# Bitwarden — Password Management

Bitwarden by Bitwarden Inc. holds a panel rating of 3/5 from 6 AI judges (category median 2/5), as of 2026-10-15. Provenance: Rest of world; sovereignty: not determined.

- Vendor: Bitwarden Inc. (https://bitwarden.com)
- Category: [Password Management](https://whats-best.ai/software/password-management.md)
- Provenance (editorial classification): Rest of world
- Canonical page: https://whats-best.ai/software/password-management/bitwarden
- Alternatives: https://whats-best.ai/software/password-management/bitwarden/alternatives ([markdown](https://whats-best.ai/software/password-management/bitwarden/alternatives.md))
- Data as of: 2026-10-21 · evaluated 2026-10-15 · oldest source captured 2026-10-01

**AI-generated.** Every score, rationale and verdict here is written by a panel of AI judges from public evidence — an analysis, not a hands-on test. Every fact quotes the vendor page it was read from. No score can be bought. How scores are made: https://whats-best.ai/methodology

## At a glance

- Vendor: Bitwarden Inc.
- Headquarters: Not stated on the vendor’s pages as of 13 Oct 2026
- Data hosting: Not stated on the vendor’s pages as of 13 Oct 2026
- Free plan: Not stated on the vendor’s pages as of 13 Oct 2026

## The panel's verdict

Bitwarden is an open-source password manager; its strongest scores are identity integration at 7-8 and audit and policy at 7-8, its weakest pricing transparency at 1-2 and sovereignty at 3-4. Judges credited SSO over SAML 2.0 and OIDC, with the identity provider stated never to hold the decryption key and a customer-run key connector among three decryption paths, plus event logs of over 60 types, CSV and JSON export through a public API, six named SIEM integrations, indefinite retention behind a 367-day viewable window. On pricing, the captured pages show tier features but judges found no public price figures — no per-user cost, seat minimum, term or VAT treatment — so an annual invoice cannot be computed. Sovereignty scores rest on storage stated primarily in the EEA and the United States on Microsoft Azure, a Delaware incorporation recorded in the vendor's terms, and we found no public information on a subprocessor list with locations. Scores spread widest on security architecture, at 5-7, where open-source reviewability sits against no public information on a named independent audit or disclosed incident history. Self-hosting is the recurring mitigating factor.

**Speaks for it:**
- SSO over SAML 2.0 and OIDC with SCIM and directory sync, three decryption paths including a customer-run key connector, and the stated position that the identity provider never holds the decryption key
- Event logs for Teams and Enterprise with over 60 event types, CSV and JSON export through a public API, and named integrations for Splunk, Microsoft Sentinel, Elastic, Panther, Rapid7 and Sumo Logic
- Self-hosting in standard and lite deployments for Windows, Linux, Docker and Kubernetes, with a Helm chart and compatibility with all clients
- Export covers encrypted JSON recommended as most complete, a ZIP with attachments, decryption local to the client, and transfer to other apps over the FIDO credential exchange protocol
- Account recovery on the Enterprise plan is documented down to its key model, with the old master password never visible to anyone and recovery actions logged

**Held against it:**
- We found no public price figures on the captured pricing pages — no per-user cost, seat minimum, add-on price, self-hosted licence, minimum term or VAT treatment
- We found no public information on a named independent audit, certification or penetration test with its date and results, or on disclosed incident history
- We found no public information on a subprocessor list with locations or a data-processing agreement covering vault metadata and logs
- We found no public information on a status page with incident history, offline vault access during a vendor outage, or import from named competitors
- We found no public information on approval workflows for sensitive items, a waiting period for emergency access, or hiding a password while autofill remains allowed

**Best for:**
- You need SSO over SAML 2.0 and OIDC with SCIM or directory sync and want to run your own key connector for decryption
- Your security operations team needs event logs piped into Splunk, Microsoft Sentinel, Elastic, Panther, Rapid7 or Sumo Logic
- You intend to self-host on Windows, Linux, Docker or Kubernetes and keep the vendor out of the data path
- You are replacing shared spreadsheets with organizations, collections and group-based permissions, with account recovery and enterprise policies on the Enterprise plan

**Avoid if:**
- You must be able to compute an annual invoice from published per-user prices before committing
- You require storage confined to the EEA or a European contracting entity — the captured pages state storage primarily in the EEA and the United States on Microsoft Azure and record a Delaware incorporation
- You need event logs, account recovery or enterprise policies while staying on a plan other than Teams or Enterprise, where the captured help pages place them

