Bitwarden Review: Is It Still the Default Pick?

Bitwarden is the password manager most security people recommend by default, and the reasons are easy to check: open-source clients and server, an annual third-party assessment, a vault encrypted on your device before it reaches anyone, and a free tier that has never been crippled to sell the paid one. None of that has changed.

What changed in the last three years is everything around it. A default that improved in 2023 did not reach existing vaults until 2026. A build pipeline was compromised. The price doubled. Those are the parts worth a review.

Companion reading: the password manager roundup ranks Bitwarden against seven rivals. This page is the verdict on Bitwarden alone.

The verdict, up front

Rating: 4.5 / 5. Use Bitwarden if you want a vault whose code you or anyone else can read, whose encryption you can verify, and whose free tier is enough for one person. Pay the USD 19.80 only if you want your TOTP codes in the same vault as your passwords. Look elsewhere if you refuse to keep a vault on someone else's server, in which case KeePassXC is the honest answer, or if you want a second locally-held factor built into the key derivation, which is 1Password's Secret Key.

Two things stop it being a 5. Bitwarden left three years between raising the KDF default and raising the floor under the accounts that already existed. And in April 2026 its release pipeline shipped malware to npm.

What you are actually buying

The vault is encrypted on your device. Your master password goes through a key derivation function to produce the encryption key, and the server receives ciphertext plus a separately-derived authentication hash. Bitwarden cannot read your entries, and a full server compromise yields encrypted blobs whose difficulty depends entirely on your master password and your KDF settings.

Since release 2023.2.0 in February 2023, new accounts derive that key with PBKDF2-SHA256 at 600,000 iterations, matching the OWASP recommendation published the previous month. Argon2id is available on the same screen: 32 MiB of memory, 6 iterations, 4 threads by default, read in August 2026. Argon2id is memory-hard, which is what defeats the GPU and ASIC farms that make PBKDF2 cracking cheap at scale. It is not the default, because PBKDF2 is the safer compatibility choice across every client Bitwarden ships.

If you want the mechanism rather than the summary, password hashing compared covers why memory-hardness matters, and how passwords get cracked covers what the attacker on the other side of a stolen vault is actually doing.

What it costs. Free covers unlimited passwords across unlimited devices, passkey storage, and two-step login with an authenticator app, email, or a FIDO2 hardware key. Premium is USD 19.80 a year as of August 2026 and adds integrated TOTP, file attachments, emergency access, vault health reports, and YubiKey OTP and Duo as extra two-step methods. Families is USD 47.88 a year for six accounts. Teams and Enterprise are USD 4 and USD 6 per user per month on annual billing.

The free tier is the most generous in the category and it is not a trial. That has been true for a decade and it is the single strongest argument for the product.

The uncomfortable part

The KDF default took three years to reach old vaults

February 2023: the default for new accounts went from 100,000 PBKDF2 iterations to 600,000. Accounts that already existed kept the count they were created with. The oldest were made when the default was as low as 5,000.

That is the LastPass shape. When attackers exfiltrated LastPass vaults in 2022, the vaults that fell were the ones stuck on legacy iteration counts, because their owners had no idea a number they never chose had been silently left behind. Bitwarden shipped the same structural gap, minus the breach: a user who joined in 2019, did nothing wrong, and never opened Settings, Security, Keys was sitting on a weaker vault than a user who joined in 2024.

It closed on 4 March 2026. Release 2026.2.1 raised the minimum to 600,000, prompts any account below it, and applies the increase automatically the next time you unlock or log in with your master password. That is the right fix. It arrived three years and one month after the default changed, and for the whole of that window the recommendation "Bitwarden defaults to 600,000 iterations" was true of new accounts and false of a large number of real ones.

Check yours now. Web vault, Settings, Security, Keys. If the number is 600,000 or you are on Argon2id, you are current.

A compromised GitHub Action put malware on npm

On 22 April 2026, between 5:57pm and 7:30pm US Eastern, npm served a malicious build of @bitwarden/cli version 2026.4.0. Attackers had compromised a GitHub Action inside Bitwarden's CI/CD pipeline, part of a wider campaign that also hit Checkmarx, and injected a payload during the package build.

The payload harvested npm tokens, GitHub tokens, SSH keys and AWS, Azure and Google Cloud credentials, exfiltrated them by creating public repositories under the victims' own accounts, and carried code to propagate into other packages. Bitwarden revoked access, deprecated the release, and reported no evidence that end-user vault data, production data or production systems were affected.

