Bitwarden

What Bitwarden does

Bitwarden is a password manager in the same mold as 1Password or LastPass: an account on a server holds an encrypted vault that syncs to browser extensions, desktop apps for Windows, macOS and Linux, mobile apps and a command-line client. Besides logins it stores secure notes, payment cards and identities, and it can save passkeys and sign you in with them. Bitwarden Send shares a piece of text or a file through an encrypted link.

Sharing works through organizations. A free organization lets two people share items; the Families plan and the business plans add collections, groups, permissions, policies, event logs, directory synchronization and SCIM provisioning. Enterprise adds single sign-on and account recovery by administrators.

Security and encryption

Bitwarden describes its design as end-to-end and zero-knowledge. Items are encrypted on the device with AES-CBC 256-bit and HMAC authentication, using a key derived from the master password with PBKDF2 SHA-256 or Argon2id. Keys are created and kept on the client, and the company says it never stores or can read the master password. The flip side is that a forgotten master password locks you out unless emergency access or Enterprise account recovery was set up beforehand; both rely on RSA public-key encryption of the user’s key.

According to its compliance page, Bitwarden commissions annual source code audits and penetration tests of its clients and core application and annual network assessments, and it holds ISO 27001, SOC 2 Type II and SOC 3 certifications. It also runs a HackerOne bug bounty.

Self-hosting Bitwarden

The official server is a set of Docker containers installed with the bitwarden.sh (or PowerShell) script. The documented minimum is an x64 machine with 2 GB of RAM and 12 GB of storage, with 4 GB and 25 GB recommended, Docker Engine 26 or later, a domain name and an SMTP server. It ships with an MSSQL Express container, which caps the database at 10 GB, or it can use an external SQL Server. Every install needs an installation ID and key from Bitwarden, and paid features on your own server still require a license file from a cloud subscription.

Bitwarden lite is a single container that needs about 200 MB of RAM, runs on ARM and can use PostgreSQL, MySQL/MariaDB, SQLite or SQL Server, but Bitwarden says it is for personal use and home labs, not businesses. For a lighter community-built server that works with the same apps, see Vaultwarden.

Hosted version

Bitwarden, Inc. runs the cloud service with separate US and EU data regions; an account lives only in the region where it was created. A free plan covers basic password management across devices. Premium adds the integrated authenticator, file attachments, emergency access and security reports, and there are Families, Teams and Enterprise plans.

Limitations

Bitwarden is open core. The core server is AGPL-3.0 and the apps GPL-3.0, but some modules aimed at larger organizations, including the SSO integration, are under the source-available Bitwarden License, which requires a paid subscription in production. The standard self-hosted stack is heavier than most self-hosted apps, and self-hosting is listed as an Enterprise feature for businesses. The standard deployment is limited to x64 hardware.

Who it suits

Bitwarden fits most people moving away from a commercial cloud password manager: individuals who want a free plan, families, and companies that need provisioning, policies and SSO. Organizations that must keep the vault on their own infrastructure can run the official server, and home users who self-host often choose Vaultwarden with the same clients. Our password manager guide compares it with local, file-based options such as KeePassXC.