## Scores by judge and criterion

Scores out of 5, each judge scoring independently against the published rubric (v1). "n/r" = not rated: the vendor publishes no price.

| Criterion | The CISO | The Identity Engineer | The Compliance Auditor | The SME Owner | The DevOps Engineer | The Skeptic |
| --- | --- | --- | --- | --- | --- | --- |
| Encryption model & independent audits | 3/5 | 3/5 | 3/5 | 3/5 | 3.5/5 | 2.5/5 |
| Sharing, roles & recovery | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| SSO, directory sync & provisioning | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 | 4/5 | 3.5/5 |
| Audit logs, policies & reporting | 4/5 | 4/5 | 3.5/5 | 3.5/5 | 4/5 | 3.5/5 |
| Hosting choice, offline access & export | 3.5/5 | 3/5 | 3.5/5 | 3.5/5 | 3.5/5 | 3/5 |
| European sovereignty | 1.5/5 | 1.5/5 | 2/5 | 2/5 | 2/5 | 1.5/5 |
| Pricing transparency | 1/5 | 1/5 | 1/5 | 0.5/5 | 1/5 | 1/5 |
| **Weighted verdict** | **3/5** | **3/5** | **3/5** | **3/5** | **3.5/5** | **2.5/5** |

### The judges

- **The CISO** (v1.0): Answers to the board for the day the vault vendor is breached. Wants a whitepaper that says which fields are encrypted and which are not, audits by named firms with dates, a bug bounty, and an incident history written down rather than discovered in the press.
- **The Identity Engineer** (v1.0): Runs Entra ID for two thousand staff and owns the joiner-mover-leaver process. Wants SCIM that suspends a leaver's vault the moment the account is disabled, an SSO unlock whose key model is documented, and FIDO2 keys and passkeys supported for the vault itself.
- **The Compliance Auditor** (v1.0): Prepares the ISO 27001 and NIS2 evidence and has to show who could see the firewall admin password last March. Wants event logs that cover views and copies, export to the SIEM, enforceable policies, and the contracting entity, hosting and subprocessors named.
- **The SME Owner** (v1.0): Runs a forty-person company where the shared passwords currently live in an Excel file. Wants shared vaults the team actually uses, a way back in when someone forgets the master password, credentials handed over when someone leaves, and a per-user price with SSO not hidden two tiers up.
- **The DevOps Engineer** (v1.0): Would rather run the vault in the company's own data centre than trust another SaaS with root credentials. Wants a documented self-hosted deployment with backup and high availability, open-source code to read, a CLI and API for pipelines, and an export that loses nothing.
- **The Skeptic** (v1.0): Has read the breach post-mortems. Reads "zero knowledge" next to unencrypted URLs and item names, "independently audited" with no report, "SSO unlock" where the vendor holds half the key, and "admin recovery" that means the vendor can decrypt — and treats a missing incident history as an answer.

## European sovereignty — proven facts

Built only from facts on the vendor's own pages; a dimension we could not prove is left open, never scored as zero. Headline: not determined.

| Dimension | Finding | Points | Source |
|---|---|---|---|
| Legal entity | Not determined | — | — |
| Ownership | Not determined | — | — |
| Data residency | Not determined | — | — |
| Subprocessors | Not determined | — | — |

## Key facts

Each fact is the vendor's own statement, cited to the source page it was read from ([S*n*] → Sources).

**Compliance**
- Audit frequency: yes [S6]
- Audit publication: x [S13]
- California no sale: no [S3]
- Certifications: yes · yes · yes [S6]
- Certifications: SOC 2 · GDPR · CCPA · HIPAA · Data Privacy Framework (DPF) [S13]
- DPA with subprocessors: yes [S3]
- Dpf certification: yes · yes · yes [S3]
- Ftc enforcement: yes [S3]
- ISMS: ISO27001 ISMS [S6]
- Policy last revised: 2024-04 [S3]
- Regulations: yes · yes · yes [S6]
- Standards: meets international and industry-specific security and privacy standards [S1]
- Transfer mechanisms: yes · yes [S3]

**Data**
- Deletion on cancellation: no · yes [S4]
- Event log retention: indefinite · 367 [S12]
- Export cli web availability: web app · browser extension · desktop · mobile · CLI [S14]
- Export confirmation: master password · email verification code [S14]
- Export cxp: 26+ · FIDO Credential Exchange Protocol (CXP) · 10+ [S14]
- Export decryption local: yes [S14]
- Export formats: json_plaintext · csv_plaintext · json_encrypted · zip_with_attachments [S14]
- Export org data scope: admins, owners, and some custom roles via web app or CLI · no · yes [S14]
- Export password protected: yes [S14]
- Retention: user-controlled, deletable at any time · retained while customer, deleted after termination per policy [S6]
- Retention policy: customer lifetime plus legal requirement · yes [S3]
- Rights access correct delete: yes · yes · yes [S3]
- Self deletion: web vault Settings · yes [S4]

