Bitwarden is an open-source password manager whose vault data is encrypted on the user's device with keys under the user's control -- the company states it cannot access vault data -- and whose clients and infrastructure undergo annual third-party security audits by firms including Cure53, IOActive, Mandiant, and ETH Zurich's Applied Cryptography Group, alongside SOC 2 Type 2, SOC 3, and ISO 27001 certification. Around the zero-knowledge vault, the company collects conventional account data: personal identifiers including IP address, billing information, IP-inferred location, and employment information, and shares personal information with service providers, affiliates and partners. Bitwarden is a private, venture-backed company that took a USD 100 million minority growth investment led by PSG in September 2022.
TIMELINE
NO ENTRIES ON FILE YET.
TOOLS WE RECOMMEND
PLUS
RECEIPTS
9 ON FILE
[2024-04-01] · COLLECTION
Bitwarden's privacy policy, last revised April 2024, states that vault data is encrypted using secure cryptographic keys under the user's control and that Bitwarden cannot access vault data; data including personal information is never sent to Bitwarden's cloud servers without first being encrypted on the local device using AES 256-bit encryption.
The source code for Bitwarden's software products is hosted publicly under the bitwarden organisation on GitHub, where clients, server, and SDKs are open to review, audit, and contribution.
As reported on 2022-09-06, Bitwarden announced a USD 100 million minority growth investment led by the growth-equity firm PSG with participation from existing investor Battery Ventures -- a disclosure that names the company's principal outside investors while its cap table and financials remain private.
Bitwarden's privacy policy states that personal information is shared with service providers for data management, database hosting, integration services, professional services, and information-security and authentication services, and that Bitwarden may also share personal information with its affiliates and partners to facilitate its global operations in accordance with applicable laws.
Bitwarden's security and compliance page lists a HackerOne bug bounty alongside its source-code and network assessments and states that independent security researchers are rewarded for submitting potential security issues, linking to hackerone.com/bitwarden. Bitwarden's own help documentation describes this as a private bug bounty program, and the HackerOne program page could not be content-verified (it serves a JavaScript-only shell), so the program's scope rules and payout table are not publicly published in a citable form.
Bitwarden's compliance documentation states that it regularly conducts comprehensive third-party security audits, listing annual assessments including Cure53 source-code audits and penetration tests (2018, 2022, 2023, 2024), IOActive client and SDK audits (2024), Mandiant mobile assessments (2024), Fracture Labs web and network assessments (2024, 2025), a Unit 42 mobile assessment (2025), and a 2025 cryptography audit by the Applied Cryptography Group at ETH Zurich, alongside SOC 2 Type 2, SOC 3, ISO 27001 and HIPAA attestations.
At the end of 2018 Bitwarden published the results of a complete white-box penetration test, source code audit, and cryptographic analysis of its application ecosystem conducted by Cure53; the testing found five vulnerabilities, of which one required immediate action, and the results were published.
In a blog post authored by Kyle Spearrin and updated January 27, 2026, Bitwarden states that it undergoes annual third-party security audits by named external firms — Cure53 and Insight Risk Consulting — covering IPs, servers, web applications, client applications and source code, with each audit featuring a penetration test and analysis of identified issues alongside the actions taken to address them; the post links published assessment reports for 2018 and 2020 through 2025, including the 2025 Web App and Network Security Assessment and the 2025 Mobile App Security Assessment.
Bitwarden's privacy policy enumerates the account-layer categories it collects around the encrypted vault: personal identifiers including name, physical address, unique personal and online identifiers, IP address and email; financial and commercial information including billing data and purchase history; location information inferred from IP address; and professional or employment information such as employer name and title.