Bitwarden vs Passbolt

Bitwarden

The security whitepaper names the design end to end — AES-CBC 256 with HMAC-SHA256, PBKDF2 at 600,000 iterations or Argon2id, RSA-OAEP for sharing — and states servers only ever store encrypted data, with third-party reviews at least yearly and SOC 2 Type 2 results published annually, a HackerOne vulnerability disclosure program, and open source to read. What I could not find on the captured pages is a field-by-field statement of what is and is not encrypted including metadata, or any published incident history, so I stop short of the top band.

Passbolt

Secrets are encrypted on the client using the OpenPGP standard — users can even bring their own PGP secret key — and the critical cryptography runs in the browser extension so a compromised server cannot touch it, with everything including the paid edition open source for me to read. Cure53 audited the full stack in 2021 and white-box tested SCIM and directory synchronisation in February 2026 with findings, severities and fix versions published, a bug bounty runs, and independent penetration tests are stated at least annually. What holds it back is the absence of a field-by-field statement of what is and is not encrypted, and the cloud infrastructure audit report is stated to be not public for security reasons.

Bitwarden

Sharing runs through organizations with collections, groups and member roles, and Enterprise account recovery is documented down to the key model: the member's encryption key is wrapped with the organization's public key, the old master password is never visible to anyone, and enrollment, resets and withdrawals are logged, with the owner-versus-admin recovery hierarchy spelled out. Emergency access via trusted contacts exists on paid plans. I found no public information on hiding a password while still allowing autofill, an emergency-access waiting period, or approval workflows for sensitive items, which holds this below the top.

Passbolt

Single items or whole folder trees can be shared with a user or a team under fine-grained controls set at the individual password level, with users, groups and role-based access control in the product and an admin-approved account recovery governed by organisation-wide policies. The captured pages do not enumerate the permission levels, and we found no public information on offboarding, emergency access or time-limited sharing with external parties.

Bitwarden

SSO over SAML 2.0 and OIDC is documented with three decryption paths — master password, device-stored keys through trusted devices, and a self-hosted Key Connector server — and the pages state plainly that the identity provider never holds the decryption key. SCIM and a Directory Connector handle user and group provisioning, just-in-time provisioning is documented, and a PRF-capable passkey can both log in and decrypt the vault. Group sync driving vault permissions is implied by the organization model, but immediate revocation on deprovisioning with a log entry and conditional access are not spelled out in the captured pages.

Passbolt

Single sign-on with Microsoft, Google, OpenID and AD FS, LDAP and SCIM provisioning of users and groups, and multi-factor authentication running from a private-key-plus-passphrase default up to Yubikey, Duo and TOTP are all evidenced, and the SCIM and Azure AD directory synchronisation code was white-box audited by Cure53 in 2026 before the features were declared stable. We found no public information on how the vault key is released behind a single sign-on unlock, on passkey support, or on automated suspension when a user is deprovisioned.

Bitwarden

Over sixty event types are logged for Teams and Enterprise, retained indefinitely with a 367-day view window, and reachable through the web app, CSV export and a public events API, with native integrations to Splunk, Microsoft Sentinel, Elastic, Panther, Rapid7 and Sumo Logic. The policy catalogue is long — master password minimums, mandatory two-step login, removal of export, Send control, session timeout, autofill behaviour — plus Have I Been Pwned checks and weak and reused password reporting. The vendor itself notes the logs may not suffice for legal forensics for all organizations, and I found no public information on tamper-evident storage or an auditor role without secret access.

Passbolt

The paid editions carry an activity log of changes, can push action logs out as syslogs or log files, and user activity can be exported to your own monitoring systems — the shape I want for wiring into my stack — with enforceable passphrase, MFA, password and expiry policies plus health checks and breached-password checks. We found no public information on log retention, named SIEM integration targets, or compliance reports aligned to ISO 27001 or NIS2.

Bitwarden

Self-hosting is documented properly: Docker or Kubernetes with a Bitwarden-developed Helm chart in standard or lite deployments, installable on Windows or Linux, compatible with every client including Linux desktops, with the source open to audit — this is the deployment story I want for my own data centre. Export covers plaintext and encrypted JSON plus CSV, the encrypted export is password-protectable or account-restricted, the CLI can drive it for pipelines, and a zip export includes attachments. But that zip is individual-vault only, no format carries trash items or Sends, individual exports exclude organization data, and the captured pages give nothing on offline access during a vendor outage, a status page, or a documented high-availability configuration for self-hosting — so a lossless exit is not proven.

Passbolt

This is the deployment story I want: self-hosted from deb, rpm, Helm, Docker or a virtual machine — the vendor itself says from a Raspberry Pi to a high-availability setup you run — plus an air-gap option, a European cloud on Google Cloud Platform, a status page, and a CLI, API and SDKs that work against self-hosted instances for CI/CD pipelines. Export covers kdbx and csv and the vendor documents moving from the paid cloud to the free self-hosted edition. Client offline mode is still beta, and we found no public information on export fidelity for attachments, a Linux desktop client, or a documented backup procedure for self-hosted servers.

Bitwarden

The contracting party is 8bit Solutions LLC under California law, wholly owned by Delaware-incorporated Bitwarden Inc., subject to FTC enforcement and leaning on the Data Privacy Framework — the contracting chain is US throughout. The privacy policy names storage primarily in the European Economic Area and the United States, and a documented self-hosting option can remove the vendor from the data path, which keeps this off the bottom. Ownership and subprocessor exposure are marked unknown here; a subprocessor list is referenced but its locations are not shown on the captured pages.

Passbolt

The contracting entity is Passbolt SA, registered in Luxembourg under Luxembourg and EU data protection law, cloud data sits on Google Cloud Platform in Europe, and the data processing agreement ships with a processor list naming activities, data types, locations and transfer mechanisms — combined with the fully open-source, self-hostable server, I can take the vendor out of the data path entirely. Ownership is not stated on the captured pages, and the chain still runs through Google's US parent plus Cloudflare and AWS SES for transactional email, so it is strong but not sovereign end to end.

Bitwarden

The business tiers are priced plainly — Teams at $4 per month per user and Enterprise at $6 per month per user, billed annually in USD with taxes not included — with a 30-day refund on paid services and 30 days' notice of price changes in the terms. What I cannot compute from the captured pages: seat minimums, self-hosted licensing, the Secrets Manager add-on, and the Families plan price, so a complete annual invoice is not derivable from public pages alone.

Passbolt

The tier structure is fully public — community, pro and enterprise with their feature lists, instance limits, update terms, support SLAs and a free starting point — but the captured pricing page states no per-user price, currency, seat minimum, term length or VAT treatment, so I cannot compute an annual invoice from public pages alone.