Bitwarden review: the most verifiable password manager, and still the cheapest to keep

Bitwarden is an open-source password manager from Bitwarden, Inc., a Santa Barbara, California company founded in 2016. It keeps your passwords, passkeys, card details and notes in an encrypted vault that syncs across your devices. The free plan sets no limit on passwords or devices. Bitwarden says more than 15 million people and 80,000 businesses use it (Bitwarden, About).

On the Cybernock research rubric Bitwarden scores 9.1/10 and ranks first in our best password managers. It leads on the two criteria that settle most choices in this category: how much of its security you can check, and what it costs. Every client is open source. Independent firms audit it every year. Premium costs $19.80 a year. 1Password has the more polished apps, but Bitwarden gives you more proof for less money.

How secure is Bitwarden?

Very secure, and unusually easy to verify. Your vault is encrypted on your device with AES-256, and Bitwarden never receives your master password or your keys. By default the master password is stretched with 600,000 rounds of PBKDF2-SHA256. You can switch to Argon2id, which resists graphics-card cracking better (Bitwarden KDF documentation). You change it once, in the web vault.

Its audit record is the deepest of any password manager we rank. Bitwarden publishes the reports: Cure53 has reviewed it every year since 2021, and 2025 alone brought work by Cure53, the Applied Cryptography Group at ETH Zurich, Palo Alto Networks’ Unit 42 and Fracture Labs (Bitwarden audit list). It holds SOC 2 Type II and ISO 27001 certification and runs a disclosure program on HackerOne. Because the code is public, outside researchers can confirm each fix.

Openness cuts both ways: the weak spots are public too. The ETH Zurich study, which Bitwarden commissioned, became the paper Zero Knowledge (About) Encryption (USENIX Security 2026). It describes 12 attacks against Bitwarden that work only if Bitwarden’s own servers turn malicious or are taken over. That’s more than the researchers found against LastPass, Dashlane or 1Password. Bitwarden says seven issues are fixed or being fixed and three are deliberate design choices.

Two other events belong in the record. On 22 April 2026 a malicious copy of Bitwarden’s command-line tool sat on the npm package registry for about 90 minutes; Bitwarden says no vault data was touched. In August 2025 the browser extension was among those exposed to a clickjacking attack shown at DEF CON, fixed in version 2025.8.2 on 31 August 2025. Bitwarden has never reported a breach of user vaults.

Which Bitwarden features matter most?

• Unlimited passwords, passkeys and devices on the free plan, with sync across all of them.
• Bitwarden Send: share text, or files on Premium (up to 500 MB), with anyone by link, including people without an account. Links expire after at most 31 days.
• Built-in authenticator for two-factor codes, on Premium and Families.
• Emergency access: a trusted contact can view or take over your vault after a waiting period you set. Premium and above.
• Email aliases: the username generator creates forwarding addresses through SimpleLogin, Addy.io, Firefox Relay, Fastmail, Forward Email or DuckDuckGo.
• Breach report powered by Have I Been Pwned, free for everyone; vault health reports need Premium.
• Self-hosting for people who want the vault on their own server, plus a CLI and an SSH agent in the desktop app.

Apps cover Windows, macOS, Linux, iOS and Android, with a web vault and extensions for Chrome, Firefox, Safari, Edge, Opera, Brave, Vivaldi, DuckDuckGo and the Tor Browser (Bitwarden downloads). Premium includes 5 GB of encrypted file storage, up from 1 GB before January 2026.

In practice, Send is the feature to remember when you need to pass a Wi-Fi key or a contract to someone outside your household. A self-expiring link beats pasting secrets into email.

Is Bitwarden’s free plan enough?

For most single users, yes. The free plan stores unlimited passwords and passkeys on unlimited devices, includes the breach report, and lets you share with one other person. Only the authenticator, emergency access, file storage and vault health reports cost money.

No other password manager we rank gives this much away. Proton Pass comes closest and adds 10 email aliases. NordPass limits free users to one active device at a time, Keeper to one phone and 10 records, and Dashlane ended its free plan in September 2025.

One caution. In April 2026 the words “always free” briefly vanished from Bitwarden’s personal plan page after a change of CEO. They returned in May, and the new CEO, Michael Sullivan, wrote that the free tier will stay (Bitwarden blog).

How much does Bitwarden cost?

Premium costs $19.80 a year ($1.65 a month). Families costs $47.88 a year for up to six people. Both prices come from Bitwarden’s pricing page in October 2026. There’s no intro discount, so the price you see is the price you renew at, and paid plans carry a 30-day refund.

Prices rose on 20 January 2026. Premium nearly doubled from $10 a year and Families went up from $40, while Bitwarden added storage, password coaching and vault health alerts. Existing subscribers got a one-time 25% discount on their next renewal. Even so, Premium remains the cheapest renewing paid plan among the managers we rank.

The family maths is simple. Two adults pay less with two Premium plans ($39.60) than with Families ($47.88). From three people up, Families is cheaper and adds unlimited sharing.

Where does Bitwarden fall short?

• The apps are plainer than 1Password’s, and autofill takes more setup on some sites.
• No travel mode for hiding vaults when you cross a border, which 1Password includes.
• The ETH Zurich paper found more malicious-server attacks against Bitwarden than against any rival studied, and three are accepted as design choices rather than fixed.
• The authenticator and emergency access are paid features.
• No public affiliate program, so review sites earn nothing from it; that does not affect its score here.

How does Bitwarden compare with 1Password, Proton Pass and NordPass?

1Password wins on polish and extras such as Travel Mode and Watchtower, if you accept $47.88 a year with no free plan. Proton Pass matches Bitwarden on open source and adds unlimited email aliases on Pass Plus, which helps if you sign up for many sites. NordPass is cheaper for its first term but closed source, and its prices rise at renewal.

Who should not use Bitwarden?

Bitwarden is a poor fit for three groups.

• People who cross borders with sensitive data. 1Password’s Travel Mode hides chosen vaults on your devices; Bitwarden has no equivalent.
• Anyone who won’t tolerate fiddly autofill. Bitwarden’s apps are plainer, and some sites need manual setup. If a family member gives up on a clunky app, the cheaper plan saves nothing.
• Organisations that need FedRAMP authorisation. Keeper covers that requirement.

Should you use Bitwarden?

For most people, yes. The evidence is unusually complete: open-source code, yearly audits by named firms, free use on unlimited devices, and $19.80 a year for the extras. Start on the free plan. Move to Premium or Families when you want the authenticator, emergency access or family sharing.

Choose differently in three cases. If you want the smoothest apps and features such as Travel Mode, pay more for 1Password. If you want an email alias for every account, choose Proton Pass. If your employer needs FedRAMP or similar certifications, look at Keeper. See the full best password managers ranking or browse all password manager reviews.