Bitwarden vs Proton Pass

Bitwarden

The security whitepaper names AES-CBC 256-bit with HMAC-SHA256, key derivation by PBKDF2 with 600,000 iterations or Argon2id, local encryption before anything reaches the servers, and a zero-knowledge claim; SOC 2 Type 2, third-party reviews at least once per year with results published annually, a HackerOne vulnerability disclosure program, and open-source code are all on the record. We found no public information stating which fields are and are not encrypted including URLs and metadata, naming the auditing firms with dates, or documenting past security incidents and their impact.

Proton Pass

The security page names its ciphers — 256-bit AES-GCM and OpenPGP with Curve25519 — and states that end-to-end encryption covers all fields including usernames, web addresses and notes, backed by a public bug bounty, open-source clients, and third-party audits whose reports are public. That is most of what I demand in writing, but the pages name no auditing firm and carry no audit dates, and I found no public information on past security incidents or a threat model describing what a server compromise would expose.

Bitwarden

Organizations, collections, projects, groups and member roles with permission levels are documented, and Enterprise account recovery is described down to its key model — the member's key wrapped with the organization's public key, the old master password never visible, and recovery actions logged. Emergency access contacts, ownership transfer on sharing, and reclaim paths for shared items are stated; we found no public information on time-limited one-time sharing with external parties, hiding the password while allowing autofill, or approval workflows for sensitive items.

Proton Pass

Sharing is built for teams: whole-vault or single-item sharing with selectable access levels, secure links with expiry and view limits for people without an account, revocation at any time, and emergency access listed among the paid features. The support article tells an admin to pick a level of access without naming those levels, and I found no public information on admin account recovery or on the key model that governs shared vaults when an employee leaves.

Bitwarden

SSO over SAML 2.0 and OIDC for Enterprise organizations, SCIM and the Directory Connector for user and group provisioning, and passkey login that decrypts the vault on PRF-capable keys are all documented. The SSO unlock is published with three decryption options — master password, trusted devices, and a self-hosted key server — together with the statement that the identity provider never holds the decryption key; we found no public information on automated suspension at deprovisioning, conditional access or device policies, or an independent review of the SSO key model.

Proton Pass

Single sign-on with SCIM provisioning is documented end to end for Microsoft Entra and Okta, down to the base URL and token, SCIM groups for access across users and deactivate-user lifecycle actions, and passkeys are supported on all devices. I found no public information on how the vault key is derived or released at SSO unlock and why the vendor cannot derive it, nor on hardware security keys or conditional access.

Bitwarden

Over sixty event types for Teams and Enterprise, export as CSV or JSON through the public API, native SIEM integrations named to Splunk, Microsoft Sentinel, Elastic and others, a stated retention of indefinite with a 367-day view window, and enforceable policies for master password, two-step login, export and browser autofill behaviour are documented, with an ISO 27001-based ISMS and SOC 2 Type 2 stated. The vendor itself writes that its event logs may not suffice for security, legal forensics or auditing purposes, and we found no public information on tamper-evident logs or an auditor role that can read them without access to secrets.

Proton Pass

The admin console enforces real policy — two-factor authentication for everyone or administrators only, sharing outside the organisation, export rights, vault creation and password-generator rules — and the professional tier adds detailed activity logs, an organisation-wide security-event monitor showing sign-in location, ISP and device, plus password-health and dark-web breach reports. SIEM integration is named as a feature without any target being named, and I found no public information on log export, log retention, or reporting aligned to ISO 27001 or NIS2.

Bitwarden

Self-hosting is documented in depth — standard and lite deployments across Windows, Linux, Docker and Kubernetes with a Helm chart — alongside clients for Windows, macOS, Linux, ChromeOS, Android and iPhone plus a CLI, and export in four formats including an encrypted JSON option and a ZIP with attachments. The export documentation itself states that no format includes trash items or Sends, that cards, identities and stored passkeys travel only in JSON, and that ZIP export covers individual vaults only; we found no public information on an EU cloud region choice, a status page with incident history, or vault access continuing during a vendor outage.

Proton Pass

Client coverage is complete — Windows, macOS, Linux, Android and iPhone apps across all major browsers — and export is documented in three forms including a PGP-encrypted JSON archive, with import guides for a dozen named competitors, though export runs only from the browser extensions, web app and Windows app. I found no public information on hosting-region choice, a self-hosted or on-premises option, offline access during a vendor outage, or a status page with incident history.

Bitwarden

The contracting party is 8bit Solutions LLC under California law with Delaware-incorporated Bitwarden Inc. as parent, the service runs on Microsoft Azure, and the vendor is subject to FTC enforcement; a self-hosted option and storage of collected information in the EEA and the United States are stated, giving one European element. Ownership, vault data residency and subprocessor locations are unknown on the captured pages, which show only a link to a subprocessor list and SCC or Data Privacy Framework transfer mechanisms.

Proton Pass

The contracting entity is Proton AG of Geneva under Swiss law with hosting jurisdiction stated as Switzerland, an EU representative in Luxembourg, a data processing agreement that applies by default, disclosure only on binding requests from competent Swiss authorities, and a subprocessor list published with locations — more than most vendors give. That list places payments with US-incorporated Stripe, Chargebee and PayPal, support with Zendesk and sales contacts with Hubspot, so parts of the chain sit under US jurisdiction. I found no public information on an EU hosting region or a self-hosted option that removes the vendor from the data path.

Bitwarden

Both business tiers carry public per-user prices — $4 per month / per user billed annually for Teams and $6 per month / per user billed annually for Enterprise — shown in USD with taxes not included, plus a 30-day refund policy and 30-day notice of price changes. We found no public information on seat minimums, add-on prices such as Secrets Manager or a self-hosting licence, or a full feature breakdown per tier on the pricing page; which features sit in which plan must be pieced together from the help documentation.

Proton Pass

Personal plans are priced publicly and exactly — Proton Free at 0,00 €/Monat, Pass Plus at 35,88 € alle 12 Monate, Proton Unlimited at 9,99 €/Monat — and the business pages list each tier's features, seat minimums, billing cycles, VAT reverse-charge treatment, a 30-day refund and one priced add-on (Dedicated server and IP at +€39.99/month). I found no public information on per-user prices for the business tiers, so a company's annual invoice is not computable from public pages alone.