Security · Encryption · Audits

Is Bitwarden safe? A technical look

Three things matter when picking a password manager: the cipher choices, the key derivation, and whether the company has ever been breached. Here are Bitwarden's answers, with sources.

Encryption code matrix on screen — Bitwarden uses AES-256-CBC with PBKDF2-SHA256 600K iterations or Argon2id for master key derivation

TL;DR

AES-256-CBC for vault items. PBKDF2-SHA256 (2023+: Argon2id available) for master key derivation, default 600,000 iterations. Zero-knowledge — server sees only ciphertext. Two external audits by Cure53 (2018, 2020). HackerOne bug bounty active. Never breached as of 2026-04. Source code on GitHub.

Encryption details

Vault items

Vault data (passwords, notes, attachments, identity records) is encrypted with AES-256-CBC. The encryption key is derived client-side from your master password and never sent to Bitwarden's servers.

Master key derivation

Two algorithms supported, configurable per account:

PBKDF2-SHA256 (default) — 600,000 iterations as of 2023. Older accounts pre-2023 default to 100,000; recommended to upgrade in account settings.
Argon2id (introduced 2023) — memory-hard, more resistant to GPU/ASIC attacks. Default parameters: 3 iterations, 64 MB memory, parallelism 4. Configurable per-account.

The output is a stretched master key, used with AES-256 to wrap a separate per-account symmetric key (account.key). Vault items are encrypted with that symmetric key, not directly with the master-derived key. This separation means changing your master password doesn't require re-encrypting every vault item.

Zero-knowledge

Critical: Bitwarden's servers never see your master password or the derived keys. The server stores only:

Encrypted ciphertext of your vault items
Hash of your master-key-derived authentication value (a separate hash, not the encryption key)
Your account metadata (email, KDF parameters, organisation membership)

If Bitwarden's database is exfiltrated tomorrow, an attacker gets ciphertext that requires brute-forcing your master password to decrypt — and with 600,000 PBKDF2 iterations, that's prohibitively slow even for state-level adversaries unless your master password is weak.

External audits

Bitwarden has commissioned multiple third-party audits, with reports published publicly:

Cure53 (2018): source code review of clients and server. Findings were minor; no critical issues.
Cure53 (2020): follow-up audit covering changes since 2018. Same outcome — no critical findings.
Insight Risk Consulting (annual SOC 2 Type II): ongoing operational audit, primary for enterprise compliance.
Penetration tests: Bitwarden runs internal pen tests roughly annually and publishes summaries.

Audit reports are linked from bitwarden.com/help/is-bitwarden-audited.

Breach history

None as of 2026-04.

The closest event was a 2024 phishing campaign that targeted Bitwarden users via Google Ads — attackers bought ads against "bitwarden" search and directed clicks to a phishing landing page with a fake login form. This wasn't a Bitwarden breach (no infrastructure compromise) but a third-party impersonation. Bitwarden coordinated takedowns and warned users.

Compare to LastPass:

2015 phishing attack — partial disclosure of email addresses, password hints, server salts.
2019 vulnerability — extension bug allowed credential extraction by malicious sites.
2022 breach — attacker stole encrypted vault backups from cloud storage. The backup format included unencrypted URL fields, weakening the dataset for targeted attack.

The 2022 LastPass event is what drove the wave of migrations to Bitwarden. We have a dedicated comparison covering the technical differences and migration steps.

Open source

All Bitwarden code — client apps for every platform, the CLI, the server — is published on GitHub:

github.com/bitwarden/clients — desktop, browser, mobile, CLI
github.com/bitwarden/server — server backend

Licence is Bitwarden's own source-available licence (the GitHub copy specifies AGPL-3.0 for some components, custom for others). For self-hosting, the licence permits non-commercial use plus commercial use up to a seat count threshold. Full licence text.

Bug bounty

Bitwarden runs a public bug bounty on HackerOne. As of 2026, payouts range $50 (low severity) to $5,000+ (critical RCE / pre-auth key disclosure). Scope includes the cloud servers, official clients, and the unified self-host image. Vaultwarden is out of scope (separate codebase).

