Evaluating 1Password and Bitwarden from vendor technical documentation reveals distinct differences in key derivation, cryptographic schemes, and publicly listed subscription tiers. While both document zero-knowledge protections where vault data is encrypted prior to transmission, their technical architectures and publicly documented plan models differ.
Overview: Documented Differences at a Glance
| Feature / Dimension | 1Password | Bitwarden |
|---|---|---|
| Core Security Model | Dual-key derivation: Account password combined with a 128-bit Secret Key | Zero-knowledge encryption using AES-CBC 256-bit with HMAC-SHA-256 (AES256-CBC-HMAC-SHA256) |
| Asymmetric Sharing Protocol | Not detailed in the supplied excerpts | RSA cryptosystem with Optimal Asymmetric Encryption Padding (OAEP) for organizations and emergency access |
| Self-Hosting Support | Self-hosting options are not documented in the supplied pricing excerpt | Documented self-host server deployment option compatible with all Bitwarden end-clients |
| Public Pricing Page Disclosures | Documented quote-based business and enterprise tiers (Unified Access, Enterprise Password Manager) and AWS Marketplace purchasing | Documented Free tier, Premium ($1.65/mo billed annually at $19.80), and Families ($3.99/mo billed annually at $47.88) |
Security Architecture: Documented Cryptographic Models
Each service implements zero-knowledge encryption using specific key structures and protocols outlined in their technical specifications.
1Password Secret Key Architecture
According to the 1Password Secret Key documentation, 1Password pairs the user’s account password with a locally generated 34-character string known as the Secret Key. This Secret Key contains 128 bits of entropy and is generated directly on the client device during account setup. It is stored on authorized devices and in the user’s Emergency Kit, and it is never transmitted to 1Password servers.
To encrypt stored data, 1Password combines the user’s memorized account password (estimated at roughly 40 bits of entropy) with the 128-bit Secret Key to derive the full encryption key. This dual-key structure ensures that an attacker attempting an offline brute-force attack against encrypted server data cannot guess the key without the 128-bit Secret Key. A user entering a new device must supply both the account password and the Secret Key to authenticate and decrypt data.
Bitwarden Encryption Protocols
According to Bitwarden’s encryption protocols documentation, Bitwarden encrypts and hashes data locally on the user’s device before sending anything to cloud servers for storage. Bitwarden employs Advanced Encryption Standard in cipher block-chaining mode with 256-bit keys (AES-CBC 256-bit), generated using a CSPRNG or derived via a KDF from a strong master password.
To verify data integrity and authenticity, Bitwarden pairs AES with a Hash-based Message Authentication Code using SHA-256 (HMAC-SHA-256), forming an AES256-CBC-HMAC-SHA256 implementation. For sharing mechanisms such as organizations and emergency access, Bitwarden implements public-key asymmetric cryptography using the RSA cryptosystem with the Optimal Asymmetric Encryption Padding (OAEP) scheme.
Pricing and Plan Disclosures
The supplied vendor pricing documentation outlines different tiers and purchasing structures.
Bitwarden Personal and Business Plans
Bitwarden’s published pricing page documents personal, family, and business options:
- Free Account: Provides basic password management across unlimited devices and passwords on browser, desktop, and mobile applications, including Bitwarden Send (text and files) and sharing with one other user via a free organization.
- Premium ($1.65/month, billed annually at $19.80): Adds an integrated TOTP authenticator, 5 GB encrypted file attachments, emergency access designation, vault health reports, self-hosting options, priority support, and two-step login supporting up to 10 hardware security keys.
- Families ($3.99/month, billed annually at $47.88): Includes up to 6 premium accounts with unlimited sharing and collections, plus 5 GB of shared family storage alongside individual storage.
- Business Plans: Includes Teams ($4/user/month billed annually) and Enterprise ($6/user/month billed annually), which adds flexibility to self-host and enterprise policies.
1Password Public Pricing Disclosures
The supplied 1Password pricing page documents business-focused platform solutions rather than consumer tiers. Listed offerings include Unified Access, Enterprise Password Manager, SaaS Manager, Privileged Access, and Device Trust. Pricing for these offerings is provided via custom quote requests or through procurement via AWS Marketplace.
Research Methodology and Limitations
This comparison was compiled strictly from the supplied public source excerpts retrieved from 1Password and Bitwarden documentation. It does not reflect hands-on testing, benchmarks, or unverified platform claims. Material limits include the absence of 1Password consumer subscription tiers on the retrieved pricing page, the absence of 1Password self-hosting or asymmetric sharing documentation in the supplied excerpts, and the lack of competing third-party review coverage.
Text version of the diagrams
- Two Documented Security Models: 1Password — Password plus Secret Key; Bitwarden — AES-CBC plus HMAC; Sharing — RSA-OAEP documented
- Plans And Deployment Choices: Bitwarden — Free to paid personal plans; Business — Teams and Enterprise pricing; 1Password — Quote-based platform products
