Bitwarden vs Proton Pass

Bitwarden

The security whitepaper names the ciphers and key derivation in detail — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at a 600,000-round default or optional Argon2id, RSA-OAEP for sharing — states the zero-knowledge model with local encryption before upload, and yearly third-party reviews with results published annually, a HackerOne vulnerability disclosure program and open-source clients and server are all documented. We found no public information on a field-by-field statement of what is and is not encrypted including URLs and metadata, on the names of the auditing firms, or on past security incidents, so I cannot place it on the highest anchors.

Proton Pass

The security page names the algorithms (256-bit AES-GCM, OpenPGP with elliptic curve Curve25519), states that end-to-end encryption covers all fields including usernames, web addresses and notes, and pairs this with public third-party audit reports, a public bug bounty and open-source clients. For my audit file I still miss the auditing firms' names, report dates and any statement that testing recurs, a description of key derivation, and any documented incident history, so the evidence falls short of end-to-end verifiability.

Bitwarden

Organizations with collections, projects, groups and member roles are documented, and Enterprise account recovery is published with its key model — the member's encryption key wrapped with the organization's public key — with recovery events logged, a stated role hierarchy, and emergency contacts on paid plans. We found no public information on hiding the password while allowing autofill, time-limited or one-time sharing with external parties, the emergency-access waiting period, or documented offboarding of a leaver's shared items.

Proton Pass

Shared vaults and single items with selectable access levels, group sharing, revocation at any time, secure links with expiry and view limits for people without an account, and emergency access are all documented. I found no public information on admin account recovery or offboarding with their key model, on granularity such as hiding a password while allowing autofill, or on delegated administration and approval workflows.

Bitwarden

SSO over SAML 2.0 and OIDC with SCIM and Directory Connector provisioning is documented, and the unlock key model is unusually well published — master password, trusted devices with device-stored keys, or a self-hosted key connector — with the vendor stating the identity provider never holds the decryption key and passkey unlock via PRF-capable passkeys supported. We found no public information on hardware-key two-step methods, automated suspension on deprovisioning, or conditional access and device policies.

Proton Pass

SSO with Microsoft Entra and Okta, SCIM provisioning with base URL and token, create-user and deactivate-user lifecycle actions, SCIM groups, an enforceable two-factor policy and passkeys across all devices are documented. The captured pages do not describe how the vault key is derived or released on an SSO unlock, and I found no public information on FIDO2 or hardware keys or on conditional access and device policies.

Bitwarden

Event logs with over 60 event types are available through the web app and a public API endpoint with CSV and JSON export, native integrations to named SIEM targets including Splunk, Microsoft Sentinel and Elastic, indefinite retention with a 367-day viewable window, and a broad enforceable policy set covering master password requirements, two-step login, export removal, Send management, session timeout and browser-extension autofill behaviour. The vendor itself states the logs may not suffice for security, legal forensics or auditing purposes because client events reach the server only every 60 seconds, and we found no public information on logging of individual views or copies, tamper-evident storage, or an ISO 27001 certification statement — only a security programme based on that standard.

Proton Pass

Detailed activity logs on the Professional tier, sign-in events showing location, ISP and device, and an admin panel with enforceable policies for two-factor, export, sharing outside the organization, vault creation and password-generator rules, plus password health and dark web reports, are documented, and SIEM integration is listed as a Professional feature. For an ISO 27001 or NIS2 audit I still miss logs covering item views and copies, named SIEM targets with an export path, a stated retention period, and compliance reporting aligned to those frameworks.

Bitwarden

Self-hosting is thoroughly documented for Windows, Linux, Docker and Kubernetes with standard and lite deployments, a Helm chart and a fit into existing high-availability strategies, alongside Linux clients and a multi-format export including an encrypted JSON and a ZIP with attachments. The captured pages note exclusions from export — trash items and Sends, and attachments ZIP for the individual vault only — and we found no public information on a selectable EU cloud region, a status page, or continued access during an outage of the vendor's cloud, though the privacy policy states storage primarily within the European Economic Area and the United States.

Proton Pass

Clients for Windows, macOS, Linux, Android, iPhone and iPad and the major browsers are documented, together with export as a PGP-encrypted JSON in a ZIP, an unencrypted ZIP or a CSV, and import guides from fourteen named password managers, though export is documented as unavailable on the mobile apps. I found no public information on offline access during an outage, a selectable hosting region or a self-hosted option, or a status page with incident history.

Bitwarden

The contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., under California governing law, processing on Microsoft Azure — proven non-EU on entity and governing law — while a self-hosted option that can take the vendor out of the data path and a published subprocessor list URL are documented. Parent ownership, confirmed data residency and subprocessor locations are unknown in what we captured, so one European element with the rest unstated is the level the evidence reaches.

Proton Pass

The contracting entity, Proton AG of Geneva, and Swiss governing law are named, an EU representative (Proton Europe sàrl, Luxembourg) and a data processing agreement exist, disclosure is limited to binding Swiss authority requests, and subprocessors are published with locations — several of them (Stripe, Chargebee, HubSpot, Zendesk, PayPal) processing payment, sales and support data in the United States. Vault data residency is not confirmed on the captured pages, and no EU hosting region or self-hosted option is stated, so the chain is only partly evidenced.

Bitwarden

Both business tiers are publicly priced per user with the billing period and tax treatment stated — Teams at "$4 per month / per user billed annually" and Enterprise at "$6 per month / per user billed annually", in USD with taxes not included — and tier gating is traceable across the help pages, with SSO and account recovery Enterprise-only and event logs from Teams upward. We found no public information on seat minimums, add-on prices such as Secrets Manager, or self-hosted licensing, which keeps a full annual invoice from being computable.

Proton Pass

Features per tier, seat ranges (three to thirty users on Essentials, three and more on Professional), VAT reverse charge for business plans, monthly, yearly and bi-yearly cycles, refund and early-termination terms are public, and personal tiers carry prices such as 35,88 € alle 12 Monate and 9,99 €/Monat for Unlimited. The captured pages give no per-user price for the business tiers themselves, so a business buyer cannot compute the annual invoice from what was captured.