Security and privacy decision
Bitwarden
A technically competent developer can build a useful, self-hosted personal or small-team password sync with end-to-end encryption, but reproducing Bitwarden's cross-platform clients, enterprise integrations, security audits, and product polish at scale is not realistic for one person.
Visit website↗Open-source builds that already do this
Every project below is open source and already does this job today. Fork one, self-host it, or take the parts you need — the build prompt further down assumes an empty file, and this is the shortcut past that. Licences differ; check the one on each card before you ship.
Code Bitwarden publishes itself
Not a way out of the subscription — these are the vendor’s own repositories. Worth a look for how they build, and for anything you would have to integrate with.
- bitwarden/server★19,764 GitHub starslicence unclearBitwarden infrastructure/backend (API, database, Docker, etc).↗
- bitwarden/clients★13,532 GitHub starslicence unclearBitwarden client apps (web, browser extension, desktop, and cli).↗
- bitwarden/android★9,176 GitHub starsGPL-3.0Bitwarden mobile apps (Password Manager and Authenticator) for Android.↗
What a replacement has to do
- Store end-to-end encrypted vault items, authenticate users (master password + optional 2FA), sync encrypted vaults via a server API, retrieve and autofill credentials in browser UI, and share items within an organization.
What it still won’t have
- Cross-platform, production-grade browser extensions and mobile apps
- Enterprise integrations (SSO, SCIM, directory connectors) and Access Intelligence
- Decades of product polish, audits, and large customer support organization
- Official security audits, bug bounty program, and certified compliance
- Built-in authenticator, passkey sync, and federated account recovery flows
What remains hard
- Brand trust
Trusted by 80,000+ organizations worldwide
- Execution quality
For eleven straight quarters, Bitwarden placed #1 in the Enterprise User Satisfaction category of the G2 Enterprise Grid Report , which ranks the best password managers for businesses.
First-year cost
Keep paying
Paying is—cheaper in year one.
On cash alone, building overtakes the subscription at 36 seats.
Money you would actually spend
Time you would spend
—
What you would spend
What we assumed
The verdict above measures whether you could build it. This one is only about money.
Runnable build prompt
Build a minimal self-hosted password manager using Node.js (Express) + Postgres + S3-compatible object storage and a React web UI plus a Chrome extension. In scope: user registration with master-password-derived key (Argon2), client-side end-to-end encryption of vault items, REST sync API that stores only encrypted blobs, web UI to create/view/search items, a Chrome extension to autofill credentials, and a simple org-sharing flow that encrypts items to recipient public keys. Out of scope: mobile apps, enterprise SSO/SCIM, advanced Access Intelligence. Include error handling, unit/integration tests, and deployment scripts (Docker + docker-compose) with instructions for TLS and backups.
How we checked
How the score was reached
- Partly verdict base52
- An open-source build was found+5
- 5 cited sources+3
- Price verified on pricing page+3
- 3/3 assessment runs agreed+4
- Evidence score67
The base comes from the verdict. Everything under it is a check that either happened or did not, and each one is a fact frozen in this record rather than a judgement made at render time — so the same evidence always produces the same number.
How scoring works →Cited sources · 5
Every page the run actually retrieved.
- official productBitwarden (homepage)
- official pricingBitwarden Pricing (business)
- official docsBitwarden Tools and Features
- open sourcepassbolt/passbolt_api
- open sourcekeeweb/keeweb
Integrity checks
What held up, and what did not.
