pages.

1Password

The pricing page sends every buyer to a quote — "Unified Access pricing is tailored to your organization's needs" — and I found no public price figure for any tier on the captured pages. The terms describe only the shape of the bill: per user, monthly or yearly cycles, US dollars, taxes invoiced separately, and fees that are non-refundable.

Bitwarden

Two business tiers are priced publicly and cleanly — $4 per month per user for Teams and $6 for Enterprise, billed annually in USD with taxes not included — with feature lists per tier, a 30-day refund policy and 30 days' notice of price changes. I found no public information on seat minimums, add-on prices such as the Secrets Manager, self-hosted licensing, or the personal-tier prices on the captured pages, so the full annual invoice is not yet computable.