Bitwarden is a real, open-source password manager that publishes named third-party security audits and says it uses end-to-end encryption, so even its own team can't read your vault. The catch is on your side: if you forget your master password, Bitwarden says you'll be locked out of your account.
Handing every password you own to one app is a big decision, so it's right to ask whether Bitwarden is safe before you do it. I've read Bitwarden's own security pages, its audit list and the public record on the company, and I'll stick to what those sources say rather than guess.
Who is behind Bitwarden
According to Wikipedia, Bitwarden debuted in 2016, and Kyle Spearrin is its original author and was named CTO in 2024. In 2022 the company announced 100 million US dollars in Series B financing, led by PSG with Battery Ventures taking part. So it's a venture-backed company with named people, not an anonymous side project.
Wikipedia also says the Bitwarden server is licensed under AGPL-3.0-only and the apps under GPL-3.0-only, with some modules proprietary, and that you can self-host it. Open code means outside experts can read how it works, which is a different trust model from a closed product.
How Bitwarden says it protects your vault
Bitwarden's security white paper describes end-to-end AES-CBC 256 bit encryption with HMAC authentication. It says your master password is stretched using PBKDF2 with 600,000 iteration rounds by default, and that you can switch to Argon2id if you prefer.
The same page makes the zero-knowledge claim in plain words: Bitwarden says it never stores and can't access your master password or your cryptographic keys, and that its team members can't see your passwords. In practice, that means your data is scrambled on your device before it reaches Bitwarden's servers.
The audits Bitwarden lists
A safety claim is worth more when outsiders check it. Bitwarden's audit page lists third-party assessments from 2018 through 2025 and names the firms, including Cure53, IOActive, Mandiant, Unit 42 by Palo Alto Networks, Fracture Labs and the Applied Cryptography Group at ETH Zurich.
On compliance, Bitwarden says it has completed SOC Type 2 and SOC 3 compliance, and that it's HIPAA compliant and GDPR compliant. Those are the company's own statements on its audit page, so if you need a report for work, ask Bitwarden for the documents rather than relying on a summary.
| What I checked | What Bitwarden's pages say |
|---|---|
| Encryption | End-to-end AES-CBC 256 bit with HMAC authentication |
| Can staff read my vault? | Bitwarden says its team can't see your passwords |
| Outside audits? | Named firms listed from 2018 to 2025 |
| Open source? | Yes, with some proprietary modules, per Wikipedia |
| Forgot the master password? | You'll be locked out of your account |
What can still go wrong with Bitwarden
No password manager removes every risk. Wikipedia notes that in 2026 researchers at ETH Zurich and USI reported 12 attacks that worked against Bitwarden under a malicious-server assumption, compared with 7 against LastPass and 6 against Dashlane. That's a research finding about a worst-case scenario, not a report of customer vaults being stolen, and I found no source describing a Bitwarden vault breach.
Wikipedia also records a browser-extension clickjacking issue presented in 2025, which it says a later Bitwarden release addressed. The lesson is simple: keep the app and extension updated.
- Choose a long, unique master password you've never used anywhere else.
- Turn on two-step login and store your recovery code somewhere safe.
- Keep the browser extension, desktop app and phone app up to date.
- Be careful where you use autofill, especially on sites you don't recognise.
What to do before you move your passwords in
Before you import anything, set the account up carefully: create the master password first, write the recovery code down on paper, and confirm two-step login works. Then import your old passwords in one go and delete the exported file straight away, because an unencrypted export sitting in your downloads folder undoes the protection you've just set up.
It's also sensible to keep a short emergency plan. If you run a business, decide who else needs access and use the sharing features Bitwarden documents rather than passing passwords around in chat. If you use a family or team plan, check Bitwarden's pricing page for what each plan includes, because the free plan only shares with one other user.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Is Bitwarden free, and what do paid plans add?
Bitwarden's pricing page says the free plan includes unlimited devices and unlimited passwords, passkey management and a password generator. Paid plans add things like the integrated authenticator, file attachments, emergency access and security reports. If you only need the basics, the free plan covers them, according to Bitwarden's own page.
If you're deciding between tools, my comparison of Bitwarden against its best-known rival goes through who each one suits, and my full review of that rival covers the other side.
Fake Bitwarden apps and phishing
A password manager is a juicy target for scammers, so be wary of anything claiming to be Bitwarden that you reached through an advert or message.
- Install only from Bitwarden's official website or an official app store or browser store.
- Never type your master password into a page you reached from an email or text.
- Bitwarden says it can't see your master password, so nobody from its team will legitimately ask for it.
- Treat any urgent warning about your vault with suspicion and go to the app directly.
My verdict on Bitwarden
This is a legitimate, well-documented password manager with named outside audits and open code, and that's a stronger evidence trail than many rivals offer. It isn't magic, though. Your master password is the weak point: pick a strong one, switch on two-step login and keep your recovery code safe.
Frequently asked questions
Is Bitwarden safe to use?
Bitwarden describes end-to-end AES-CBC 256 bit encryption and lists third-party audits by named firms from 2018 to 2025. You still need a strong master password and two-step login.
Can Bitwarden see my passwords?
Bitwarden says it never stores and can't access your master password or cryptographic keys, and that its team members can't see your passwords.
What happens if I forget my master password?
Bitwarden says forgetting a master password will result in you being locked out of your account, with limited exceptions such as emergency access and administrator account recovery in Enterprise organizations.
Is Bitwarden open source?
Wikipedia says the server is licensed under AGPL-3.0-only and the apps under GPL-3.0-only, with some proprietary modules, and that you can self-host.
Is Bitwarden free?
Bitwarden's pricing page says the free plan includes unlimited devices and unlimited passwords, with paid plans adding extras such as emergency access and file attachments.
