In short
Keeper vs Bitwarden for business: Keeper sells Business Starter, Business and Enterprise, with SAML 2.0 single sign-on, SCIM and Active Directory sync on Enterprise. Bitwarden sells Teams and Enterprise with no user limit; SCIM and Directory Connector come with Teams, SSO with Enterprise, and Enterprise can also be self-hosted.
Want help weighing them up?
Tell us about your users, systems and priorities and we can compare them against your requirements.
Keeper vs Bitwarden at a glance
| Keeper | Bitwarden | |
|---|---|---|
| Made by | Keeper Security, Inc., headquartered in Chicago | Bitwarden, Inc., headquartered in Santa Barbara, California; source code published on GitHub |
| Vault encryption | AES-256 GCM, encrypted and decrypted on your device (zero knowledge) | AES-CBC with 256-bit keys and HMAC-SHA256, encrypted on your device (zero knowledge) |
| Unlocking the vault | Master password (key derived on the device with PBKDF2), biometrics, or SAML 2.0 single sign-on on Enterprise | Master password (PBKDF2 SHA-256 at 600,000 iterations by default, or Argon2id); login with SSO on Enterprise, where trusted devices can unlock without a master password |
| Business plans | Business Starter (5 to 10 seats), Business (minimum 5 seats), Enterprise; KeeperMSP for IT providers | Teams and Enterprise, both with no user limit; a tailored plan on request for large organisations |
| Single sign-on and provisioning | Enterprise: SAML 2.0 SSO, SCIM provisioning, AD and LDAP sync; Entra ID, Okta, Google Workspace and Ping | Teams and Enterprise: SCIM provisioning and Directory Connector sync (Entra ID, Google Workspace, Okta, OneLogin, Active Directory and LDAP); Enterprise: SSO over SAML 2.0 or OIDC |
| SIEM | SIEM integration add-on (requires Advanced Reporting & Alerts) | Event logs and the Public API on both plans; Bitwarden Event Logs apps for Splunk and Microsoft Sentinel |
| Breach and password monitoring | BreachWatch dark web monitoring, an add-on | Vault health reports (weak, reused and exposed passwords) for every user; Access Intelligence at-risk reporting on Enterprise |
| Business trials | Free trials of Business and Enterprise | Free 14-day trials of Teams and Enterprise |
| Certifications named | ISO 27001, 27017 and 27018; SOC 2 Type 2; FIPS 140-3 validated encryption | ISO 27001; SOC 2 Type II and SOC 3; HIPAA compliance; annual third-party audits |
Sources: Keeper Enterprise (opens in a new tab), Keeper security (opens in a new tab), Bitwarden plans (opens in a new tab), Bitwarden SSO (opens in a new tab) and Bitwarden encryption (opens in a new tab). Both providers publish more detail on their own sites; the sections below explain what the differences mean in use.
Still not sure which way to go? Ask us
Tell us what matters most to you and we can go through the trade-offs with you.
Security model
Both are zero-knowledge designs: the vault is encrypted and decrypted on the user's device, and neither company can read what is in it.
Keeper says vault data "is encrypted on the user's device locally using AES-256 GCM", and that "PBKDF2 is utilised on the local device to derive a 256-bit AES key for decryption", with 1,000,000 iterations. It lists ISO 27001, 27017 and 27018, SOC 2 Type 2 and "FIPS 140-3 validated encryption" under NIST certificate #4743 (Keeper security (opens in a new tab)).
Bitwarden says it "always encrypts and/or hashes your data on your local device before anything is sent to cloud servers", using AES-CBC with 256-bit keys and HMAC-SHA256, a scheme it calls "AES256-CBC-HMAC-SHA256" (Bitwarden (opens in a new tab)). The master key is derived with PBKDF2 SHA-256 at 600,000 iterations by default, or with Argon2id, and Bitwarden says its PBKDF2 implementation "satisfies FIPS-140 requirements so long as default values are not changed" (Bitwarden KDF (opens in a new tab)). Its code is on GitHub for anyone "to review, audit, and contribute to" (Bitwarden open source (opens in a new tab)), and it names ISO 27001, SOC 2 Type II and SOC 3 (Bitwarden compliance (opens in a new tab)).
See are password managers safe for business? for what these models protect against.
