Bitwarden vs Passbolt

Bitwarden

The security whitepaper names the design end to end — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 with 600,000 iterations or Argon2id, RSA-OAEP for sharing — and states that servers only ever store encrypted data, with the code published openly for anyone to inspect. Third-party reviews run at least once per year and audit results with SOC 2 reports are published and updated annually. What I did not find on the pages I read: a stated list of which fields stay unencrypted, dated audit reports, or any documented past incidents.

Passbolt

Fully open source including the paid edition, end-to-end encryption on the named OpenPGP standard, a full Cure53 audit in 2021 and a second Cure53 white-box test of the directory-sync components in February 2026 with every finding, severity and fix version published — plus a bug bounty, a SOC 2 Type II report and a maintained security whitepaper. That is proof I can hand to my own IT person. I could not find a stated list of which fields beyond the secrets themselves are encrypted, and the cloud-infrastructure audit report is kept private, so it stops short of verifiable end to end.

Bitwarden

Sharing runs through organizations with collections, projects, groups and access settings, and moving an item into an organization transfers ownership to the company — so a leaver's shared credentials stay with us. Admin account recovery is documented down to the key model: the enrolled member's key is wrapped with the organization's public key, nobody including the admin can see the old master password, every recovery step is logged, and emergency contacts can be designated. Approval workflows and hiding the password while allowing autofill I found no public information on.

Passbolt

Shared folders and subfolders with per-password permissions, users and groups management and role-based access control are exactly what would get my team out of the Excel file, and admin-approved account recovery with an escrow key model answers my forgotten-master-password nightmare. We found no public information on what happens to a leaver's shared items at offboarding, on time-limited or one-time sharing with external parties, or on emergency access with a waiting period.

Bitwarden

SSO via SAML 2.0 and OIDC comes with a genuinely clear key story — authentication is decoupled from decryption, the identity provider never holds the decryption key, and members can unlock through trusted devices, their master password, or a self-hosted key connector that is self-hosting only. SCIM and Directory Connector handle user and group provisioning, and passkeys can both log in to and decrypt the vault when PRF-capable. SSO sits in the Enterprise tier only, and I found no public information on automated suspension when a member is deprovisioned.

Passbolt

Single sign-on with Microsoft, Google, OpenID and AD FS sits in the Pro edition alongside SCIM and LDAP provisioning of users and groups, with Yubikey, Duo and TOTP as additional factors, and the SCIM and Azure AD components were independently audited in early 2026. We found no public information on how the vault key is derived or released when unlocking with single sign-on, on automatic suspension when someone is deprovisioned, or on passkeys stored in the vault itself.

Bitwarden

Event logs record over 60 event types, export as CSV or JSON through a public API, feed named SIEM platforms including Splunk, Microsoft Sentinel and Elastic, and retention is stated — indefinite, with a 367-day viewable window — while enforceable policies reach master password requirements, two-step login, export, Send usage and browser-extension behaviour, backed by weak and reused password reports and a Have I Been Pwned check. The vendor itself cautions that event logs may not suffice for security, legal forensics or auditing purposes for all organizations, which tempers what I would hand an auditor.

Passbolt

The Pro edition carries an activity log of changes, action logs as syslogs or log files that can be exported to my own monitoring systems, enforceable passphrase, MFA and password-expiry policies, plus a health check and breached-password screening. We found no public information on stated log retention, on integration with named SIEM targets beyond generic syslog export, or on compliance reporting an ISO 27001 or NIS2 auditor could use.

Bitwarden

Self-hosting is documented properly — Windows, Linux, Docker or Kubernetes with a Helm chart, a standard and a lightweight deployment, and compatibility with all clients — and the client list covers Windows, macOS, Linux, ChromeOS, Android, iPhone and iPad. Export is documented in honest detail across web, browser, desktop, mobile and CLI, though attachments travel only in a zip for individual vaults and trash items and Sends are never included. I found no public information on an EU cloud region choice, a status page with incident history, or vault access during a vendor outage.

Passbolt

Cloud in Europe on Google Cloud Platform plus a genuinely deep self-hosted path — Docker, VM appliance, turn-key installer, anything from a Raspberry Pi to a high-availability setup — with extensions for six browsers, iOS and Android apps, a Windows desktop app, a CLI, an offline mode in beta, a status page, and export in kdbx and csv including a documented path from cloud to self-hosted. The captured pages do not state that export covers every item type including attachments, and no incident history for the status page is shown.

Bitwarden

The chain is American: the contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., governed by California law, hosting on Microsoft Azure with storage primarily in the European Economic Area and the United States. Standard Contractual Clauses and Data Privacy Framework certification are stated, a subprocessor list is published, and self-hosting is offered as the escape hatch that takes the vendor out of the data path. Ownership of the company is unstated, and Google Analytics with cross-site linking is in the chain.

Passbolt

The captured pages show Passbolt SA registered in the Grand Duchy of Luxembourg under Luxembourg and EU data protection law, cloud data hosted in Google Cloud Platform's European region, a GDPR data processing agreement with a maintained processor list, and a fully open-source, air-gappable self-hosted option that removes the vendor from the data path entirely. Google's US parent sits behind the European hosting and transfer safeguards are invoked for non-EU services such as transactional email and the firewall layer, and we found no public information confirming the ownership chain, so this is European but not proven sovereign end to end.

Bitwarden

Both business tiers carry public per-user prices — Teams at $4 per month / per user and Enterprise at $6 per month / per user, billed annually in USD with taxes not included — plus a free trial, a 30-day refund policy, and 30 days' notice before price changes take effect. SSO is documented as an Enterprise capability, so the jump for single sign-on is visible and only one tier up from Teams. What I could not compute from the pages I read: seat minimums, add-on prices such as Secrets Manager, and self-hosted licensing.

Passbolt

The pricing page lays out the Community, Pro and Enterprise editions feature by feature — single sign-on, directory sync and the activity log all sit in Pro rather than being pushed two tiers up, which answers my main question — and the Community edition is free forever. But the captured pages give no per-user price for any paid tier, no billing period and no seat minimum, so I could not compute what this would cost my forty people.