Bitwarden vs Proton Pass: privacy compared
Bitwarden and Proton Pass are both rated in password managers against the same 12 public criteria. Bitwarden does better on open source, security headers and local or self-hosted option. Proton Pass does better on no trackers or telemetry, transparency report and tells users about requests. Bitwarden is based in the United States (Five Eyes); Proton Pass is based in Switzerland.
| Criterion | Bitwarden Our pick | Proton Pass |
|---|---|---|
| Grade | Grade C C (73/100) | Grade B B (80/100) |
| Jurisdiction | United States Five Eyes | Switzerland Outside Eyes |
| Open source Is all the source code needed to run the product public? | Yes source | Partial source |
| No trackers or telemetry Are the website and apps free of third-party trackers, with any analytics anonymous and any telemetry off by default? | No source | Partial source |
| No ads or data sales Is the product funded without advertising, ad targeting or selling user data? | Yes source | Yes source |
| Independent audit Has an independent security or privacy audit been published within the last three years? | Yes source | Yes source |
| Transparency report Does the provider regularly publish how many government and legal requests it receives and how it responds? | No | Yes source |
| Tells users about requests Does the provider promise to tell users about requests for their data, unless a court forbids it? | No | Yes source |
| TLS configuration Does the website pass the Qualys SSL Labs test with a grade of A or better? | Yes source | Yes source |
| Security headers Does the website pass the Mozilla HTTP Observatory test with a grade of A or better? | Yes source | Partial source |
| Modern web standards Does the website score 90% or higher on the Internet.nl website test? | Not tested yet | Not tested yet |
| End-to-end encrypted vault Is the vault encrypted on the device before it is synced, with a key the provider does not hold? | