🩺 Vitals
- 🟢 Last active: 2026-08-05
- 📦 Latest release: v2026.7.2 (2026-08-05)
- 🐞 Open issues: 244
- 🌟 Stars: 19.7k
What do these metrics mean?
- Last active: when code was last pushed, as of our last check. The dot is green when that was recent, grey otherwise. A long gap can mean a tool is finished and stable, not only unmaintained.
- Latest release: the most recent tagged, packaged version the maintainers published. Not every healthy project tags releases.
- Open issues: unresolved reports and requests. A high number is normal for a popular project and is not a warning on its own.
- Stars: how many people bookmarked the project on its forge. A rough popularity signal, not a measure of quality.
🏗️ Profile
- Official: bitwarden.com
- Source: github.com/bitwarden/server
- License: AGPL-3.0
- Deployment: Docker | SaaS
- Data Model: MSSQL / PostgreSQL
- Jurisdiction: United States 🇺🇸 (Bitwarden, Inc.)
- Compliance (SaaS): SOC 2 Type II | ISO 27001 | HIPAA | GDPR
- Compliance (Self-Hosted): HIPAA Eligible | GDPR Ready | CRA Ready
- Complexity: Moderate (3/5) - Enterprise Container Stack
- Maintenance: Moderate (3/5) - Regular Security Patches
- Enterprise Ready: Very High (5/5) - SSO & Directory Sync
1. The Executive Summary
What is it? Bitwarden is the leading open-source password management platform for businesses and individuals. It secures passwords, passkeys, and sensitive data in an end-to-end encrypted vault. Unlike proprietary solutions, its codebase is fully auditable, ensuring no "backdoors" exist and providing total transparency for security teams.
The Strategic Verdict:
- 🔴 For "Set and Forget": Caution. Self-hosting the official server requires active maintenance and security monitoring. Consider the SaaS plan if you lack dedicated Ops resources.
- 🟢 For Digital Sovereignty: Strong Buy. Full control over your cryptographic keys and data location. It is the gold standard for organizations with strict compliance and auditing requirements.
2. The "Hidden" Costs (TCO Analysis)
| Cost Component | 1Password / LastPass (Proprietary) | Bitwarden (Self-Hosted) |
|---|---|---|
| License Fee | ~$8/user/mo | $0 (AGPLv3) |
| Infrastructure | $0 (Cloud Hosted) | ~$20/mo (VPS) |
| Compliance | Dependent on Vendor Cloud | 100% Owned & Auditable |
3. The "Day 2" Reality Check
🚀 Deployment & Operations
- Installation: The official self-hosted instance is deployed via a unified Docker container setup (Identity, Api, Admin).
- Vaultwarden: Note that many home-lab users run "Vaultwarden" (a lightweight Rust rewrite), but for Enterprise use, the Official Server is recommended for support and feature parity.
🛡️ Security & Governance (Risk Assessment)
- Jurisdiction & The CLOUD Act: Bitwarden, Inc. is a US-based entity. While their SaaS environment holds rigorous certifications (SOC 2 Type II, ISO 27001), data hosted on their cloud is theoretically subject to US jurisdiction (e.g., the CLOUD Act). For absolute EU/GDPR data sovereignty, self-hosting is mandatory. If EU jurisdiction at the vendor layer is the requirement, an EU-domiciled peer such as Passbolt reaches that position without self-hosting.
- The Compliance Shift: Choosing to self-host provides cryptographic autonomy, but it immediately shifts the Shared Responsibility Model. The software is HIPAA and GDPR capable, but your infrastructure team becomes solely responsible for the underlying network security, access logs, and audit trails required to pass an enterprise audit.
- The AGPLv3 License Trap: The official server is licensed under AGPL-3.0. Deploying this for internal corporate IT (employee password vaults) is entirely safe and highly recommended. However, if you intend to modify the codebase to embed a white-labeled password manager into your own customer-facing SaaS product, you will trigger the AGPL network clause and risk forced open-sourcing of your proprietary stack.
4. Market Landscape
🏢 Proprietary Incumbents
- 1Password
- LastPass
🤝 Open Source Ecosystem
- Vaultwarden: A lightweight, community-driven implementation of the Bitwarden API, ideal for resource-constrained environments.
- KeePassXC: The offline counterpart. Where Bitwarden syncs the shared organisational vault, KeePassXC holds break-glass and air-gapped credentials in a local file that never reaches a server.