In short
1Password vs Bitwarden for business: 1Password adds a 128-bit Secret Key to every account and includes Unlock with SSO (OpenID Connect) and SCIM on 1Password Business. Bitwarden publishes its code, includes SCIM and Directory Connector on Teams, puts SAML 2.0 or OIDC single sign-on on Enterprise, and lets Enterprise self-host.
Want help weighing them up?
Tell us about your users, systems and priorities and we can compare them against your requirements.
1Password vs Bitwarden at a glance
| 1Password | Bitwarden | |
|---|---|---|
| Made by | AgileBits Inc. | Bitwarden, Inc., headquartered in Santa Barbara, California; source code published on GitHub |
| Vault encryption | AES 256-bit end-to-end encryption, with Secure Remote Password sign-in | AES-CBC with 256-bit keys and HMAC-SHA256, encrypted on your device (zero knowledge) |
| Unlocking the vault | Account password plus a 128-bit Secret Key (Two-Key Derivation); Unlock with SSO on 1Password Business | Master password (PBKDF2 SHA-256 at 600,000 iterations by default, or Argon2id); login with SSO on Enterprise, where trusted devices can unlock without a master password |
| Business plans | Teams Starter Pack (10 users minimum, up to 20), 1Password Business (1 user minimum), Enterprise Password Manager (quote only) | Teams and Enterprise, both with no user limit; a tailored plan on request for large organisations |
| Single sign-on and provisioning | 1Password Business: Unlock with SSO over OpenID Connect; SCIM provisioning with Entra ID, Google Workspace, Okta, OneLogin and JumpCloud | Teams and Enterprise: SCIM provisioning and Directory Connector sync (Entra ID, Google Workspace, Okta, OneLogin, Active Directory and LDAP); Enterprise: SSO over SAML 2.0 or OIDC |
| SIEM | Event streaming to SIEM tools including Splunk, Microsoft Sentinel, Elastic and Sumo Logic | Event logs and the Public API on both plans; Bitwarden Event Logs apps for Splunk and Microsoft Sentinel |
| Breach and password monitoring | Watchtower alerts for breaches and weak, reused or expiring passwords | Vault health reports (weak, reused and exposed passwords) for every user; Access Intelligence at-risk reporting on Enterprise |
| Business trials | 14-day free trial, no credit card | Free 14-day trials of Teams and Enterprise |
| Certifications named | SOC 2 Type 2; ISO 27001, 27017, 27018 and 27701 | ISO 27001; SOC 2 Type II and SOC 3; HIPAA compliance; annual third-party audits |
Sources: 1Password security (opens in a new tab), 1Password Unlock with SSO (opens in a new tab), 1Password provisioning (opens in a new tab), Bitwarden plans (opens in a new tab), Bitwarden SSO (opens in a new tab) and Bitwarden encryption (opens in a new tab). The sections below explain what the differences mean in use.
Still not sure which way to go? Ask us
Tell us what matters most to you and we can go through the trade-offs with you.
Security model: Secret Key or open source
Both encrypt the vault on the user's own device, and neither provider holds the key to read it. They take different routes to protecting that key.
1Password adds a second secret. The Secret Key is "34 letters and numbers, separated by dashes", is stored on the devices you have signed in on and in your Emergency Kit, and has "128 bits of entropy"; 1Password says "We have no record of your Secret Key and can't recover it" (1Password (opens in a new tab)). In its words, the account password "protects your data on your devices", and the Secret Key "protects your data off your devices". It holds SOC 2 Type 2 and ISO 27001, 27017, 27018 and 27701.
Bitwarden derives the key from the master password on the device, with PBKDF2 SHA-256 at 600,000 iterations by default or Argon2id (Bitwarden KDF (opens in a new tab)), and encrypts with "AES256-CBC-HMAC-SHA256" (Bitwarden encryption (opens in a new tab)). Its source code is on GitHub for anyone "to review, audit, and contribute to" (Bitwarden open source (opens in a new tab)), and it publishes annual third-party assessments, including 2025 audits by Cure53 and Fracture Labs (Bitwarden audits (opens in a new tab)). It names ISO 27001, SOC 2 Type II and SOC 3.
For staff, the practical difference is that 1Password users keep an Emergency Kit with their Secret Key, while Bitwarden users rely on a strong master password, or on Enterprise can sign in through SSO. See are password managers safe for business?.