Business plans, provisioning and single sign-on
| Keeper | Bitwarden | |
|---|---|---|
| Plans and seats | Business Starter (5 to 10 seats), Business (minimum 5 seats), Enterprise; KeeperMSP for IT providers | Teams and Enterprise, both with no user limit; a tailored plan on request for large organisations |
| Sign-in and provisioning | Enterprise: SAML 2.0 SSO, SCIM provisioning, AD and LDAP sync; Entra ID, Okta, Google Workspace and Ping | Teams and Enterprise: SCIM provisioning and Directory Connector sync (Entra ID, Google Workspace, Okta, OneLogin, Active Directory and LDAP); Enterprise: SSO over SAML 2.0 or OIDC |
| Sharing | Shared team folders on Business and Enterprise; one-time sharing with people who have no Keeper account; time-limited access | Unlimited sharing through collections and user groups on both plans; Bitwarden Send for encrypted text and files to anyone |
| Policies and admin | Policy engine by user, role or team; delegated administration on Business; vault transfer when someone leaves | Admin Console, groups and organisation-wide Duo two-step login on both plans; enterprise policies, custom roles and account recovery on Enterprise |
| Reporting and SIEM | SIEM integration add-on (requires Advanced Reporting & Alerts) | Event logs and the Public API on both plans; Bitwarden Event Logs apps for Splunk and Microsoft Sentinel |
| Breach monitoring | BreachWatch dark web monitoring, an add-on | Vault health reports (weak, reused and exposed passwords) for every user; Access Intelligence at-risk reporting on Enterprise |
| Family benefit for staff | Free Family Plan for every user on Business and Enterprise, for up to 5 family members | Free Families plan for every user on Enterprise, shared with up to five family members or friends |
| Trial | Free trials of Business and Enterprise | Free 14-day trials of Teams and Enterprise |
Where directory sync sits. Keeper Enterprise lists SAML 2.0 single sign-on, SCIM provisioning and Active Directory and LDAP sync through Keeper Bridge, with identity providers such as "Entra ID (formerly Azure AD), Okta, Google Workspace, Ping, AD FS and more" (Keeper Enterprise (opens in a new tab)). Bitwarden puts provisioning on Teams: "Teams and Enterprise organizations can use SCIM" and "Teams and Enterprise organizations can use Directory Connector", which syncs from Active Directory, any LDAP directory, Entra ID, Google Workspace, Okta and OneLogin (Bitwarden Directory Connector (opens in a new tab)). Bitwarden's login with SSO is an Enterprise feature over SAML 2.0 or OIDC (Bitwarden SSO (opens in a new tab)).
Plan sizing. Keeper Business Starter is for 5 to 10 seats and Business starts at 5 seats. Bitwarden says Teams and Enterprise "can have an unlimited number of users (priced per user)" (Bitwarden plans (opens in a new tab)).
Policies. Keeper's policy engine enforces policies "by user, role or team", with delegated administration on Keeper Business. Bitwarden's enterprise policies, such as master password requirements, required two-step login, required SSO and removing vault export, are on Enterprise (Bitwarden policies (opens in a new tab)).
Weighing up the options?
We can talk through the differences that matter for your organisation.
Hosting, data regions and developer secrets
Keeper lets organisations "host their Keeper tenant in their preferred primary region", including Europe (EU) (Keeper security (opens in a new tab)). For developer and DevOps teams, Keeper sells Keeper Secrets Manager, which it describes as "a fully managed, cloud-based secrets management solution".
Bitwarden runs its cloud "with data storage in both United States and European Union regions", and an organisation "only exists in the region where it was first created" (Bitwarden regions (opens in a new tab)). Enterprise organisations can also self-host: Bitwarden "can be run, using Docker, on Linux and Windows machines", and self-hosted organisations "will be able to utilize all paid features provided by their chosen plan" (Bitwarden self-hosting (opens in a new tab)). For developers, Bitwarden Secrets Manager (opens in a new tab) is a separate end-to-end encrypted product for infrastructure and machine secrets, added to Teams or Enterprise.
Whichever you choose, pick the region before you create the organisation, because both tie your data to the region you start in.
