Bitwarden

Bitwarden is an open-source password manager that stores logins, passkeys, cards and notes inside an end-to-end encrypted vault that syncs across every device you own. We rate it 91/100 — the best free password manager you can use right now, and the only one whose entire client and server source code anyone can read on GitHub. The catch: a real-world supply-chain incident in April 2026 reminded everyone that "open source" is not a synonym for "automatically safe."

What is Bitwarden?

Bitwarden was founded by Kyle Spearrin and publicly launched on August 10, 2016. Headquartered in Santa Barbara, California, the company raised a $100 million growth round from PSG and Battery Ventures in 2022, has been independently audited every year since 2018, and as of April 29, 2026 is used by more than 10 million users and 50,000 business customers worldwide. The full client (web, mobile, desktop, browser extension, CLI) and server are published under combinations of GPLv3, AGPLv3 and the Bitwarden Source License at github.com/bitwarden.

The product solves a single, durable problem: humans cannot memorize a unique 16-character password for every site they touch, and the operating-system keychains that try to fill the gap (iCloud Keychain, Google Password Manager) only work cleanly inside their own ecosystems. Bitwarden runs on every major desktop OS, every major mobile OS, every major browser, and the command line — and the same vault syncs to all of them, encrypted with AES-256 and a master password that never leaves your device.

\n \n \n

Key Features of Bitwarden

• Truly unlimited free tier: Unlimited passwords, unlimited devices, free forever — Bitwarden is the only major password manager whose free plan is not a 30-day trial in disguise.
• End-to-end AES-256 + PBKDF2/Argon2id: Vault data is encrypted client-side before it ever touches the server. Argon2id is now the default key-derivation function for new accounts, with 600,000 PBKDF2 iterations as the legacy minimum.
• Passkey support: Bitwarden stores and syncs passkeys across browsers and OS combinations that natively cannot share them — including Safari → Chrome → Firefox on the same machine — and supports passkey login to the vault itself.
• Bitwarden Send: Encrypted, expiring file and text shares with view limits and password protection — the open-source equivalent of 1Password's "Item Sharing".
• Bitwarden Authenticator + integrated TOTP: Premium accounts can generate and autofill 2FA codes inside the same login record, and a free standalone iOS/Android app launched in 2024 for users who want their TOTP separated from their passwords.
• Self-hosting two ways: Run the official Docker stack or the lightweight community fork Vaultwarden on a $4 VPS — both speak the same Bitwarden client protocol.
• SSO, SCIM and account recovery for teams: Enterprise tier adds SAML/OIDC SSO, SCIM provisioning, granular role-based access and admin-initiated account recovery (key-based, never plaintext).
• Audited every year: Public reports from Cure53 (2018, 2020, 2022), Insight Risk Consulting (2021), and Stake (2023) — no other free password manager publishes this many third-party audits.

\n \n \n

What Users Say About Bitwarden

Sentiment across Reddit, Hacker News, G2 and Capterra is unusually consistent. On r/Bitwarden, r/selfhosted and r/privacy, the most upvoted recurring praise is the same line repeated for years: \"the free tier is better than every competitor's paid tier.\" G2 rates Bitwarden 4.6/5 across more than 1,400 reviews and Capterra rates it 4.6/5 across more than 2,800 — the recurring positive theme is value, the recurring complaint is UX polish.

The complaints are also predictable. The desktop and mobile UIs feel a half-generation behind 1Password and Dashlane — multiple Hacker News commenters call it \"the Linux of password managers: powerful, ugly, and right.\" iOS users on the App Store cite occasional autofill flakiness on Safari, the mobile app's biometric unlock has lost a few users to crashes after major iOS updates, and a vocal minority on r/selfhosted still wishes the official self-hosted server were Apache-licensed instead of using the bespoke Bitwarden License with a 200-seat cap. The biggest single hit to user trust in the last twelve months was the brief Checkmarx supply-chain incident on April 22, 2026, when a malicious @bitwarden/[email protected] npm package shipped through a compromised CI/CD action and was alive for roughly 90 minutes — Bitwarden rotated the keys, deprecated the release, and confirmed no end-user vault data was accessed, but it was a deserved black eye and a reminder that supply-chain security is everyone's problem.

Bitwarden Pricing

Bitwarden's pricing is the simplest in the category — and the cheapest at every tier where competitors charge.

\n \n \n \n \n \n \n \n \n

Plan	Price	Key Limits
Free	$0/forever	Unlimited passwords, unlimited devices, basic 2FA (TOTP, email), Bitwarden Send (text only), self-hosting allowed.
Premium	$1.65/mo ($19.80/yr)	Adds integrated TOTP autofill, advanced 2FA (YubiKey/FIDO2/Duo), 1 GB encrypted file Send, emergency access, vault health reports.
Families	$3.99/mo ($47.88/yr)	Up to 6 users, unlimited shared collections, all Premium features for everyone.
Teams	$4/user/month	Shared collections, event logs, directory connector for AD/LDAP/Azure/Okta/Google.
Enterprise	$6/user/month	SSO (SAML/OIDC), SCIM, granular role-based access, account recovery, optional self-hosting.

