Bitwarden vs Passbolt

Bitwarden

The security whitepaper names the ciphers and key derivation in detail — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at a 600,000-round default or optional Argon2id, RSA-OAEP for sharing — states the zero-knowledge model with local encryption before upload, and yearly third-party reviews with results published annually, a HackerOne vulnerability disclosure program and open-source clients and server are all documented. We found no public information on a field-by-field statement of what is and is not encrypted including URLs and metadata, on the names of the auditing firms, or on past security incidents, so I cannot place it on the highest anchors.

Passbolt

End-to-end encryption on the OpenPGP standard with client-side encryption and a fully open-source codebase is documented, and Cure53 audits in 2021 and February 2026 are published with findings, severities and fix versions, alongside a bug bounty, a maintained security whitepaper, SOC 2 Type II and an ANSSI CSPN certification in progress. For an ISO 27001 file I still miss a stated list of which fields, including URLs and metadata, are encrypted, a named key-derivation method, and documentation of past security incidents with their impact.

Bitwarden

Organizations with collections, projects, groups and member roles are documented, and Enterprise account recovery is published with its key model — the member's encryption key wrapped with the organization's public key — with recovery events logged, a stated role hierarchy, and emergency contacts on paid plans. We found no public information on hiding the password while allowing autofill, time-limited or one-time sharing with external parties, the emergency-access waiting period, or documented offboarding of a leaver's shared items.

Passbolt

Granular sharing down to a single item or a whole folder tree with permissions set per password, users and groups with role-based access control, and admin-approved account recovery under an escrow key model are documented, together with just-in-time access and instant cryptographic revocation for privileged accounts. We found no public information on offboarding and what happens to a leaver's shared items, view-only or time-limited sharing with external parties, or emergency access with a waiting period.

Bitwarden

SSO over SAML 2.0 and OIDC with SCIM and Directory Connector provisioning is documented, and the unlock key model is unusually well published — master password, trusted devices with device-stored keys, or a self-hosted key connector — with the vendor stating the identity provider never holds the decryption key and passkey unlock via PRF-capable passkeys supported. We found no public information on hardware-key two-step methods, automated suspension on deprovisioning, or conditional access and device policies.

Passbolt

SSO is offered with Microsoft, Google, OpenID and AD FS, directory synchronisation runs through LDAP and SCIM provisioning, multi-factor options include Yubikey hardware keys, and the SCIM and Azure AD components were white-box audited by Cure53 in February 2026, which is diligence I rarely see. We found no public information on how the vault key is derived or released behind an SSO unlock, automated suspension on deprovisioning, conditional access or device policies, or passkey support.

Bitwarden

Event logs with over 60 event types are available through the web app and a public API endpoint with CSV and JSON export, native integrations to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, indefinite retention with a 367-day viewable window, and a broad enforceable policy set covering master password requirements, two-step login, export removal, Send management, session timeout and browser-extension autofill behaviour. The vendor itself states the logs may not suffice for security, legal forensics or auditing purposes because client events reach the server only every 60 seconds, and we found no public information on logging of individual views or copies, tamper-evident storage, or an ISO 27001 certification statement — only a security programme based on that standard.

Passbolt

An activity log auditing changes, action logs delivered as syslogs or log files, export of user activity to the customer's own monitoring systems with real-time monitoring, and enforceable passphrase, MFA and password-expiry policies are documented, with a health check and breached-password screening. For an ISO 27001 or NIS2 audit I still need explicit coverage of views and copies in the event log, a stated log retention period, enforceable policies for sharing and export, and compliance reporting aligned to those frameworks.

Bitwarden

Self-hosting is thoroughly documented for Windows, Linux, Docker and Kubernetes with standard and lite deployments, a Helm chart and a fit into existing high-availability strategies, alongside Linux clients and a multi-format export including an encrypted JSON and a ZIP with attachments. The captured pages note exclusions from export — trash items and Sends, and attachments ZIP for the individual vault only — and we found no public information on a selectable EU cloud region, a status page, or continued access during an outage of the vendor's cloud, though the privacy policy states storage primarily within the European Economic Area and the United States.

Passbolt

Both a European cloud on Google Cloud Platform and self-hosting are documented with on-premises installers, Docker containers, virtual machines and Linux packages, air-gapped operation is possible, offline mode is in beta, a status page exists, and export and import cover kdbx and CSV including moving from the cloud to a self-hosted instance. We found no public information on an encrypted full-fidelity export covering all item types and attachments, and no confirmation of macOS or Linux desktop clients.

Bitwarden

The contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., under California governing law, processing on Microsoft Azure — proven non-EU on entity and governing law — while a self-hosted option that can take the vendor out of the data path and a published subprocessor list URL are documented. Parent ownership, confirmed data residency and subprocessor locations are unknown in what we captured, so one European element with the rest unstated is the level the evidence reaches.

Passbolt

The contracting entity is registered in the Grand Duchy of Luxembourg, cloud data sits in Google Cloud Platform's European regions, a data processing agreement maintains a processor list naming activities, locations and transfer mechanisms, and self-hosting removes the vendor from the data path entirely. Exposure still runs through Google's US parent and AWS SES for transactional email, we found no public information on the ownership chain, and no statement that the data processing agreement covers vault metadata and logs.

Bitwarden

Both business tiers are publicly priced per user with the billing period and tax treatment stated — Teams at "$4 per month / per user billed annually" and Enterprise at "$6 per month / per user billed annually", in USD with taxes not included — and tier gating is traceable across the help pages, with SSO and account recovery Enterprise-only and event logs from Teams upward. We found no public information on seat minimums, add-on prices such as Secrets Manager, or self-hosted licensing, which keeps a full annual invoice from being computable.

Passbolt

A free community edition is publicly offered with feature lists per edition, user and instance limits, and support SLA terms, but we found no public per-user prices for the paid editions, no seat minimums, add-on prices, minimum term or VAT treatment. A buyer cannot compute a real annual cost from the published pages alone.