Business plans, provisioning and single sign-on
| 1Password | Bitwarden | |
|---|---|---|
| Plans and seats | Teams Starter Pack (10 users minimum, up to 20), 1Password Business (1 user minimum), Enterprise Password Manager (quote only) | Teams and Enterprise, both with no user limit; a tailored plan on request for large organisations |
| Sign-in and provisioning | 1Password Business: Unlock with SSO over OpenID Connect; SCIM provisioning with Entra ID, Google Workspace, Okta, OneLogin and JumpCloud | Teams and Enterprise: SCIM provisioning and Directory Connector sync (Entra ID, Google Workspace, Okta, OneLogin, Active Directory and LDAP); Enterprise: SSO over SAML 2.0 or OIDC |
| Sharing | Shared vaults with role-based permissions, guest accounts, and sharing items with anyone, even without 1Password | Unlimited sharing through collections and user groups on both plans; Bitwarden Send for encrypted text and files to anyone |
| Policies and admin | Custom policies, recovery of team members' accounts, Travel Mode controls and custom business reports | Admin Console, groups and organisation-wide Duo two-step login on both plans; enterprise policies, custom roles and account recovery on Enterprise |
| Reporting and SIEM | Event streaming to SIEM tools including Splunk, Microsoft Sentinel, Elastic and Sumo Logic | Event logs and the Public API on both plans; Bitwarden Event Logs apps for Splunk and Microsoft Sentinel |
| Breach monitoring | Watchtower alerts for breaches and weak, reused or expiring passwords | Vault health reports (weak, reused and exposed passwords) for every user; Access Intelligence at-risk reporting on Enterprise |
| Family benefit for staff | Free 1Password Families membership for every 1Password Business user | Free Families plan for every user on Enterprise, shared with up to five family members or friends |
| Trial | 14-day free trial, no credit card | Free 14-day trials of Teams and Enterprise |
Single sign-on. 1Password Business offers Unlock with SSO, which "is only available using the OpenID Connect (OIDC) protocol", with one identity provider per account (1Password (opens in a new tab)). Bitwarden's login with SSO is on Enterprise, with "SAML 2.0 and OIDC configuration options" and just-in-time provisioning (Bitwarden SSO (opens in a new tab)). With SSO and trusted devices, Bitwarden members can decrypt the vault "using a device-stored encryption key, eliminating the need to enter a master password" (Bitwarden (opens in a new tab)); organisations that want to hold the keys themselves can use Key Connector on a self-hosted server (Bitwarden Key Connector (opens in a new tab)).
Provisioning. 1Password provisioning creates users and groups and suspends users from Google Workspace, JumpCloud, Microsoft Entra ID, Okta or OneLogin (1Password provisioning (opens in a new tab)). Bitwarden offers SCIM on Teams and Enterprise, with guides for JumpCloud, Entra ID, Okta, OneLogin and Ping Identity (Bitwarden SCIM (opens in a new tab)), and Directory Connector, which also syncs from Active Directory, LDAP and Google Workspace (Bitwarden Directory Connector (opens in a new tab)).
Plan sizing. 1Password's Teams Starter Pack starts at 10 users and goes up to 20, and 1Password Business has a one-user minimum; Enterprise Password Manager is sold on quote. Bitwarden Teams and Enterprise "can have an unlimited number of users (priced per user)" (Bitwarden plans (opens in a new tab)).
Weighing up the options?
We can talk through the differences that matter for your organisation.
Hosting, reporting and developer secrets
Where your data lives. 1Password accounts are created on 1Password.com (United States), 1Password.ca (Canada) or 1Password.eu (European Union) (1Password regions (opens in a new tab)). Bitwarden's cloud stores data "in both United States and European Union regions" (Bitwarden regions (opens in a new tab)), and Bitwarden Enterprise can be self-hosted on your own Linux or Windows servers with Docker (Bitwarden self-hosting (opens in a new tab)).
SIEM and audit. 1Password streams events to SIEM tools including Splunk, Microsoft Sentinel, Elastic and Sumo Logic (1Password (opens in a new tab)). Bitwarden's event logs, on Teams and Enterprise, record "over 60 event types", are "retained indefinitely" and export as CSV or through the Public API (Bitwarden event logs (opens in a new tab)); Bitwarden publishes Event Logs apps for Splunk (opens in a new tab) and Microsoft Sentinel (opens in a new tab).
Developer secrets. 1Password describes its Enterprise Password Manager as a "Secrets manager for humans, machines, and AI agents". Bitwarden sells Secrets Manager (opens in a new tab) as a separate end-to-end encrypted product for infrastructure secrets, with machine accounts and CI/CD integrations, and Passwordless.dev (opens in a new tab) for adding passkey sign-in to your own applications.
