Bitwarden vs Proton Pass

Bitwarden

The security white paper names the full crypto stack — AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at 600,000 iterations with an Argon2id option, RSA-OAEP for sharing — and states data is encrypted on the local device before anything is sent, with servers storing only encrypted data. Third-party reviews run at least yearly with results and SOC 2 material published annually, a HackerOne vulnerability disclosure program exists, and the code is open for anyone to inspect. We found no public information on which fields such as URLs or metadata are or are not encrypted, or on past incidents and their impact.

Proton Pass

The security page names the cryptography — OpenPGP with elliptic-curve Curve25519 and 256-bit AES-GCM — states that end-to-end encryption covers all fields including usernames, web addresses and notes, and that nobody, not even Proton, can read or create new vault keys. Independent third-party audits with publicly available reports and a public bug bounty are stated, and the client is open source. We found no public information naming the audit firms or dates, on key derivation, or on disclosed incident history.

Bitwarden

Sharing runs through organizations with collections, projects, groups and member roles, and moving an item into the organization transfers ownership to it, so shared items stay with the company. Enterprise account recovery is documented down to the key model — the member's encryption key wrapped with the organization's public key as the Account Recovery Key — with role limits on who can recover whom, event logging of recovery actions, and trusted emergency contacts supported. We found no public information on hiding a password while allowing autofill, waiting periods on emergency access, or approval workflows for sensitive items.

Proton Pass

Shared vaults with selectable access levels, sharing of single items or whole vaults, secure links with expiry and view limits for people without a Proton Pass account, and organisational toggles for sharing outside the organisation and export are documented, with emergency access listed in Pass Plus. What I need for a clean leaver process is thin: we found no public information on the key model for admin recovery or on what happens to a leaver's shared items beyond revoking access, and a support topic exists on why hidden passwords cannot be shared.

Bitwarden

This is what I judge first, and it is documented properly: SSO speaks SAML 2.0 and OIDC, and the unlock key model is written down — members decrypt with the master password, a device-stored key via trusted devices, or a self-hosted Key Connector — with the vendor stating the identity provider never holds the decryption key and zero-knowledge is retained. SCIM and the Directory Connector keep users and groups in sync with the directory, just-in-time provisioning over SSO is documented, and passkeys can log in to the vault itself and decrypt it when PRF-capable. We found no public information on automated suspension of a member's vault the moment their account is disabled in the directory, which is the piece I would want spelled out before relying on deprovisioning.

Proton Pass

This is my home ground: SCIM with Microsoft Entra is documented step by step with a base URL and token, SCIM groups, email invitations confirmed by an admin, and provisioning actions that include Deactivate Users, with SAML SSO set up first; passkeys are supported across all devices and 2FA can be enforced organisation-wide. But the pages never document how the vault key is derived or released on an SSO unlock, and we found no public information on FIDO2 or hardware security keys as a sign-in factor for the vault itself or any statement that disabling an account immediately severs vault access.

Bitwarden

Event logs cover over sixty event types, are retained indefinitely with a 367-day view window, export as CSV or JSON from a public events endpoint, and feed named SIEM targets including Splunk, Microsoft Sentinel and Elastic. Enterprise policies are deep and enforceable — master password requirements, two-step login, SSO, export removal, session timeout, autofill and Send behaviour — and the compliance program is based on an ISO 27001 ISMS with SOC 2 Type 2. The vendor itself cautions that event logs may not suffice for security, legal forensics or auditing purposes for all organizations, and we found no public information on tamper-evidence or alerting on anomalous access.

Proton Pass

Professional plans include detailed activity logs, enterprise policies and SIEM integration, and the policies page documents enforceable 2FA, password generator rules, export restrictions and sharing controls, while Sentinel surfaces sign-in events with location, ISP and device and admins can monitor security events organisation-wide. Password health, dark web monitoring and inactive-2FA detection are documented. We found no public information on log export, retention periods or named SIEM targets, and the compliance line reads GDPR and HIPAA support rather than reporting aligned to ISO 27001 or NIS2.

Bitwarden

Self-hosting is documented thoroughly — Docker, Kubernetes with a vendor Helm chart, Windows and Linux, standard and lite deployments — described as fitting an existing high-availability and recovery strategy, with clients for Windows, macOS, Linux, ChromeOS, Android, iPhone and iPad. Export covers plaintext and encrypted JSON, CSV, and a zip with attachments for individual vaults, decrypted locally before export, with the exclusions honestly listed (trash items and Sends in no format, organization data only via admin or collection-permission export). We found no public information on a status page with incident history or on vault access continuing through an outage of the cloud service.

Proton Pass

Clients cover Windows, macOS, Linux, Android, iPhone and iPad and all major browsers, import is documented from fifteen named competitors, and export offers a ZIP containing a PGP-encrypted JSON file that can be re-imported — though the export help states data cannot be exported from the mobile apps. Hosting jurisdiction is given as Switzerland; we found no public information on an EU data region, a self-hosted option, or offline access during an outage, with the SLA targeting 99.95% uptime and service credits.

Bitwarden

The chain is American at the top: the contracting party is 8bit Solutions LLC, wholly owned by Delaware-incorporated Bitwarden Inc., governed by California law, subject to FTC enforcement, hosted on Microsoft Azure, and certified under the EU-U.S. Data Privacy Framework. The European elements are real but secondary — storage within the European Economic Area and the United States is stated, SCCs are offered as a transfer mechanism, a subprocessor list page is published, and self-hosting on your own infrastructure is described as true data sovereignty. We found no public information on the parent's ownership or on subprocessor locations.

Proton Pass

The contracting entity is Proton AG of Plan-les-Ouates, Geneva, hosting jurisdiction is stated as Switzerland with disclosure only on binding requests from competent Swiss authorities, and the privacy policy names an EU representative in Luxembourg plus an available DPA. The subprocessor list is published with locations but names US-headquartered Stripe, Chargebee, Hubspot, Zendesk and Atlassian for payment, sales and support data. No EU or self-hosted hosting option for the vault is stated in the captured pages, and we found no public information on ownership.

Bitwarden

The business tiers are priced publicly — Teams at "$4 per month / per user billed annually" and Enterprise at "$6 per month / per user billed annually", in USD with taxes not included — and the tier placement of the features I care about is discoverable: SSO and enforced policies are Enterprise, event logs start at Teams, and Enterprise includes a free Families plan for all users. A 30-day refund on all paid services and 30 days' notice of price changes are stated in the terms. We found no public information on seat minimums, add-on prices, or licensing for the self-hosted deployment.

Proton Pass

Personal tiers are fully priced — Proton Free at 0,00 €/Monat, Pass Plus at 35,88 € every 12 months, Proton Unlimited at 9,99 €/Monat — and the business page lays out feature sets, seat ranges of 3 to 30 users for Essentials and 3 and more for Professional, VAT reverse charge for business plans, a 30-day refund and early-termination penalties. What I could not find on the captured pages is a per-user price for the business tiers themselves, so I cannot compute a two-thousand-seat annual invoice from public material alone.