Bitwarden

Is Bitwarden safe?

Yes. Bitwarden encrypts your passwords on your own device before anything reaches its servers, the apps are open source, and outside firms audit the code every year. No vault breach has been reported. We score it 88/100.

Two 2026 events keep it below a perfect security score. Researchers in Zurich showed that someone who took over Bitwarden's servers could, in several ways, get at passwords. And in April a malicious copy of its command-line tool was published on npm, the JavaScript package registry. Neither touched the phone and browser apps most people use.

How Bitwarden protects your vault

Bitwarden's security whitepaper describes a standard but solid design. Your master password is stretched with PBKDF2 (600,000 rounds by default) or Argon2id, and the result unlocks a key that encrypts each item with AES-256. Bitwarden never receives the master password, so it cannot read your vault and cannot reset it for you.

Around that sits the usual checklist for a security company: SOC 2 Type II and ISO 27001 certification, annual source code reviews and penetration tests by outside firms, and a bug bounty on HackerOne. You can also run your own Bitwarden server.

Apple's privacy label is short. Bitwarden links your email address and a device ID to you for running the app, and collects your name and crash data without linking them. Nothing is used for tracking. The website uses Google Analytics, which the app does not.

What did the 2026 ETH Zurich study find?

In February 2026, cryptographers from ETH Zurich and Università della Svizzera italiana published a paper testing whether four "zero knowledge" password managers stay safe if their own server turns hostile. They found 12 attacks against Bitwarden, more than against LastPass (7), Dashlane (6) or 1Password (6). According to The Register, seven of the Bitwarden attacks could reveal passwords. One worked through the invitation flow for shared organisations.

The threat model matters. These attacks need control of Bitwarden's servers, or of a self-hosted one, and none has been seen in use. Bitwarden was told in advance, thanked the researchers and said it "has never been breached". The paper says fixes are under way. For a product whose whole promise is that the server cannot learn your secrets, this is still a real finding.

The April 2026 npm incident

On 22 April 2026, between 5:57 pm and 7:30 pm Eastern time, a malicious @bitwarden/cli version 2026.4.0 was available on npm. Security firm Socket said the attack appears to have used a compromised GitHub Action in Bitwarden's build pipeline, part of a wider supply-chain campaign. The code stole developer secrets such as GitHub, cloud and SSH keys from machines that installed it. Bitwarden said there was no evidence that vault data or production systems were reached, and the version was pulled. It matters mainly to developers who install the CLI through npm. Mobile, desktop and browser extension users were not affected, according to Bitwarden.

Is Bitwarden still open source?

Mostly, yes. In October 2024 users noticed that a new internal software kit pulled into the desktop app carried a licence that banned use outside Bitwarden. Bitwarden called it a packaging bug, reorganised the build so the apps compile from GPL-licensed code only, and by November had moved the kit to the GPLv3. Its separate business products still use their own licence.

How to set up Bitwarden safely

1. Use a long master password you have never used anywhere else, ideally a passphrase of five or more random words. Bitwarden cannot recover it.
2. Turn on two-step login with an authenticator app or a security key, and store the recovery code offline.
3. If you created your account years ago, check the encryption settings and raise the KDF to the current defaults or Argon2id.
4. Let autofill do the checking. If Bitwarden does not offer to fill a login page, look hard at the address before typing anything.
5. Keep a password-protected encrypted export somewhere offline, not a plain CSV.

How we scored it

Bitwarden scores highest on privacy (90), control (90) and regulatory record (96), with no fines found. Security (82) is its weakest factor, held back by the 2026 Zurich study and the npm incident rather than by any vault breach. It sits above Proton Mail (85) mainly because a password manager carries little scam or harmful-content risk of its own.