Two honest readings sit side by side. Vault security held: this was the distribution channel for a developer tool, and nobody using the browser extension, mobile app or desktop app was ever in the blast radius. And the pipeline that signs and ships the software you trust with every password you own was compromised for an hour and a half. If you installed that version, treat the machine's credentials as burned and rotate them. Everyone else can read it as the category's real threat model now: supply-chain compromise is where mature software gets hit, and code signing is the control that is supposed to catch it.

Autofill in iframes was known for four years before it was fixed

In early 2023 Flashpoint published research showing Bitwarden's browser extension would autofill credentials into an embedded iframe served from a different domain, so a page that embedded a hostile frame could collect a login. Bitwarden had received the report in 2018 and accepted the behaviour, because legitimate sites put login forms in iframes.

The fix restricted autofill on page load to trusted domains and added a warning for manual fills into untrusted frames. Autofill on page load is off by default, which is why the practical exposure was narrower than the coverage suggested. The disclosure timeline is still the point: a known credential-exposure path stayed open for four years because closing it would break some sites.

The price doubled, in a post about features

On 21 January 2026, Premium went from USD 9.99 a year to USD 19.80 and Families from USD 40 to USD 47.88. It was the first increase in ten years and it is still defensible against every rival on this list.

The announcement led with vault health alerts, password coaching, five times the attachment storage and a phishing blocker, and the price sat further down. Renewal notices quote USD 1.65 a month rather than the annual figure that actually leaves your account, and existing subscribers get 15 days' warning before renewal. Bitwarden built its reputation on being the one that does not do this.

It is a US company with institutional capital

Bitwarden Inc. is private, based in Santa Barbara, California, and took a USD 100 million growth investment led by PSG in September 2022, with Battery Ventures participating. PSG holds a minority position and board seats.

That does not weaken the cryptography, which is why the zero-knowledge design matters: US jurisdiction cannot compel plaintext a company does not hold. What it does mean is that a generous free tier is a business decision that gets revisited, and January 2026 was the first sign of the revisiting. The exit is unusually easy here, which is the mitigation: export your vault, or run Vaultwarden yourself.

The 2024 licence scare, which resolved

In October 2024 a new sdk-internal dependency appeared in the clients under a licence saying you could not use the SDK to build applications for anything other than Bitwarden, which for a GPL project is a contradiction. Bitwarden called it a packaging problem and, by November 2024, moved the client SDK to unmodified GPL3 while the Secrets Manager SDK kept the proprietary licence under a renamed repository. The clients are buildable from OSI-licensed code again. It is in this list because it took public pressure to get there.

How it compares

1Password's Secret Key is the one architectural feature Bitwarden lacks: a 34-character value held only on your devices and mixed into key derivation, so a stolen server-side vault cannot be attacked with the master password alone. Bitwarden's answer is that you can raise your own KDF or self-host. Both are defensible; 1Password's protects users who chose a weak master password, and Bitwarden's requires you to act.

Who should use it

Most people, on the free tier. Unlimited passwords, unlimited devices, passkeys, and a hardware key for two-step login costs nothing. Set a diceware passphrase as your master password, register a security key, and stop.

Anyone who wants to verify rather than trust. Both the clients and the server are open source, the audits are published, and you can build the thing yourself. Nothing else in the mainstream offers all three.

People who will actually self-host. Vaultwarden on a machine you own removes the vendor from your threat model entirely, and replaces it with your own backup discipline. If that sentence sounds like a chore rather than a weekend, stay on the hosted service.

Not for you if you want a second locally-held factor baked into key derivation (1Password), or you want no server in the picture at all (KeePassXC), or your household is already paying for Proton, in which case Proton Pass is included and good enough that a second subscription is hard to justify.

Verdict

4.5 / 5. Bitwarden remains the password manager to beat, and the reason is unchanged: you can read the code, the audits are real, the free tier is not a trap, and no customer vault has ever been breached. Set a strong master password, check that your KDF reads 600,000 or Argon2id, register a hardware key, and the residual risk is small.

The half point comes off for the three-year gap between a good default and the vaults that needed it, and for a build pipeline that shipped credential-stealing malware to npm in April 2026. Both are the same category of failure, which is worth naming plainly: the cryptography is finished work, and the operational path between the code and your device is where password managers get compromised now.

For the ranked comparison, read the password manager roundup. For the setup that makes any of this worthwhile, read the password manager guide and two-factor authentication.