**Hosting**
- Encryption at rest: Azure Transparent Data Encryption (TDE) [S6]
- Provider: Microsoft Azure · Azure Kubernetes Services (AKS) [S6]
- Storage regions: EEA · United States [S3]

**Integrations**
- CSV export: yes · yes [S12]
- Events API: JSON · /events [S12]
- Non native siem: yes [S12]
- Public API: yes [S6]
- Siem: splunk · panther · elastic [S6]
- Siem: Elastic SIEM · Microsoft Sentinel SIEM · Panther SIEM · Rapid7 SIEM · Sumo Logic SIEM · Splunk SIEM [S12]
- SSO: yes [S1]
- SSO authentication decryption decoupled: SSO decouples authentication from decryption; IdP never holds the decryption key [S10]
- SSO SCIM: yes · yes [S13]

**Legal**
- Copyright entity: Bitwarden, Inc. [S1]
- Effective date: 2017-06-01 [S4]
- Entity: 8bit Solutions LLC [S4]
- Entity address: Bitwarden, Inc. · 1 North Calle Cesar Chavez, Suite 102, Santa Barbara, CA 93103 [S3]
- Governing law: California, USA [S4]
- Incorporation: Bitwarden Inc. · 8bit Solutions LLC · Delaware [S4]
- Terms license: CC BY 4.0 · GitHub, Inc. [S4]

**Pricing**
- Change notice: material changes such as price changes · 30 [S4]
- Currency and tax note: USD · annual · no [S2]
- Enterprise price: Enterprise · USD · annual · 6 [S1]
- Enterprise price: 6 [S2]
- Free plan payment info: no [S4]
- Free tier personal: personal · yes [S1]
- Free trial: yes [S2]
- Grandfathering: duration of payment term · at end of payment term [S4]
- Payment methods: credit card · PayPal · other approved methods [S4]
- Refund policy: 30 · all paid Services [S4]
- Teams price: Teams · USD · annual · 4 [S1]
- Teams price: 4 [S2]
- VAT note: USD · no [S1]

