Bitwarden: when to install it, and when not to
The highest-return install on this site. It works across every platform here, the free tier is genuinely usable, the source is public and it has been…
The short version
Bitwarden: If you install one thing from this entire page, install this. The free tier covers unlimited passwords on unlimited devices with sync, and everything is end-to-end encrypted. Start here rather than with a paid competitor.
| Licence / price | Free + paid tiers |
|---|---|
| Platforms | Windows, macOS, Linux, Android, iOS |
| Category | Privacy & Security — 10 programs |
| Official download | https://bitwarden.com/download/ ↗ |
What it is for
The highest-return install on this site. It works across every platform here, the free tier is genuinely usable, the source is public and it has been externally audited.
When to pick something else
If you want no service involved at all, KeePassXC keeps the vault purely local, at the cost of you owning synchronisation and backups yourself.
What independent reviewers found
We do not run lab tests or benchmarks. These summaries are written in our own words, with the publisher named and the original linked. Our citation policy explains what we will and will not reproduce.
Cure53 — 2018
What the source says. Cure53's 2018 white-box review recorded eleven findings across the clients and cryptographic design. Three were initially rated critical; one was withdrawn after discussion with the maintainers and two remained, alongside praise for the code's readability.
What we take from it. An audit is a list of problems found and fixed, not a badge. We would rather see the report than the phrase 'independently audited'.
Pentest Report: Bitwarden Password Manager 11.2018 ↗ (Cure53 · 2018 · Source code audit and penetration test)
Bitwarden — Ongoing
What the source says. The publisher maintains a dated index of third-party assessments from 2018 onward, with links to the underlying reports.
What we take from it. The dates matter more than the count. A habit that continued over several years tells you more than a single clean report ever could.
Compliance, Audits and Certifications ↗ (Bitwarden · Ongoing · Publisher's audit index)
How it compares in Privacy & Security
These are the alternatives we would consider for the same job. The notes are the same ones used on the main list, so there is no separate ranking hiding on this page.
| Program | Licence / price | Platforms | Why it is on the list |
|---|---|---|---|
| KeePassXC Publisher's site ↗ | Free · Open source | Windows, macOS, Linux | A password database that is just an encrypted file on your own disk. No company, no account, no server to breach. You are responsible for your own backups, which is the trade you are making. |
| VeraCrypt Publisher's site ↗ | Free · Open source | Windows, macOS, Linux | Creates encrypted containers and can encrypt a whole drive, including hidden volumes. The successor to TrueCrypt. Keep the password and the rescue disk somewhere you will still find them in two years. |
Practical notes
- Set up two-factor authentication on the vault itself before you start filling it.
- Export an encrypted copy once and store it somewhere outside the vault; that is your recovery path.
Questions people ask
What if I forget the master password?
There is no reset. An emergency access contact or a stored encrypted export is the only recovery route, so decide that before you need it.
Where it appears in our guides
- Setting up a new Windows PC: the order that actually works
- Before and after a clean reinstall: the checklist
- A privacy-first setup that does not break your computer
- Do you need a third-party antivirus on Windows 11?
- Moving off browser-saved passwords in one sitting
See the full Privacy & Security explainer for the other 9 programs in this category.
How to read this page. How to read this page. Platform, licence and publisher details come from our directory data. Where an independent review, audit or survey is mentioned, it is summarised in our own words with the source named and linked; our /sources page sets out that policy. The recommendation, the trade-offs and every 'skip it if' line are our editorial judgement. We do not run benchmarks, publish measured performance figures or host installers, and every download link goes to the publisher's own site. If a detail is out of date, our About page explains how to tell us.