1Password vs Bitwarden

1Password

The security pages name AES-GCM-256 encryption, PBKDF2-HMAC-SHA256 key derivation and a 128-bit Secret Key, the privacy policy states the vendor has no way to decrypt Secure Data, and the trust pages show ISO 27001 and SOC 2 certifications, a dated 2020 ISE penetration test with unaltered reports published through a Trust Center, and a public HackerOne bug bounty. The captured pages do not show a field-by-field list of what stays unencrypted, any incident history, or open-source clients, so I place this a notch below the strongest documented designs.

Bitwarden

The security whitepaper names the design end to end — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 with 600,000 iterations or Argon2id, RSA-OAEP for sharing — and states that servers only ever store encrypted data, with the code published openly for anyone to inspect. Third-party reviews run at least once per year and audit results with SOC 2 reports are published and updated annually. What I did not find on the pages I read: a stated list of which fields stay unencrypted, dated audit reports, or any documented past incidents.

1Password

This is what I need for forty people: shared vaults with groups and five permission levels, account recovery documented down to issuing a new Secret Key and password with bulk recovery via CLI and a recommendation to keep two recoverers, and suspension of leavers through identity-provider deprovisioning. Guests restricted to a single vault give me controlled external sharing; we found no public information on time-limited or one-time shares, emergency access with a waiting period, or approval workflows beyond a homepage feature bullet.

Bitwarden

Sharing runs through organizations with collections, projects, groups and access settings, and moving an item into an organization transfers ownership to the company — so a leaver's shared credentials stay with us. Admin account recovery is documented down to the key model: the enrolled member's key is wrapped with the organization's public key, nobody including the admin can see the old master password, every recovery step is logged, and emergency contacts can be designated. Approval workflows and hiding the password while allowing autofill I found no public information on.

1Password

Unlock with SSO is documented down to the OIDC protocol with PKCE and an encrypted-credentials-plus-device-key model, supports Entra ID, Okta, Google and others on the Business plan, and automated provisioning creates users and groups, grants and revokes group access, and suspends leavers, with recovery-capable groups deliberately excluded from automation. Hardware security keys are not named on the captured pages and passkey evidence is thin, so I stop just below the strongest level.

Bitwarden

SSO via SAML 2.0 and OIDC comes with a genuinely clear key story — authentication is decoupled from decryption, the identity provider never holds the decryption key, and members can unlock through trusted devices, their master password, or a self-hosted key connector that is self-hosting only. SCIM and Directory Connector handle user and group provisioning, and passkeys can both log in to and decrypt the vault when PRF-capable. SSO sits in the Enterprise tier only, and I found no public information on automated suspension when a member is deprovisioned.

1Password

Sign-in attempts, item usage and audit events feed named SIEM targets like Splunk, Microsoft Sentinel and Elastic through revocable bearer tokens with retention control, and the report set covers Watchtower password health, domain breaches that notify affected users, devices and adoption. Admin policies govern viewing, copying, exporting, sharing and printing of items; we found no public information on master-password or MFA enforcement, browser-extension policies, or compliance reports aligned to ISO 27001 or NIS2 audits.

Bitwarden

Event logs record over 60 event types, export as CSV or JSON through a public API, feed named SIEM platforms including Splunk, Microsoft Sentinel and Elastic, and retention is stated — indefinite, with a 367-day viewable window — while enforceable policies reach master password requirements, two-step login, export, Send usage and browser-extension behaviour, backed by weak and reused password reports and a Have I Been Pwned check. The vendor itself cautions that event logs may not suffice for security, legal forensics or auditing purposes for all organizations, which tempers what I would hand an auditor.

1Password

Clients cover Windows, macOS, Linux, iOS, Android, browsers and a CLI, the vault region is selectable between the EU, US and Canada, imports are documented from LastPass, Bitwarden, KeePass and other named sources, and a status page is referenced in the terms. The export path worries me as a buyer: exports are unencrypted plaintext, the CSV route only carries Login and Password items, passkeys export only from iOS or Android, and accounts unlocked with SSO cannot export until an administrator intervenes; we found no public information on self-hosting or vault access during a vendor outage.

Bitwarden

Self-hosting is documented properly — Windows, Linux, Docker or Kubernetes with a Helm chart, a standard and a lightweight deployment, and compatibility with all clients — and the client list covers Windows, macOS, Linux, ChromeOS, Android, iPhone and iPad. Export is documented in honest detail across web, browser, desktop, mobile and CLI, though attachments travel only in a zip for individual vaults and trash items and Sends are never included. I found no public information on an EU cloud region choice, a status page with incident history, or vault access during a vendor outage.

1Password

The contracting entity is AgileBits Inc. of Toronto with Ontario governing law, but customers can select EU hosting for their secure data, item sharing data is stored in the EU, and a DPA is published with standard contractual clauses and other transfer safeguards. The captured pages prove support and email hosting in the United States and Canada, imply AWS in the infrastructure, and leave ownership and the wider subprocessor chain unstated, so only part of the chain is European.

Bitwarden

The chain is American: the contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., governed by California law, hosting on Microsoft Azure with storage primarily in the European Economic Area and the United States. Standard Contractual Clauses and Data Privacy Framework certification are stated, a subprocessor list is published, and self-hosting is offered as the escape hatch that takes the vendor out of the data path. Ownership of the company is unstated, and Google Analytics with cross-site linking is in the chain.

1Password

The pricing page I read sends every buyer to the sales team for a tailored Unified Access quote, and no per-user figures appear on the captured pages, so I cannot compute what my forty people would cost or see by price which tier carries SSO. The terms do establish a per-user model in US dollars, monthly or yearly cycles, 30-day payment terms, auto-renewal and non-refundable fees, which keeps this just above the bottom.

Bitwarden

Both business tiers carry public per-user prices — Teams at $4 per month / per user and Enterprise at $6 per month / per user, billed annually in USD with taxes not included — plus a free trial, a 30-day refund policy, and 30 days' notice before price changes take effect. SSO is documented as an Enterprise capability, so the jump for single sign-on is visible and only one tier up from Teams. What I could not compute from the pages I read: seat minimums, add-on prices such as Secrets Manager, and self-hosted licensing.