**Product**
- Access and sharing features: Unlimited devices and passwords, browser/mobile/desktop apps, free sharing, Bitwarden Send [S2]
- Access controls: collections · projects · groups · member_roles · permissions [S6]
- Account recovery: enterprise · yes [S6]
- Account recovery capability: Administrators can reset member credentials (master password, two-step login) and restore access [S8]
- Account recovery encryption: Enrolled member encryption key encrypted with org public key, stored as Account Recovery Key [S8]
- Account recovery event logging: enrollment/withdrawal · admin initiates recovery · master password update via recovery · new two-step login saved [S8]
- Account recovery password visibility: no [S8]
- Account recovery permissions: Owner · Admin · custom role with Manage account recovery permission [S8]
- Account recovery plan availability: Enterprise · yes [S8]
- Account recovery process: Admin resets master password and/or two-step login; recovery link emailed to member · Member uses emailed link to reset master password and/or set up new two-step login [S8]
- Account recovery role hierarchy: Admin/owner can recover an admin; only an owner can recover another owner [S8]
- Account recovery setup requirements: Requires Account recovery administration policy; users may enroll manually or via automatic enrollment [S8]
- Account recovery SSO scope: Recovery does not bypass SSO or IdP-configured two-factor authentication [S8]
- Admin console sharing: organization owners · admins · some custom users · yes [S7]
- Admin console sharing: owners, admins, and some custom users can share directly from the Admin Console, including assign to collections in bulk [S7]
- Alternative login: yes [S6]
- Argon2id option: yes [S6]
- Assign to collections bulk: existing items can be assigned to collections in bulk via the action bar [S7]
- Authenticator: Bitwarden Authenticator [S1]
- Autofill: yes [S1]
- Automatic confirmation onboarding: yes [S11]
- Bulk share assign to collections: yes [S7]
- Business continuity: yes [S6]
- Client compatibility: mobile apps · desktop apps · browser extensions [S13]
- Code scanning: SonarQube · Codecov · linters [S6]
- Collection based access: yes [S7]
- Column encryption: yes [S6]
- Community forum account: yes [S3]
- Cookie categories: Strictly Necessary · Functional [S3]
- Core features: Open source security, zero-knowledge encryption, advanced two-step login, phishing protection [S2]
- Credential leasing: yes · yes [S13]
- Credential lifecycle: full credential lifecycle management [S1]
- Credential management features: Notes, credit cards, identities, passkeys, generator, email aliases, encrypted export [S2]
- Data sovereignty: x [S13]
- Deployment options: multiple deployment options, policies, integrations, developer tools [S1]
- Deployment options: standard · lite [S13]
- Edit view sharing: item ownership and collections can be changed in the Edit view [S7]
- Emergency access: premium · families · teams · enterprise · yes [S6]
- Encryption: end-to-end encrypted open-source platform [S1]
- Encryption: PBKDF2 SHA-256 · Argon2id · yes · AES-CBC 256-bit [S6]
- Encryption standard: yes · yes [S3]
- Enterprise policies: Enterprise · yes [S11]
- Event log access roles: Admins · Owners · custom role [S12]
- Event logs: teams · enterprise · yes [S6]
- Event logs access: yes · /events [S12]
- Event logs availability: Teams · Enterprise [S12]
- Event logs client event delay: instant · 60 [S12]
- Event types count: 60 [S12]
- Family plan: family plan with single subscription [S1]
- Fill assist selfhost custom ruleset: yes [S11]
- Free account limit: 1 [S4]
- Free family plan enterprise: Kostenloses Familien-Abo für alle Nutzer [S1]
- Free tools: Passwortgenerator · Passphrasen-Generator · Passwortstärke-Tester · Benutzernamen-Generator [S1]
- Helm chart: x [S13]
- Hibp integration: yes [S6]
- Hmac: SHA-256 · AES256-CBC-HMAC-SHA256 [S5]
- Hsts: yes [S6]
- Idp cannot decrypt: no [S9]
- Import items to organization: items can be added or imported to an organization with sharing specified upfront [S7]
- Incident response: yes [S6]
- Kdf iterations: PBKDF2 · yes · 600000 [S6]
- Key rotation: yes [S6]
- Local encryption: yes · yes [S5]
- Master password hash: 600000 · PBKDF2-SHA256 [S6]
- Minimum age: 13 [S3]
- Minimum age: 13 [S4]
- Msp program: yes [S2]
- New device no export needed: no [S14]
- Open source: yes [S1]
- Open source: yes [S6]
- Open source: x [S13]
- Organizations: yes [S6]
- Passkey algorithm: ES256 [S6]
- Passkey login: yes [S6]
- Passkeys and AI agents: credentials, passkeys, sensitive info for people, AI agents and machines [S1]
- Password complexity library: zxcvbn [S11]
- Passwordless dev: Passwordless.dev und Passkeys [S1]
- Passwordless dev: yes [S6]
- Permission warning: members with sufficient collection permission can alter or delete shared items [S7]
- Platforms: Windows · macOS · Linux · ChromeOS · Android · iPhone · iPad [S1]
- Policy account recovery administration: Account recovery administration · yes [S11]
- Policy autofill on page load: Enable autofill on page load · yes [S11]
- Policy automatic login SSO: Automatic login with SSO · yes [S11]
- Policy automatic user confirmation: Automatic user confirmation · yes [S11]
- Policy block account creation: Block account creation for claimed domains · yes [S11]
- Policy centralize ownership: Centralize organization ownership · yes [S11]
- Policy configuration roles: owners · admins [S11]
- Policy default uri match: Default URI match detection · yes [S11]
- Policy fill assist: Activate fill assist · yes [S11]
- Policy manage send: Manage Send · yes [S11]
- Policy master password requirements: Master password requirements · yes [S11]
- Policy password generator: Password generator · yes [S11]
- Policy removal of export clients: message shown in web app and CLI; option disabled in other clients [S11]
- Policy remove card type: Remove card item type · yes [S11]
- Policy remove export: Remove export · yes [S11]
- Policy remove sponsored families: Remove sponsored Families plan · yes [S11]
- Policy remove unlock pin: Remove Unlock with PIN · yes [S11]
- Policy require SSO: Require single sign-on (SSO) · yes [S11]
- Policy require two step login: Require two-step login · yes [S11]
- Policy session timeout: Session timeout · yes [S11]
- Policy single organization: Single organization · yes [S11]
- Policy SSO trusted devices dependency: Account recovery administration policy required for SSO with trusted devices [S11]
- Policy vault banner: Vault banner · yes [S11]
- Post quantum: yes [S5]
- Public key cryptography: RSA-OAEP · secure data sharing features such as organizations and emergency access [S5]
- Reclaim shared item ownership: yes [S7]
- Recommended export: encrypted .json [S14]
- Recovery code: yes [S6]
- Restriction alternative to unsharing: moving item to more restrictive collection suggested as alternative to removing from organization [S7]
- Secret manager: Secrets-Manager [S1]

