Bitwarden vs Passbolt

Bitwarden

The security white paper names the full crypto stack — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at 600,000 iterations with an Argon2id option, RSA-OAEP for sharing — and states data is encrypted on the local device before anything is sent, with servers storing only encrypted data. Third-party reviews run at least yearly with results and SOC 2 material published annually, a HackerOne vulnerability disclosure program exists, and the code is open for anyone to inspect. We found no public information on which fields such as URLs or metadata are or are not encrypted, or on past incidents and their impact.

Passbolt

End-to-end encryption is the stated model with OpenPGP named as the standard, secrets encrypted on the client, and users able to bring their own PGP secret key; the entire codebase is open source under AGPL V3, paid edition included. Cure53 audited the front end and back end in 2021 and returned in February 2026 for a white-box audit of the SCIM and Azure AD components with findings, severities and fix versions published, and audit reports are listed every year from 2021 to 2026 alongside a public bug bounty and SOC 2 Type II. I found no public information on a field-by-field statement of what beyond the secrets is encrypted, but open-source clients plus repeated named audits make this design reviewable in a way few products manage.

Bitwarden

Sharing runs through organizations with collections, projects, groups and member roles, and moving an item into the organization transfers ownership to it, so shared items stay with the company. Enterprise account recovery is documented down to the key model — the member's encryption key wrapped with the organization's public key as the Account Recovery Key — with role limits on who can recover whom, event logging of recovery actions, and trusted emergency contacts supported. We found no public information on hiding a password while allowing autofill, waiting periods on emergency access, or approval workflows for sensitive items.

Passbolt

Sharing reaches down to the individual password, with permissions set per item and each secret encrypted once per authorised user, alongside groups, shared folders and role-based access control. Account recovery is an escrow-based feature with admin approval and organisation-wide policies, which names the mechanism even if the detail behind it is thin here. We found no public information on time-limited or one-time sharing with external parties, emergency access with a waiting period, or what happens to a leaver's shared items — the piece I care most about in a joiner-mover-leaver process.

Bitwarden

This is what I judge first, and it is documented properly: SSO speaks SAML 2.0 and OIDC, and the unlock key model is written down — members decrypt with the master password, a device-stored key via trusted devices, or a self-hosted Key Connector — with the vendor stating the identity provider never holds the decryption key and zero-knowledge is retained. SCIM and the Directory Connector keep users and groups in sync with the directory, just-in-time provisioning over SSO is documented, and passkeys can log in to the vault itself and decrypt it when PRF-capable. We found no public information on automated suspension of a member's vault the moment their account is disabled in the directory, which is the piece I would want spelled out before relying on deprovisioning.

Passbolt

SSO is offered with Microsoft, Google, OpenID and AD FS, SCIM plus LDAP provisioning covers users and groups, and multi-factor options include Yubikey, Duo and TOTP on top of the private-key-plus-passphrase default. The SCIM and Azure AD directory synchronisation code was white-box audited by Cure53 in February 2026 before being declared stable — exactly the diligence I want — though those features were still beta and disabled by default at audit time. I found no public information on how the vault key is derived or released under an SSO unlock, on automated suspension of a vault when the account is disabled, or on passkey unlock for the vault itself.

Bitwarden

Event logs cover over sixty event types, are retained indefinitely with a 367-day view window, export as CSV or JSON from a public events endpoint, and feed named SIEM targets including Splunk, Microsoft Sentinel and Elastic. Enterprise policies are deep and enforceable — master password requirements, two-step login, SSO, export removal, session timeout, autofill and Send behaviour — and the compliance program is based on an ISO 27001 ISMS with SOC 2 Type 2. The vendor itself cautions that event logs may not suffice for security, legal forensics or auditing purposes for all organizations, and we found no public information on tamper-evidence or alerting on anomalous access.

Passbolt

The paid editions include an activity log of audit changes, action logs exported as syslog or log files, and enforceable MFA, passphrase, password and password-expiry policies; user activity can be traced precisely and exported to our own monitoring systems. Checks against breached and reused passphrases are present. We found no public information on sharing or export policies, browser-extension behaviour policies, stated log retention, or compliance reports an ISO 27001 or NIS2 audit could consume directly.

Bitwarden

Self-hosting is documented thoroughly — Docker, Kubernetes with a vendor Helm chart, Windows and Linux, standard and lite deployments — described as fitting an existing high-availability and recovery strategy, with clients for Windows, macOS, Linux, ChromeOS, Android, iPhone and iPad. Export covers plaintext and encrypted JSON, CSV, and a zip with attachments for individual vaults, decrypted locally before export, with the exclusions honestly listed (trash items and Sends in no format, organization data only via admin or collection-permission export). We found no public information on a status page with incident history or on vault access continuing through an outage of the cloud service.

Passbolt

Both EU cloud on Google Cloud Platform and self-hosted deployment are documented — deb, RPM, Helm, Docker, a turn-key installer or a VM, from a Raspberry Pi to a high-availability setup — including fully air-gapped operation without an internet connection, with browser extensions across six browsers, iOS and Android apps, a Windows desktop app and a CLI. Export and import cover kdbx and CSV, with migration from the cloud to a self-hosted instance and from the paid to the free version, and a status page exists. We found no public information on macOS or Linux desktop clients, incident history on the status page, or an encrypted full-fidelity export covering all item types including attachments.

Bitwarden

The chain is American at the top: the contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., governed by California law, subject to FTC enforcement, hosted on Microsoft Azure, and certified under the EU-U.S. Data Privacy Framework. The European elements are real but secondary — storage within the European Economic Area and the United States is stated, SCCs are offered as a transfer mechanism, a subprocessor list page is published, and self-hosting on your own infrastructure is described as true data sovereignty. We found no public information on the parent's ownership or on subprocessor locations.

Passbolt

Passbolt SA states it is registered in the Grand Duchy of Luxembourg and subject to Luxembourg and EU data protection law, cloud services are hosted in Europe on Google Cloud Platform with all databases located in Europe, and a data processing agreement is offered with a list of approved processors including their activities, data types, locations and transfer mechanisms. Self-hosting and even air-gapped deployment remove the vendor from the data path entirely. We found no public information on the ownership or parent structure; the chain otherwise runs through Google's EU regions under a US parent, with Cloudflare for caching and the application firewall and AWS SES for transactional email.

Bitwarden

The business tiers are priced publicly — Teams at "$4 per month / per user billed annually" and Enterprise at "$6 per month / per user billed annually", in USD with taxes not included — and the tier placement of the features I care about is discoverable: SSO and enforced policies are Enterprise, event logs start at Teams, and Enterprise includes a free Families plan for all users. A 30-day refund on all paid services and 30 days' notice of price changes are stated in the terms. We found no public information on seat minimums, add-on prices, or licensing for the self-hosted deployment.

Passbolt

The pricing page compares the editions with feature lists per tier, user and instance limits, license type and support service levels, and a free tier plus a free trial are public. We found no public information on per-user prices, billing periods, seat minimums, add-on prices or minimum terms. An annual invoice is therefore not computable from public pages alone.