Bitwarden vs Passbolt

Bitwarden

The whitepaper is real security documentation: AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at 600,000 iterations or Argon2id, RSA-OAEP for sharing, open-source code, and a HackerOne vulnerability disclosure program, with third-party reviews claimed at least yearly and results said to be published annually. What I did not find is the part post-mortems are made of: a stated list of which fields remain unencrypted, audit reports or summaries with dates and named firms, and any disclosed incident history — a blank record I treat as an answer, not an assurance.

Passbolt

End-to-end encryption is described with the mechanism named — OpenPGP, secrets encrypted on the client, the private key never sent to the server in cleartext, users able to bring their own key — and everything is open source, so the claims are reviewable. The audits are recurring and current: Cure53 audited the whole stack in 2021 and returned in February 2026 to white-box the SCIM and Azure AD code, publishing findings, severities and fix versions. What keeps this short of the top: we found no public statement of which fields stay unencrypted (URLs, metadata), the cloud infrastructure audit report is explicitly withheld, and the SOC 2 report is only available to customers on demand.

Bitwarden

Collections, groups, roles and permissions are documented, and account recovery is unusually candid: the member's encryption key is wrapped with the organization's public key, every recovery step is logged, and the old master password is never visible to anyone including the executing administrator — that is a stated key model, and shared items transfer to the organization, so a leaver cannot take them. Emergency access exists but no waiting period is documented on these pages, and I found no public information on hide-password-but-autofill permissions, one-time or time-limited sharing with external parties, or approval workflows for sensitive items.

Passbolt

Sharing is granular and evidenced: single items or whole folder trees can be shared with a user or team, permissions are set at the password level, and groups with role-based access control plus an admin-approved account recovery labelled Escrow are listed features. But we found no public information on one-time or time-limited sharing with external parties, emergency access with a waiting period, or permissions that hide the password while still allowing autofill — the parts that decide what a leaver or contractor can actually do — and the escrow key model behind recovery is named but not documented.

Bitwarden

SSO over SAML 2.0 and OIDC with three decryption models documented — master password, trusted devices holding a device-stored key, and a self-hosted Key Connector — plus a flat statement that the identity provider never has access to the decryption key. SCIM and a directory connector handle user and group provisioning with just-in-time members, and passkeys can both unlock the vault (PRF-capable) and be stored in it. The pages leave open which identity providers are specifically supported and what deprovisioning actually revokes, and when.

Passbolt

SSO with Microsoft, Google, OpenID and AD FS, LDAP provisioning, SCIM, and MFA with Yubikey, Duo and TOTP are all listed, and the SCIM and Azure AD components were independently audited by Cure53 before being declared stable — that part I respect. What the captured pages never say is how the vault key is released during an SSO unlock or that the vendor cannot derive it, and we found no public information on automated suspension when a user is deprovisioned, group sync driving vault permissions, or passkey support.

Bitwarden

Over sixty event types, CSV and JSON export, a public events API, native integrations with six named SIEM platforms, a stated retention of indefinitely with a 367-day viewable window, and a deep enforceable policy catalogue from master password requirements to export removal and browser autofill behaviour. I hold it below the top because the vendor's own documentation warns the event logs may not suffice for security, legal forensics or auditing purposes, with the majority of client events only transmitted every 60 seconds — an auditor should read that sentence twice.

Passbolt

An activity log of audited changes, action logs exportable as syslogs or log files to your own monitoring systems, enforceable passphrase, MFA, password and expiry policies, plus a health check and breached-password screening, are all listed — enough to enforce the basics and ship events out. We found no named SIEM targets, no stated log retention period, and no compliance reporting aligned to ISO 27001, NIS2 or BSI IT-Grundschutz; the certifications shown are SOC 2 Type II and an ANSSI CSPN certification still in process.

Bitwarden

Self-hosting is genuinely documented — Windows, Linux, Docker and Kubernetes installs, standard and lite deployments, a Helm chart, and compatibility with all clients — and export is documented down to its limits: plaintext and encrypted JSON, CSV, and a zip with attachments for individual vaults, with trash and Sends excluded and cards, identities and passkeys JSON-only. Clients cover every major platform including Linux. I found no public information on a selectable EU cloud region, a status page with incident history, or vault access continuing during a vendor outage.

Passbolt

Both paths are real and documented: a cloud hosted on Google Cloud Platform databases in Europe, and self-hosting via packages, Docker, a turn-key installer or a virtual machine, down to fully air-gapped operation with no third-party service required — the customer can remove the vendor from the data path entirely. Clients cover a Windows desktop app, iOS, Android, six browsers and a CLI, and export runs both directions (kdbx and CSV, paid to free, cloud to self-hosted). We found no encrypted full-fidelity export covering attachments, no documented Linux desktop client, and no status page with incident history; offline mode is in Beta.

Bitwarden

Where the chain is proven, it is American: the contracting party is 8bit Solutions LLC under Delaware-incorporated Bitwarden Inc., California governing law, a Santa Barbara address, Microsoft Azure hosting, Data Privacy Framework certification and FTC jurisdiction. European elements exist — storage described as within the EEA and the United States, data processing terms, a published subprocessor list, and a self-hosted option that takes the vendor out of the data path — but ownership, subprocessor locations and residency as a customer choice are unstated on the captured pages.

Passbolt

The company is registered in the Grand Duchy of Luxembourg, the cloud data sits on GCP databases located in Europe, and a data processing agreement maintains a processor list with activities, locations, safeguards and transfer mechanisms. But the chain still runs through US-parent companies — hosting on Google Cloud, transactional email via AWS SES, caching and web application firewall via Cloudflare and Aikido — and we found no public information on the ownership of Passbolt SA. The self-hosted, air-gap-capable option that removes the vendor from the data path is what keeps this respectable.

Bitwarden

Two business tiers are priced publicly and cleanly — $4 per month per user for Teams and $6 for Enterprise, billed annually in USD with taxes not included — with feature lists per tier, a 30-day refund policy and 30 days' notice of price changes. I found no public information on seat minimums, add-on prices such as the Secrets Manager, self-hosted licensing, or the personal-tier prices on the captured pages, so the full annual invoice is not yet computable.

Passbolt

The captured pricing page compares editions feature by feature and shows a free community edition with unlimited users, but we found no public prices for the paid tiers: no per-user figure, no billing period, no seat minimum, no add-on or self-hosting licence price. The page calls the Pro user limit flexible; a buyer cannot compute an annual cost from these pages, and the nonprofit and enterprise offerings are listed without figures.