Bitwarden — The Open-Source Password Manager
A 2026 overview of Bitwarden: an open-source, zero-knowledge password manager with a famously generous free tier, end-to-end encryption, and passkey support across every major platform.
Bitwarden encrypts your vault on your device before it ever reaches the servers — the company never sees your master password or your data. The apps and clients are open source and independently audited. Tap any section to expand.
- Definition: A cross-platform password manager that stores logins, passkeys, cards, identities, and secure notes in an encrypted vault.
- Everywhere: Web vault, browser extensions (Chrome, Firefox, Safari, Edge and more), desktop apps (Windows, macOS, Linux), iOS & Android, and a CLI.
- Open & portable: Source code is public on GitHub, and you can even self-host the whole server if you want full control of your data.
- Free — Unlimited passwords across unlimited devices, password generator, one-to-one sharing, passkey storage, and basic two-factor (authenticator app, email). Genuinely usable long-term.
- Premium — ~$19.80/year. Adds the integrated TOTP authenticator, file attachments, emergency access, vault health reports, and hardware-key 2FA (YubiKey, Duo, FIDO2).
- Families — ~$47.88/year for up to 6 people, with unlimited sharing and shared collections.
- Teams / Enterprise — ~$4 and ~$6 per user / month for organizations, adding SSO, policies, directory sync, and admin controls.
💡 Heads up: In January 2026 Premium roughly doubled from $9.99 to $19.80/year — its first price change in about a decade. Existing subscribers got a one-time loyalty discount on renewal. (Prices vary by region and may change.)
- Passkeys: Store and use FIDO2 passkeys for passwordless, phishing-resistant sign-in.
- Autofill: Across browsers and mobile, with inline suggestions.
- Password generator: Strong passwords, passphrases, and username/email aliases (incl. integrations with masked-email services).
- Bitwarden Send: Share text or files securely with expiry and access limits.
- Vault Health Reports: Surface weak, reused, exposed, and unsecured credentials (Premium).
- Authenticator: Built-in TOTP plus a standalone Bitwarden Authenticator app.
- Emergency Access: Grant trusted contacts time-delayed access (Premium).
- Zero-knowledge: Your vault is encrypted and decrypted locally; Bitwarden's servers only ever store ciphertext.
- Encryption: AES-256 for vault data, with your master password strengthened via a key-derivation function — PBKDF2-SHA256 or the stronger, memory-hard Argon2id (recommended).
- Open source: All client and server code is public and subject to community review.
- Audited & compliant: Regular third-party security audits and penetration tests; SOC 2 Type 2, GDPR, and similar attestations.
- Self-hosting: Run the server on your own infrastructure for complete data ownership.
- SSH Agent (Jan 2025): Manage and use SSH keys directly from the desktop app's vault.
- Passkey login for browser extensions: Passwordless unlock on Chromium browsers using the WebAuthn PRF standard.
- Native Windows 11 passkeys: Built with Microsoft — store and use passkeys at the OS level, managed through your Bitwarden vault.
- Passkey portability: Contributions to the FIDO Credential Exchange Protocol enable secure passkey transfer and recovery across devices and ecosystems.
- MCP server: A Model Context Protocol server lets AI agents retrieve and manage secrets via authenticated CLI/API — without exposing raw secrets or breaking zero-knowledge.
- Access Intelligence (Enterprise): Credential-risk insights and guided remediation at organizational scale.
- Strong master password: Use a long, unique passphrase you never reuse — it is the one key that protects everything.
- Switch KDF to Argon2id: In Settings → Security → Keys, prefer Argon2id over PBKDF2 for stronger resistance to brute force.
- Turn on two-step login: Authenticator app at minimum; a hardware key (YubiKey/FIDO2) for the best protection.
- Save your recovery code: Store the two-step recovery code somewhere safe and offline.
- Adopt passkeys: Where sites support them, prefer passkeys — phishing-resistant and storable in Bitwarden.
- Run Vault Health: Periodically fix weak, reused, or exposed credentials it flags.
Bitwarden's pitch is simple: strong, open, audited encryption with a free tier that's actually enough for most people — and paid tiers that stay inexpensive. For a related personal organising guide, see the NordPass readme.