Bitwarden 2026: Evaluating the shift from 1Password and KeePassXC

Price changes and leadership shifts

Bitwarden increased its Premium subscription from $10 to $20 per year in February 2026. Fast Company and Reddit users criticized this change because the company announced the price hike inside a blog post covering feature updates instead of through more direct communication. Management also saw a shakeup in 2026 as CEOs Michael Crandell and Stephen Morrison stepped down in February and April. Michael Sullivan and Michael Shenkman replaced them. Sullivan’s LinkedIn profile notes his experience with mergers and acquisitions, specifically involving private equity firms where transactions reached $1 billion. In May 2026, Fast Company reported that Bitwarden removed the phrase "Always free" from its marketing page. The company also replaced "inclusion" and "transparency" with "innovation" and "trust" on its hiring page. Bitwarden restored the "Always free" description after that report. If you are deciding between Bitwarden and 1Password, the price hike is the first thing you will notice.

Security audits and vulnerability findings

Marek Toth presented a vulnerability at DEF CON 33 on August 9, 2025, regarding DOM-based extension clickjacking in several password manager extensions, including Bitwarden. This flaw allowed attackers to exfiltrate user data with a single click in default configurations. Bitwarden released version 2025.8.2 on August 31, 2025, to address this issue. The company notified vendors in April 2025 before the presentation. Bitwarden also maintains compliance with HIPAA, GDPR, CCPA, SOC 2, SOC 3, and the EU-US and Swiss – US Privacy Shield frameworks. The company conducts annual third-party security audits. In 2022 and 2023, Cure53 performed penetration testing and source code audits against all software components, including the core application, browser extension, desktop application, web application, and TypeScript library. They found two high-rated issues, which Bitwarden and third-party HubSpot fixed quickly. Other issues were rated low or informational only. A 2024 study by Hutchinson et al. evaluated 14 password managers using weak, breached, and randomly generated passwords. They found that products like Bitwarden reported weak and compromised passwords inconsistently. This can give users a false sense of security.

Feature sets and the final verdict

Bitwarden uses client-side zero-knowledge encryption so the company cannot see user data. This security relies on AES-CBC 256-bit encryption and PBKDF2 SHA-256/Argon2id for key derivation. The platform hosts multiple client applications including a web interface, desktop applications for Windows, MacOS, and Linux, various browser extensions, and mobile apps, which allows users to access their encrypted vaults on any device they choose. You can sync data across unlimited platforms and devices. Bitwarden supports 50 languages and dialects. The software includes a random password generator and an autofill tool. The Password Checkup tool uses zxcvbn to assess password strength. It also detects credential breaches by querying the Have I Been Pwned? database. The browser extensions are available for Chrome, Firefox, Safari, Edge, Opera, Vivaldi, Arc, Brave, and Tor. Users can also use biometric authentication, two-factor authentication, and passwordless login via notification approval on a mobile or desktop device.

Bitwarden users manage passkeys and TOTP seeds. The tool also stores identity information, debit card numbers, and billing data. Users can share items using the "Send" feature. The free version allows for end-to-end encrypted text messages, while paid versions allow for file sharing. You can set expiration dates or access limits on sent items. The software permits imports from 1Password and Keeper. It also provides a command-line interface for scripted applications. Bitwarden also provides developer tools like Secrets Manager for managing and deploying developer secrets at scale. This tool helps DevOps and cybersecurity teams centrally store and deploy secrets throughout the development lifecycle. The company acquired the Swedish startup Passwordless.dev to provide open-source solutions for WebAuthn and FIDO2 standards. I recommend Bitwarden as the best budget pick following the Wirecutter comparison. Will the new leadership prioritize private equity interests over user transparency?