\n

Self-hosters who run Vaultwarden or the official Bitwarden server on their own hardware get every Premium and Enterprise feature for free — Bitwarden has been remarkably hands-off about this and even publishes the API contract publicly.

\n \n \n

Who Should Use Bitwarden?

Best for: Privacy-minded individuals who refuse to lock their secrets inside a single OS vendor's ecosystem, families that want one shared vault without paying $5+/month, developers who want a CLI to read secrets in CI/CD pipelines, and IT teams at small-to-medium businesses who want enterprise SSO and SCIM at one-third the price 1Password Business charges.

Not ideal for: Users who want the most polished UI on the market — 1Password and Dashlane still beat Bitwarden on visual design and onboarding flow. Buyers who require extras like a built-in VPN (NordPass, Dashlane), live dark-web monitoring (1Password Watchtower goes deeper), or biometric unlocking on every supported platform without occasional friction.

Pros and Cons

Pros:

• The only major password manager with a genuinely useful free tier — unlimited everything across unlimited devices
• Open source and audited annually by independent third parties — every line of client and server code is on GitHub
• Full self-hosting story: official Docker stack or the popular Vaultwarden fork on a $4 VPS
• Premium is the cheapest paid tier in the category at $19.80/year while shipping integrated TOTP, hardware-key 2FA and emergency access
• Native passkey support that bridges browser and OS silos that natively cannot share passkeys
• SSO and SCIM at $6/user/month — roughly half what 1Password Business charges for equivalent features

Cons:

• UI feels a generation behind 1Password and Dashlane on every platform — workable, not delightful
• The Checkmarx-related npm CLI compromise on April 22, 2026 was a real (if brief) operational failure and a reminder that open source still relies on hardened CI/CD
• iOS Safari autofill is flakier than the iCloud Keychain alternative for non-power users
• No built-in VPN, no continuous dark-web monitoring on the consumer plans, no \"travel mode\" equivalent to 1Password
• Bitwarden Source License (server) is not OSI-approved — purists prefer Vaultwarden

Alternatives to Bitwarden

The closest competitors each trade something away. 1Password ($2.99/mo individual, $4.99/mo families) ships the slickest UI and the strongest \"travel mode\" but is closed-source and has no free tier. Vaultwarden is the community-built Rust reimplementation of the Bitwarden server — same clients, same protocol, fully self-hosted and fully GPL-licensed. Proton Pass bundles a password manager with Proton Mail/Drive/VPN starting at $1.99/mo and has caught up fast on UX, but its free tier is more limited than Bitwarden's and its open-source clients are newer and less audited. KeePassXC is the offline-first option for users who refuse cloud sync entirely.

Verdict: Is Bitwarden Worth It?

Bitwarden is worth it for almost everyone. The free tier alone is good enough that we recommend it as the default password manager for anyone who has not yet adopted one — there is no excuse not to install it tonight. The $19.80/year Premium upgrade is the best value in security software full stop, and the Teams/Enterprise tiers are the obvious choice for businesses that want SSO and SCIM without paying premium-brand prices. The April 2026 npm CLI compromise dings the rating but it was contained in 90 minutes, no vault data was lost, and Bitwarden's response was textbook. Use Bitwarden, enable Argon2id and a hardware key, keep your CLI install pinned to known-good versions, and you have a 91/100 setup that costs less than a single coffee per month.

Frequently Asked Questions

\n

Is Bitwarden free?

\n

Yes. Bitwarden's free plan stores unlimited passwords on unlimited devices forever, with basic 2FA, the password generator, and Bitwarden Send for text. Premium is $1.65/month billed annually ($19.80/year).

\n\n

Is Bitwarden safe after the April 2026 supply-chain incident?

\n

Yes — but pin your CLI version. The malicious @bitwarden/[email protected] npm package was alive for about 90 minutes on April 22, 2026 before being deprecated. Bitwarden confirmed no vault data was accessed. Vault encryption is end-to-end and was unaffected.

\n\n

What platforms does Bitwarden support?

\n

Web vault, native apps for Windows / macOS / Linux, iOS and Android, browser extensions for Chrome, Edge, Firefox, Safari, Brave, Vivaldi, Opera, Tor and Arc, plus a full CLI and a public REST API.

\n\n

Is Bitwarden open source?

\n

Yes. Every Bitwarden client (web, mobile, desktop, extension, CLI) is GPLv3 or AGPLv3. The official server uses the bespoke Bitwarden Source License, which permits free self-hosting up to 200 seats. The Vaultwarden community server is a fully GPLv3 alternative.

\n\n

How does Bitwarden compare to 1Password?

\n

Bitwarden is open source, has a far better free tier, costs less at every paid tier, and is self-hostable. 1Password has the more polished UI, sharper Watchtower monitoring, and a better travel mode. For most people, Bitwarden's $19.80/year Premium is the better deal.

\n\n

Can I self-host Bitwarden for free?

\n

Yes. Run the official Docker stack from github.com/bitwarden/server or the lightweight Rust fork Vaultwarden on a $4/month VPS. Both speak the same Bitwarden client protocol, so every official Bitwarden app keeps working.

\n