Two-factor authentication

Bitwarden supports multiple second-factor methods on the master account:

TOTP (Google Authenticator, Authy, etc.) — free tier
Email codes — free tier
FIDO2 / WebAuthn (YubiKey, security key) — Premium ($10/year) on personal; included in Family/Enterprise
Duo — Premium / Enterprise

For high-value accounts, FIDO2 is the gold standard — no shared secret, phishing-resistant, no SMS interception risk.

Supply chain considerations

The desktop apps are built and signed by Bitwarden's CI from the public repo. Signed binaries land on GitHub Releases. The signing certificates:

Windows: "Bitwarden Inc." Windows Authenticode signature, valid in SmartScreen.
macOS: "Developer ID Application: 8bit Solutions LLC" (Bitwarden's legal entity), notarised by Apple.
Linux: repository signing keys per package format (.deb signed with apt key, .rpm signed with rpm key, AppImage signed with appimagetool).

Reproducible builds: not yet implemented across all client variants. The desktop build pipeline is open enough that a determined verifier could rebuild from source and check binary equality, though this isn't part of the official QA flow.

What we don't do

We're an independent download portal — we redirect to the official Bitwarden release artifacts on GitHub or the platform stores. We never modify the installer, never inject ads or analytics into the binary, and never host a custom build. The signing chain stays Bitwarden-end-to-end. More about us.

Bitwarden security — frequently asked questions

Has Bitwarden ever been breached?

No public breach has been disclosed as of 2026-04. The closest event was a 2024 third-party phishing campaign that impersonated Bitwarden via Google Ads — Bitwarden's own infrastructure was not compromised. Compare to LastPass which had three significant security events between 2015 and 2022.

What encryption does Bitwarden use?

AES-256-CBC for vault items. PBKDF2-SHA256 (or Argon2id) for master key derivation. Zero-knowledge — server holds only ciphertext.

How many PBKDF2 iterations?

600,000 default for new accounts (since 2023). Older accounts default to 100,000; you can upgrade in Account Settings → Security. Industry consensus 2026 is 600,000+ for PBKDF2-SHA256, or switch to Argon2id which is memory-hard.

Should I use Argon2id instead of PBKDF2?

Argon2id is the modern recommendation — it's memory-hard (resists GPU/ASIC brute-force more effectively than PBKDF2). Both are secure with reasonable parameters. PBKDF2 is more battery-friendly on mobile; Argon2 is more attacker-resistant. Bitwarden lets you pick per-account.

Is Bitwarden audited?

Yes — Cure53 in 2018 and 2020, plus annual SOC 2 Type II. Audit reports linked from bitwarden.com/help/is-bitwarden-audited.

Is Bitwarden actually open source?

Yes — clients, CLI, and server are all published on GitHub. Licence is Bitwarden's source-available licence (similar to AGPL with non-compete restrictions for hosted-service competitors). Self-hosting is permitted; selling Bitwarden-as-a-service is not.

Can Bitwarden see my passwords?

No. Vault items are encrypted client-side with a key derived from your master password. Bitwarden's servers store ciphertext only. Bitwarden employees, infrastructure providers, and any future attackers see encrypted blobs they'd need to brute-force. Master password is never transmitted, never stored, never recoverable.

What happens if I forget my master password?

Account is unrecoverable. This is the trade-off of zero-knowledge — Bitwarden cannot reset your master password because they never had it. Mitigations: Premium tier offers Emergency Access (designate a contact who can request recovery after a delay) and recovery codes (printed string that lets you log in once).

Is the master password stored anywhere?

No. The master password is used only to derive the encryption key, on your device, in memory, briefly. The key is then stored in memory while the vault is unlocked, and discarded when locked. Nothing is written to disk in plaintext.

Should I trust the unified self-host image versus building from source?

The pre-built unified image is what 99% of self-hosters use. If you want maximum verification, you can build from github.com/bitwarden/server yourself — full source available, Dockerfile published. The convenience trade-off is real: building takes 30+ minutes, the pre-built image is the same source.