Bitwarden vs Passbolt

Bitwarden

The security whitepaper names AES-CBC 256-bit with HMAC-SHA256, key derivation by PBKDF2 with 600,000 iterations or Argon2id, local encryption before anything reaches the servers, and a zero-knowledge claim; SOC 2 Type 2, third-party reviews at least once per year with results published annually, a HackerOne vulnerability disclosure program, and open-source code are all on the record. We found no public information stating which fields are and are not encrypted including URLs and metadata, naming the auditing firms with dates, or documenting past security incidents and their impact.

Passbolt

Cure53 audits with dates and published results, an annual independent penetration test, a bug bounty, SOC 2 Type II, fully open-source code under AGPL V3 and a February 2026 security disclosure with findings, severities, fix versions and even a documented won't-fix — that is a disclosure posture I can defend to a board. It stops short of full verification: no captured page states which fields, including URLs and metadata, are encrypted and which are not, and the cloud infrastructure audit of July 2021 was withheld rather than published.

Bitwarden

Organizations, collections, projects, groups and member roles with permission levels are documented, and Enterprise account recovery is described down to its key model — the member's key wrapped with the organization's public key, the old master password never visible, and recovery actions logged. Emergency access contacts, ownership transfer on sharing, and reclaim paths for shared items are stated; we found no public information on time-limited one-time sharing with external parties, hiding the password while allowing autofill, or approval workflows for sensitive items.

Passbolt

Permissions set at the level of an individual password, shared folders and subfolders, users, groups and role-based access control, and admin-approved account recovery under an escrow model are all documented. I found no public information on emergency access with a waiting period, one-time or time-limited sharing with external parties, or view-only access that hides the secret while autofill still works.

Bitwarden

SSO over SAML 2.0 and OIDC for Enterprise organizations, SCIM and the Directory Connector for user and group provisioning, and passkey login that decrypts the vault on PRF-capable keys are all documented. The SSO unlock is published with three decryption options — master password, trusted devices, and a self-hosted key server — together with the statement that the identity provider never holds the decryption key; we found no public information on automated suspension at deprovisioning, conditional access or device policies, or an independent review of the SSO key model.

Passbolt

Single sign-on is offered with Microsoft, Google, OpenID and AD FS, provisioning covers LDAP, SCIM and Azure AD, multi-factor options include Yubikey, and the vendor had the SCIM and directory synchronisation surface white-box audited by Cure53 before declaring it stable — exactly the discipline I look for. The captured pages do not document how the vault key is derived or released under single sign-on, and I found no public information on passkey storage or conditional access and device policies.

Bitwarden

Over sixty event types for Teams and Enterprise, export as CSV or JSON through the public API, native SIEM integrations named to Splunk, Microsoft Sentinel, Elastic and others, a stated retention of indefinite with a 367-day view window, and enforceable policies for master password, two-step login, export and browser autofill behaviour are documented, with an ISO 27001-based ISMS and SOC 2 Type 2 stated. The vendor itself writes that its event logs may not suffice for security, legal forensics or auditing purposes, and we found no public information on tamper-evident logs or an auditor role that can read them without access to secrets.

Passbolt

An activity log of audited changes, exportable to the customer's own monitoring systems and as syslogs or log files, enforceable passphrase, MFA and password-expiry policies, and health check with breached-password screening give an administrator real teeth. I found no public information on named SIEM destinations, stated log retention, sharing or export policies, or compliance reporting aligned to ISO 27001 or NIS2.

Bitwarden

Self-hosting is documented in depth — standard and lite deployments across Windows, Linux, Docker and Kubernetes with a Helm chart — alongside clients for Windows, macOS, Linux, ChromeOS, Android and iPhone plus a CLI, and export in four formats including an encrypted JSON option and a ZIP with attachments. The export documentation itself states that no format includes trash items or Sends, that cards, identities and stored passkeys travel only in JSON, and that ZIP export covers individual vaults only; we found no public information on an EU cloud region choice, a status page with incident history, or vault access continuing during a vendor outage.

Passbolt

Cloud hosting in Europe on Google Cloud and a self-hosted path documented down to packages, containers, a virtual machine and air-gapped deployment from a Raspberry Pi to a high-availability setup, with a status page, an offline mode, browser extensions across six browsers, mobile and desktop apps, a command line, and import and export including kdbx and csv plus a cloud-to-self-hosted move. I found no public information on an encrypted full-fidelity export covering all item types and attachments.

Bitwarden

The contracting party is 8bit Solutions LLC under California law with Delaware-incorporated Bitwarden Inc. as parent, the service runs on Microsoft Azure, and the vendor is subject to FTC enforcement; a self-hosted option and storage of collected information in the EEA and the United States are stated, giving one European element. Ownership, vault data residency and subprocessor locations are unknown on the captured pages, which show only a link to a subprocessor list and SCC or Data Privacy Framework transfer mechanisms.

Passbolt

Passbolt SA is registered in the Grand Duchy of Luxembourg, cloud data sits on Google Cloud Platform in Europe, a data processing agreement with an approved processor list including activities, locations and safeguards is published, and self-hosting can remove the vendor from the data path entirely. Ownership is not evidenced anywhere I read, and Cloudflare plus AWS SES for transactional email appear in the processing chain, so the chain is not European end to end.

Bitwarden

Both business tiers carry public per-user prices — $4 per month / per user billed annually for Teams and $6 per month / per user billed annually for Enterprise — shown in USD with taxes not included, plus a 30-day refund policy and 30-day notice of price changes. We found no public information on seat minimums, add-on prices such as Secrets Manager or a self-hosting licence, or a full feature breakdown per tier on the pricing page; which features sit in which plan must be pieced together from the help documentation.

Passbolt

The pricing page lays out feature sets and edition limits — instances, users, licence type, support levels — and a free community edition is public, so a buyer can compare tiers. I found no public price for any paid tier: no per-user figure, no billing period, no seat minimum, no minimum term and no VAT treatment, so the real annual cost of a business deployment cannot be computed from these pages.