Which suits which organisation
Match the facts to your situation:
- You want SSO without an enterprise tier: 1Password Business includes Unlock with SSO and provisioning; Bitwarden puts SSO on Enterprise
- Your identity provider only offers SAML: Bitwarden Enterprise supports SAML 2.0 and OIDC; 1Password's Unlock with SSO uses OpenID Connect
- You sync users from Active Directory or LDAP on premises: Bitwarden's Directory Connector syncs from both, on Teams
- You need to self-host: Bitwarden Enterprise has a self-host option
- You want a second secret on every account: 1Password adds the Secret Key automatically
- You travel with sensitive vaults: 1Password's Travel Mode removes vaults from devices except those marked safe for travel
- Your data must sit in Canada: 1Password offers 1Password.ca alongside its US and EU regions
Both offer business trials: 14-day trials of 1Password's Teams Starter Pack and Business, and 14-day trials of Bitwarden Teams and Enterprise.
Moving between 1Password and Bitwarden
Both import from the other. Bitwarden can import "directly without needing to download a file" from a 1Password account in its browser extension or desktop app (Bitwarden (opens in a new tab)). 1Password lists Bitwarden among the apps it imports from (1Password import (opens in a new tab)), and Bitwarden exports vaults as .csv or .json; organisation items are exported by admins and owners (Bitwarden export (opens in a new tab)).
Plan the move by team: recreate vaults or collections once, import, check that shared items arrived, then delete any export file, because a plain export is not encrypted. Our switching guide covers each step.
Buying 1Password for your organisation
We can quote 1Password's business plans for your organisation, with the plan and terms confirmed at quote, and help you weigh 1Password against Bitwarden on the points that decide it: your identity provider, your team size, how teams share logins and where your data should be held. We can:
- Help you choose the 1Password plan that fits your identity platform (Microsoft Entra ID, Google Workspace or Okta), your team size and your reporting needs
- Set up single sign-on and user provisioning on the 1Password plans that include them, so accounts are created and removed from your directory
- Set policies and build shared folders or vaults for each team before staff are invited
- Import passwords from browsers, spreadsheets or a CSV export from another password manager
- Keep licensing in one place: licences can be billed monthly, with terms confirmed at quote
See our 1Password business page for each plan in detail, or the business password manager comparison. Contact us for free advice or a quote.
Frequently asked questions
Is 1Password or Bitwarden more secure?
Both encrypt your vault on your own device so the provider cannot read it. 1Password combines your account password with a 128-bit Secret Key and holds SOC 2 Type 2 and ISO 27001, 27017, 27018 and 27701. Bitwarden derives the key from your master password with PBKDF2 or Argon2id, publishes its source code and annual audits, and names ISO 27001, SOC 2 Type II and SOC 3. See are password managers safe for business?.
Which plan includes single sign-on?
1Password includes Unlock with SSO, over OpenID Connect, on 1Password Business. Bitwarden includes login with SSO, over SAML 2.0 or OIDC, on Enterprise.
Do both work with Microsoft Entra ID?
Yes. 1Password Business unlocks with SSO through Entra ID and provisions users from it. Bitwarden provisions from Entra ID with SCIM or Directory Connector on Teams and Enterprise, and supports Entra ID SSO over SAML or OIDC on Enterprise.
Where can each one hold our data?
1Password accounts are created on 1Password.com (United States), 1Password.ca (Canada) or 1Password.eu (European Union). Bitwarden's cloud stores data in United States or European Union regions, and Bitwarden Enterprise can also be self-hosted on your own servers with Docker (Bitwarden (opens in a new tab)).
Can we move from Bitwarden to 1Password, or the other way?
Yes. 1Password imports from Bitwarden, and Bitwarden can import straight from a 1Password account. We can help plan the move team by team.
Still deciding?
Ask us and a member of our team will get back to you.
More password manager guides
1Password1Password's business plans, Secret Key security model and wider Unified Access range, and how we can quote and set up 1Password.Keeper vs BitwardenKeeper and Bitwarden business plans compared on security model, provisioning, SSO, hosting and admin.NordPass vs BitwardenNordPass and Bitwarden business plans compared on encryption, SSO, provisioning, breach monitoring and hosting.Keeper vs 1PasswordKeeper and 1Password business plans compared on security model, seats, sharing, SSO and admin.Compare password managersKeeper, 1Password, NordPass and LastPass business plans side by side on published facts.Switching password managerHow to move passwords between password managers and off browsers or spreadsheets, safely.