Bitwarden vs Proton Pass

Bitwarden

The whitepaper is real security documentation: AES-CBC 256-bit with HMAC-SHA256, PBKDF2 at 600,000 iterations or Argon2id, RSA-OAEP for sharing, open-source code, and a HackerOne vulnerability disclosure program, with third-party reviews claimed at least yearly and results said to be published annually. What I did not find is the part post-mortems are made of: a stated list of which fields remain unencrypted, audit reports or summaries with dates and named firms, and any disclosed incident history — a blank record I treat as an answer, not an assurance.

Proton Pass

The security page names its cryptography — OpenPGP with Curve25519 and 256-bit AES-GCM — and states that every field including usernames, web addresses and notes is end-to-end encrypted with vault keys nobody at the vendor can read, backed by an open-source client, a public bug bounty, and audits whose reports are said to be public. But we found no public information naming the auditing firms or dates, describing key derivation, or documenting any incident history, so the audit claim rests on the vendor's own word.

Bitwarden

Collections, groups, roles and permissions are documented, and account recovery is unusually candid: the member's encryption key is wrapped with the organization's public key, every recovery step is logged, and the old master password is never visible to anyone including the executing administrator — that is a stated key model, and shared items transfer to the organization, so a leaver cannot take them. Emergency access exists but no waiting period is documented on these pages, and I found no public information on hide-password-but-autofill permissions, one-time or time-limited sharing with external parties, or approval workflows for sensitive items.

Proton Pass

Sharing is genuinely covered: whole vaults or single items by email with permission levels, secure links with expiry and view limits for outsiders, revocation, emergency access, and admin policies over sharing inside and outside the organization. We found no public information on offboarding a leaver's shared items, the key model behind emergency access, or approval workflows; the terms instead state plainly that the vendor cannot recover data if a password is lost.

Bitwarden

SSO over SAML 2.0 and OIDC with three decryption models documented — master password, trusted devices holding a device-stored key, and a self-hosted Key Connector — plus a flat statement that the identity provider never has access to the decryption key. SCIM and a directory connector handle user and group provisioning with just-in-time members, and passkeys can both unlock the vault (PRF-capable) and be stored in it. The pages leave open which identity providers are specifically supported and what deprovisioning actually revokes, and when.

Proton Pass

SSO with SAML and SCIM is documented for both Microsoft Entra and Okta, including SCIM groups and Create and Deactivate user lifecycle actions, a two-factor enforcement policy, and passkeys across all devices. We found no public information on how the vault key is derived or released at SSO unlock — exactly the point where a vendor can end up holding half the key — nor on FIDO2 hardware keys or conditional access and device policies.

Bitwarden

Over sixty event types, CSV and JSON export, a public events API, native integrations with six named SIEM platforms, a stated retention of indefinitely with a 367-day viewable window, and a deep enforceable policy catalogue from master password requirements to export removal and browser autofill behaviour. I hold it below the top because the vendor's own documentation warns the event logs may not suffice for security, legal forensics or auditing purposes, with the majority of client events only transmitted every 60 seconds — an auditor should read that sentence twice.

Proton Pass

Professional plans carry detailed activity logs, SIEM integration and enforceable policies — two-factor, export, sharing inside and outside the organization, vault creation, password generator rules — sign-in events record location, ISP and device, and Pass Monitor adds password health, breach alerts and inactive-2FA detection. We found no public information on log export or retention, on the SIEM targets by name, or on compliance reporting aligned to ISO 27001 or NIS2.

Bitwarden

Self-hosting is genuinely documented — Windows, Linux, Docker and Kubernetes installs, standard and lite deployments, a Helm chart, and compatibility with all clients — and export is documented down to its limits: plaintext and encrypted JSON, CSV, and a zip with attachments for individual vaults, with trash and Sends excluded and cards, identities and passkeys JSON-only. Clients cover every major platform including Linux. I found no public information on a selectable EU cloud region, a status page with incident history, or vault access continuing during a vendor outage.

Proton Pass

Clients cover Windows, macOS, Linux, Android and iPhone across five browsers and a web app, and export is documented in three forms — a PGP-encrypted JSON inside a ZIP, an unencrypted ZIP, and CSV — with import guides for fourteen competing managers, though export runs only from browser extensions, the web app and the Windows app and the pages note the mobile apps cannot export. We found no public information on hosting region choice, a self-hosted option, or offline access during a vendor outage.

Bitwarden

Where the chain is proven, it is American: the contracting party is 8bit Solutions LLC under Delaware-incorporated Bitwarden Inc., California governing law, a Santa Barbara address, Microsoft Azure hosting, Data Privacy Framework certification and FTC jurisdiction. European elements exist — storage described as within the EEA and the United States, data processing terms, a published subprocessor list, and a self-hosted option that takes the vendor out of the data path — but ownership, subprocessor locations and residency as a customer choice are unstated on the captured pages.

Proton Pass

The contracting entity is Proton AG in Geneva under Swiss law with Swiss hosting jurisdiction, an EU representative in Luxembourg, a data processing agreement offered, and a subprocessor list published with locations — but that list routes payments, support and sales through US-headquartered processors (Stripe, Chargebee, PayPal, Zendesk, Hubspot) alongside processors in Macedonia and Taiwan. We found no public information on ownership or a self-hosted option, and the vendor itself states it sits outside US and EU jurisdiction.

Bitwarden

Two business tiers are priced publicly and cleanly — $4 per month per user for Teams and $6 for Enterprise, billed annually in USD with taxes not included — with feature lists per tier, a 30-day refund policy and 30 days' notice of price changes. I found no public information on seat minimums, add-on prices such as the Secrets Manager, self-hosted licensing, or the personal-tier prices on the captured pages, so the full annual invoice is not yet computable.

Proton Pass

Consumer prices are exact and public — 0,00 €/Monat for Free, 35,88 € alle 12 Monate for Pass Plus, 9,99 €/Monat for Unlimited — and the business page maps features to tiers in detail with seat ranges, billing cycles, VAT reverse charge for business plans and a 30-day refund. We found no public information giving a per-user price for the business tiers themselves, so a real annual business invoice is not computable from the captured pages alone.