Which suits which organisation
Match the facts to your situation:
- A team of 5 to 10 that wants a small entry plan: Keeper Business Starter is sized for 5 to 10 seats
- You want SCIM or Active Directory sync without an enterprise tier: Bitwarden includes SCIM and Directory Connector on Teams; Keeper lists them on Enterprise
- You need to host the password manager on your own servers: Bitwarden Enterprise has a self-host option
- You need FIPS 140-3 validated encryption on paper: Keeper publishes its NIST certificate number
- You want delegated administration below an enterprise tier: Keeper Business includes delegated administration
- You want the source code open to review: Bitwarden publishes its code on GitHub
- You want breach alerts across the organisation: Keeper sells BreachWatch dark web monitoring as an add-on; Bitwarden gives every business user vault health reports and adds Access Intelligence on Enterprise
Both offer free business trials: of Keeper Business and Enterprise, and 14-day trials of Bitwarden Teams and Enterprise.
Moving between Keeper and Bitwarden
Bitwarden's browser extension and desktop app can import "directly without needing to download a file" from a Keeper account, using your Keeper email and data centre location (Bitwarden (opens in a new tab)). Keeper's documentation covers imports from other password managers, browsers and CSV files (Keeper import (opens in a new tab)), and Bitwarden exports vaults as .csv or .json (Bitwarden export (opens in a new tab)).
- Set up the new organisation first, including two-step login and your policies
- Recreate shared folders or collections once, by team, rather than letting each person import their own copy
- Import, then check that shared items and attachments arrived as expected
- Delete any export file, because a plain export is not encrypted
- Close the old account once everyone has moved
Our switching guide covers each step.
Buying Keeper for your organisation
We can quote Keeper's business plans for your organisation, with the plan and terms confirmed at quote, and help you weigh Keeper against Bitwarden on the points that decide it: your identity provider, your team size, how teams share logins and where your data should be held. We can:
- Help you choose the Keeper plan that fits your identity platform (Microsoft Entra ID, Google Workspace or Okta), your team size and your reporting needs
- Set up single sign-on and user provisioning on the Keeper plans that include them, so accounts are created and removed from your directory
- Set policies and build shared folders or vaults for each team before staff are invited
- Import passwords from browsers, spreadsheets or a CSV export from another password manager
- Keep licensing in one place: licences can be billed monthly, with terms confirmed at quote
See our Keeper business page for each plan in detail, or the business password manager comparison. Contact us for free advice or a quote.
Frequently asked questions
Is Keeper or Bitwarden more secure?
Both encrypt your vault on your own device so the provider cannot read it. Keeper uses AES-256 GCM with PBKDF2 at 1,000,000 iterations and publishes ISO 27001, 27017 and 27018, SOC 2 Type 2 and a FIPS 140-3 certificate. Bitwarden uses AES-CBC 256-bit with HMAC-SHA256 and PBKDF2 at 600,000 iterations or Argon2id, publishes its source code and names ISO 27001, SOC 2 Type II and SOC 3. See are password managers safe for business?.
Which includes Active Directory sync?
Both. Keeper Enterprise syncs with Active Directory and LDAP through Keeper Bridge. Bitwarden's Directory Connector syncs from Active Directory, LDAP, Entra ID, Google Workspace, Okta and OneLogin on both Teams and Enterprise.
Can Bitwarden be self-hosted?
Yes, on Enterprise. Bitwarden runs on your own Linux or Windows servers with Docker, and a self-hosted organisation keeps all the paid features of its plan (Bitwarden (opens in a new tab)). Keeper lets organisations choose the primary region for their tenant, including Europe (EU).
Can we trial both?
Yes. Keeper offers free trials of Keeper Business and Enterprise, and Bitwarden offers 14-day free trials of Teams and Enterprise. We can help you run a pilot group.
Still deciding?
Ask us and a member of our team will get back to you.
More password manager guides
KeeperKeeper Security's business plans and add-ons, and how we can quote and set up Keeper for your business.1Password vs Bitwarden1Password and Bitwarden business plans compared on Secret Key, SSO, provisioning, hosting and admin.LastPass vs BitwardenLastPass and Bitwarden business plans compared on security model, directory integration, SSO, policies and hosting.Keeper vs 1PasswordKeeper and 1Password business plans compared on security model, seats, sharing, SSO and admin.Compare password managersKeeper, 1Password, NordPass and LastPass business plans side by side on published facts.Switching password managerHow to move passwords between password managers and off browsers or spreadsheets, safely.