Bitwarden
The open-source password manager with a genuinely free unlimited tier and optional self-hosting.
About
Bitwarden is a freemium open-source password manager for individuals and teams, developed by Bitwarden Inc. of Santa Barbara, California. It stores credentials in a zero-knowledge encrypted vault with AES-256 encryption and PBKDF2 or Argon2id key derivation, and the full codebase is public on GitHub, where a September 2026 snapshot showed roughly 20,000 stars. The free tier is one of the most generous in the category: unlimited passwords on unlimited devices, plus passkeys, a TOTP-capable two-step login, and the option to self-host the server for full data sovereignty.
Paid plans add vault health reports, breach reports, emergency access, an integrated authenticator, 1 GB of encrypted file attachments, and priority support. Premium runs $10 per year for individuals, Families is $3.33 per month for up to six users, and Business plans start at $4 per user per month with a separate Secrets Manager product for developer credentials. A September 2026 comparison snapshot showed Bitwarden Business at $4 per user per month, and independent reviews consistently praise the value while noting the interface feels more functional than polished. Like most cloud vaults, some vault metadata (such as item URLs) is stored unencrypted server-side, which is worth knowing.
What it can do
- Unlimited passwords and devices on the free tier
- Open-source clients and server, auditable on GitHub
- AES-256 encryption with PBKDF2 or Argon2id key derivation
- Passkey storage and management
- Bitwarden Send for sharing secrets with non-users
- Organizations with collections, roles, and SSO/SCIM (paid)
- Bitwarden Secrets Manager for developer credentials
- Self-hosting option for full data sovereignty
- Cross-platform: Windows, macOS, Linux, iOS, Android, all major browsers, CLI
Setup
Create an account at bitwarden.com, install the browser extension or desktop/mobile apps, and import passwords from your browser or another manager. Paid features and organizations are enabled from the web vault. For self-hosting, run the official Docker Compose stack on your own server and point the clients at your URL.
Prerequisites
An email address for a cloud account, or a Docker host with roughly 2 GB RAM for self-hosting.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (metrics tier, metrics-v1). Evidence: Wikipedia and independent 2026 comparisons confirm the open-source codebase, AES-256 with PBKDF2/Argon2id, the unlimited free tier, the $10/year Premium and $3.33/month Families pricing, and self-hosting; AlternativeTo's GitHub snapshot shows ~20.2k stars with recent activity. Strengths: the strongest free tier in the category, genuinely auditable code, cheap premium, real self-hosting. Docked for: (1) the UI is functional rather than polished, with sharing and sync more complex than 1Password; (2) some vault metadata such as item URLs is stored unencrypted server-side; (3) master-password recovery is impossible by design, which is correct security but unforgiving. License: AGPL-3.0 (server), GPL-3.0 (clients), some proprietary modules.
★ 20,182 GitHub stars
How the trust score is built
Full methodology →- Adoption · stars/downloads, log-scaled vs peers
- 9.0/10
- Maintenance · recency, releases, issue load
- 9.0/10
- Openness · license + docs
- 10.0/10
- Manual review · sanity read + red-flag check
- 8.0/10
- · ~20.2k GitHub stars (Sept 2026 snapshot via AlternativeTo), recent activity confirmed
- · Free tier: unlimited passwords and devices; Premium $10/yr; Families $3.33/mo; Business from $4/user/mo (2026 comparisons)
- · AES-256 with PBKDF2 or Argon2id; zero-knowledge; self-hosting supported; Secrets Manager product for developers
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.