**Support**
- Business 24 7: 24/7 priority support for Teams and Enterprise [S13]
- Help docs: Hilfe und Dokumentation [S1]

45 more facts on the canonical page: https://whats-best.ai/software/password-management/bitwarden

## Questions

### Is Bitwarden European?

No. whats-best.ai classifies Bitwarden as Rest of world.

### Where does Bitwarden store data?

Not stated on the vendor’s pages as of 13 Oct 2026.

### Does Bitwarden have a free plan?

Not stated on the vendor’s pages as of 13 Oct 2026.

### What are the best alternatives to Bitwarden?

As of 21 Oct 2026, the panel rates [Password Depot (3.5/5)](https://whats-best.ai/software/password-management/password-depot), [Keeper (3/5)](https://whats-best.ai/software/password-management/keeper) and [Passbolt (3/5)](https://whats-best.ai/software/password-management/passbolt) highest among the other 18 Password Management products evaluated. Ratings that look equal are rounded to half stars; the order uses the unrounded rating, then the name. The highest-rated European alternative is [Password Depot](https://whats-best.ai/software/password-management/password-depot) (EU-Made). Ratings are the AI panel’s opinion, formed from public evidence: [how scores are made](https://whats-best.ai/methodology#ordering). The full list, with European products first: [Bitwarden alternatives](https://whats-best.ai/software/password-management/bitwarden/alternatives).

## What this page leaves out

- 20 product facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 5 data facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 2 legal facts could not be confirmed on the vendor’s page as captured and were left out of this page and of the panel’s material.
- 1 compliance fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 integrations fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 subprocessors fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 1 support fact could not be confirmed on the vendor’s page as captured and was left out of this page and of the panel’s material.
- 2 sovereignty dimensions could not be confirmed on the vendor’s own pages and are shown as unknown.
- 6 of the readings below were written against an earlier fact sheet — a fact has been corrected, added or pulled since. Until the panel next runs on this product you are reading the older judgement.

## Sources

- [S1] Vendor homepage: https://bitwarden.com/de-de/ (checked 2026-10-13)
- [S2] Pricing page: https://bitwarden.com/pricing/business/ (checked 2026-10-13)
- [S3] Privacy policy: https://bitwarden.com/privacy/ (checked 2026-10-13)
- [S4] Terms of service: https://bitwarden.com/terms/ (checked 2026-10-13)
- [S5] Encryption model & independent audits — found from sitemap: https://bitwarden.com/help/what-encryption-is-used/ (checked 2026-10-13)
- [S6] Encryption model & independent audits — found from sitemap: https://bitwarden.com/help/bitwarden-security-white-paper/ (checked 2026-10-13)
- [S7] Sharing, roles & recovery — found from sitemap: https://bitwarden.com/help/sharing/ (checked 2026-10-13)
- [S8] Sharing, roles & recovery — found from sitemap: https://bitwarden.com/help/account-recovery/ (checked 2026-10-13)
- [S9] SSO, directory sync & provisioning — found from sitemap: https://bitwarden.com/help/about-sso/ (checked 2026-10-13)
- [S10] SSO, directory sync & provisioning — found from sitemap: https://bitwarden.com/help/sso-decryption-options/ (checked 2026-10-13)
- [S11] Audit logs, policies & reporting — found from sitemap: https://bitwarden.com/help/policies/ (checked 2026-10-13)
- [S12] Audit logs, policies & reporting — found from sitemap: https://bitwarden.com/help/event-logs/ (checked 2026-10-13)
- [S13] Hosting choice, offline access & export — found from sitemap: https://bitwarden.com/self-hosted-password-manager-on-premises/ (checked 2026-10-13)
- [S14] Hosting choice, offline access & export — found from sitemap: https://bitwarden.com/help/export-your-data/ (checked 2026-10-13)

---

Cite as: whats-best.ai, "Bitwarden — Password Management", AI panel analysis, as of 2026-10-21. https://whats-best.ai/software/password-management/bitwarden

Corrections: https://whats-best.ai/correct/672?target=page