Bitwarden vs Proton Pass

Bitwarden

The security whitepaper names the design end to end — AES-CBC 256 with HMAC-SHA256, PBKDF2 at 600,000 iterations or Argon2id, RSA-OAEP for sharing — and states servers only ever store encrypted data, with third-party reviews at least yearly and SOC 2 Type 2 results published annually, a HackerOne vulnerability disclosure program, and open source to read. What I could not find on the captured pages is a field-by-field statement of what is and is not encrypted including metadata, or any published incident history, so I stop short of the top band.

Proton Pass

The dedicated security page names the stack I want to see — 256-bit AES-GCM and OpenPGP with Curve25519 — and states that usernames, web addresses and note contents are end-to-end encrypted like the password field, with independent audits whose reports are public, a public bug bounty, and open-source code I can review myself. It sits below the top band because the pages name neither the auditing firms nor dates, document no key derivation, and we found no public information on incident history or a threat model.

Bitwarden

Sharing runs through organizations with collections, groups and member roles, and Enterprise account recovery is documented down to the key model: the member's encryption key is wrapped with the organization's public key, the old master password is never visible to anyone, and enrollment, resets and withdrawals are logged, with the owner-versus-admin recovery hierarchy spelled out. Emergency access via trusted contacts exists on paid plans. I found no public information on hiding a password while still allowing autofill, an emergency-access waiting period, or approval workflows for sensitive items, which holds this below the top.

Proton Pass

Shared vaults and single items with end-to-end encryption, selectable access levels, group sharing in the business tier, emergency access in the paid plans, revocation at any time, and secure links for outsiders with an expiry date and a view limit — solid team material. We found no public information on an admin recovery or offboarding key model or approval workflows, and the permission levels themselves are not enumerated on the pages we read.

Bitwarden

SSO over SAML 2.0 and OIDC is documented with three decryption paths — master password, device-stored keys through trusted devices, and a self-hosted Key Connector server — and the pages state plainly that the identity provider never holds the decryption key. SCIM and a Directory Connector handle user and group provisioning, just-in-time provisioning is documented, and a PRF-capable passkey can both log in and decrypt the vault. Group sync driving vault permissions is implied by the organization model, but immediate revocation on deprovisioning with a log entry and conditional access are not spelled out in the captured pages.

Proton Pass

SAML single sign-on with SCIM is documented step by step for Microsoft Entra and Okta, including SCIM groups and Create/Deactivate user lifecycle, alongside enforceable two-factor policies and passkeys stored across all devices. What I cannot verify from the public pages is how the vault key is derived or released at SSO unlock, and we found no public information on hardware-key MFA or device policies.

Bitwarden

Over sixty event types are logged for Teams and Enterprise, retained indefinitely with a 367-day view window, and reachable through the web app, CSV export and a public events API, with native integrations to Splunk, Microsoft Sentinel, Elastic, Panther, Rapid7 and Sumo Logic. The policy catalogue is long — master password minimums, mandatory two-step login, removal of export, Send control, session timeout, autofill behaviour — plus Have I Been Pwned checks and weak and reused password reporting. The vendor itself notes the logs may not suffice for legal forensics for all organizations, and I found no public information on tamper-evident storage or an auditor role without secret access.

Proton Pass

The professional tier ships detailed activity logs, SIEM integration and enterprise policies, sign-in events record location, ISP and device, admins can view and manage security events for the whole organization, and password health with dark-web breach monitoring is documented. But the SIEM targets are not named on the pages we read, and we found no public information on log export, retention periods, or reporting aligned to ISO 27001 or NIS2.

Bitwarden

Self-hosting is documented properly: Docker or Kubernetes with a Bitwarden-developed Helm chart in standard or lite deployments, installable on Windows or Linux, compatible with every client including Linux desktops, with the source open to audit — this is the deployment story I want for my own data centre. Export covers plaintext and encrypted JSON plus CSV, the encrypted export is password-protectable or account-restricted, the CLI can drive it for pipelines, and a zip export includes attachments. But that zip is individual-vault only, no format carries trash items or Sends, individual exports exclude organization data, and the captured pages give nothing on offline access during a vendor outage, a status page, or a documented high-availability configuration for self-hosting — so a lossless exit is not proven.

Proton Pass

Clients cover Windows, macOS, Linux, Android, iPhone and iPad and the five major browsers, the command-line interface is included in business plans, export offers a PGP-encrypted ZIP containing JSON, a plain ZIP or CSV, and import guides exist for fourteen named managers including Bitwarden, KeePass and LastPass. As the one who runs the vault in his own racks, we found no public information on a self-hosted or on-premises option, hosting-region choice, offline access during an outage, or a status page; the vendor itself states you cannot export from the mobile apps, and the pages do not say whether exports include attachments.

Bitwarden

The contracting party is 8bit Solutions LLC under California law, wholly owned by Delaware-incorporated Bitwarden Inc., subject to FTC enforcement and leaning on the Data Privacy Framework — the contracting chain is US throughout. The privacy policy names storage primarily in the European Economic Area and the United States, and a documented self-hosting option can remove the vendor from the data path, which keeps this off the bottom. Ownership and subprocessor exposure are marked unknown here; a subprocessor list is referenced but its locations are not shown on the captured pages.

Proton Pass

The contracting entity is Proton AG in Geneva under Swiss law and the courts of the Canton of Geneva, with an EU representative in Luxembourg, a published data processing agreement, and a subprocessor list with locations — though support, payment and sales contacts flow to US-headquartered Zendesk, Stripe, Chargebee and Hubspot. Where vault data is actually hosted is not confirmed on the vendor's own captured pages, and we found no public information on a self-hosted option that would remove the vendor from the data path.

Bitwarden

The business tiers are priced plainly — Teams at $4 per month per user and Enterprise at $6 per month per user, billed annually in USD with taxes not included — with a 30-day refund on paid services and 30 days' notice of price changes in the terms. What I cannot compute from the captured pages: seat minimums, self-hosted licensing, the Secrets Manager add-on, and the Families plan price, so a complete annual invoice is not derivable from public pages alone.

Proton Pass

Consumer prices are exact and public — Proton Free at 0,00 €/Monat, Pass Plus at 35,88 € alle 12 Monate, Unlimited at 9,99 €/Monat — with monthly, yearly and bi-yearly billing, a 30-day money-back guarantee, business reverse-charge VAT treatment and the early-termination penalty spelled out. The business pricing page maps features and seat minimums per tier, but we found no per-user price for the business tiers on the captured pages, so a company's real annual invoice is not computable from public information.