Bitwarden
The open-source choice: clients and server on GitHub, self-hosting or an EU cloud region on any plan, twenty-four published audits since 2018, a full free plan, Teams at $4 a user with SCIM and event logs, Enterprise at $6 with SSO, a CLI, a public API, a Secrets Manager and an official MCP server. The trade-offs: dollars only, annual billing only, SSO gated to Enterprise, and a Trustpilot 3.2 on 362 reviews.
How we testBitwarden (Bitwarden, Inc., Santa Barbara, California, founded 2016, private, with a $100 million growth investment from PSG in 2022) is the password manager you can read. The web, extension, desktop, CLI, Android and iOS clients and the server are all public on GitHub, the vault is encrypted with AES-256 and HMAC using a key stretched with 600,000 rounds of PBKDF2 or, at the user's choice, Argon2id, and the "Is Bitwarden audited?" page lists twenty-four assessments between 2018 and 2025, most by Cure53 and including a 2025 cryptography review by ETH Zurich's applied cryptography group. Compliance is SOC 2 Type II, SOC 3 and ISO 27001, with a private HackerOne bounty. The one wobble is on the record: in October 2024 a desktop release pulled in an SDK under a licence that barred use with non-Bitwarden software; an issue titled "Bitwarden is no longer free software" was opened on 17 October and by 25 October the SDK crates were back under GPL-3.0, with the restrictive licence confined to the Secrets Manager crate.
Prices in US dollars on 8 September 2026; Bitwarden has no pound page, and the tax basis is not stated. Free is a full individual vault with no device limit. Premium is $1.65 a month ($19.80 a year) for the built-in authenticator, file attachments, emergency access and health reports; Families is $3.99 a month for six. Teams is $4 a user a month billed annually, with shared collections, event logs, directory sync, SCIM provisioning and the public API; Enterprise is $6 a user with SSO (SAML and OIDC), enterprise policies, account recovery, a self-hosting option and a free Families plan for every user. Neither business tier offers monthly billing. The terms give a 30-day refund policy on all paid services and at least 30 days' notice of a price change. The EU data region is chosen at signup on any plan and cannot be changed afterwards.
Tooling is the best in the field alongside 1Password: an official open-source CLI, a REST API for organisation management (Teams and Enterprise), Bitwarden Secrets Manager with SDKs, and an official MCP server that runs locally over the CLI and can read and write vault items, generate passwords and, for admins, approve devices and manage collections, which makes its permissions worth reading before an agent gets a session token. Passkeys are stored and filled, TOTP codes live in the vault on Premium and above, a hardware key can be a second factor, and the apps cover Windows, macOS and Linux. Support is 24/7 by ticket with priority on paid plans, no phone. Trustpilot is 3.2 on 362 unprompted reviews, 74% five-star and 16% one-star, the one-star themes being extension lag after an April 2026 update, lockouts and a price that "doubled in one year".
Not yet tested by Saaskly: assessed on published pricing, documentation, audit reports and third-party reviews.
Pros
- +Fully open source, self-hostable, with an EU cloud region on any plan and twenty-four published audits since 2018
- +A full free plan; Teams at $4 with SCIM, event logs and the API; SOC 2, SOC 3 and ISO 27001
- +CLI, public API, Secrets Manager and an official MCP server
Cons
- −SSO is Enterprise only ($6); business plans are annual billing only; dollars only
- −The October 2024 SDK licence episode, reversed within a week
- −Trustpilot 3.2 on 362 reviews with extension performance and lockouts the themes; no phone support
Pricing
Minimum commitment: $1.65 ($1.65/yr for the entry licence). The least you can spend before walking away; excludes numbers, minutes and add-ons.
Premium (individual)
$1.65/yr · annual commitment
Month-to-month: not published
- ✓$1.65/mo ($19.80/yr), USD only, tax basis not stated. Free plan: full individual vault, unlimited devices. Families $3.99/mo for 6. 30-day refund policy.
Teams
$4/yr · annual commitment
Month-to-month: not published
- ✓$4/user/mo billed annually: collections, event logs, directory sync, SCIM, public API. Enterprise $6/user/mo annual adds SSO, policies, self-hosting option, free Families for all users. No monthly billing on business plans.
Specifications
| Rating | 4.1 |
| Business per user* | $4/user/mo annual only (Teams) |
| Individual | $1.65/mo annual only |
| Free tier | Full-featured |
| Seat minimum | 1 |
| Breach on record | No |
| Last audit | 2025 (Cure53, ETH Zurich, Unit 42, Fracture Labs) |
| Open source | Clients + server |
| Self-host | ✓ |
| Passkeys | Store |
| TOTP codes | ✓ |
| Hardware key | ✓ |
| SSO | Extra cost |
| SCIM | ✓ |
| Shared vaults | ✓ |
| Secrets manager | ✓ |
| CLI | ✓ |
| MCP server | ✓ |
| Owned in** | US-owned |
| Data location | US or EU region chosen at signup; or self-hosted |
| Trustpilot (reviews) | 3.2 (362) |
| Family plan | $3.99/mo (6 seats) |
| Scored tier | Teams |
| Tier above | Enterprise ($6/user) |
| Free tier limits | Unlimited devices; no built-in authenticator, attachments or emergency access |
| Money-back (days) | 30 |
| Encryption | AES-256-CBC with HMAC; PBKDF2 600,000 rounds or Argon2id |
| Zero-knowledge | ✓ |
| Bug bounty | ✓ |
| Email aliases | No |
| Built-in VPN | No |
| Admin console | ✓ |
| Role-based permissions | ✓ |
| Password health reports | ✓ |
| Dark-web monitoring | No |
| External sharing | No |
| Guest accounts | No |
| Emergency access | ✓ |
| Audit logs | ✓ |
| Browser extensions | Chrome, Firefox, Safari, Edge, Brave, Opera, Vivaldi |
| Desktop apps | ✓ |
| Linux | ✓ |
| API | ✓ |
| HQ | US |
| Owner | Bitwarden, Inc. |
| SOC 2 | ✓ |
| ISO 27001 | ✓ |
| Live chat | No |
| Phone support | No |
| Support channels | Ticket 24/7, Community forum |
*Business per user: the business or teams tier the score is set on, per user per month on annual billing and then month-to-month, in the currency the vendor shows a UK visitor on the research date; see each profile for the VAT basis, the seat minimum and what the tier above adds.
**Owned in: where the company that owns the provider answers to. A US-owned provider is subject to US law (including the CLOUD Act) wherever the vault is stored; with a zero-knowledge design the vendor cannot read the vault either way, so this column is about the company, not the encryption. "Data location" records where the encrypted vault is stored.
Researched and drafted with AI assistance; reviewed and approved by Tim Meredith. How we use AI
Work at Bitwarden? Something not look right? Register in the vendor portal to see what we publish and send corrections.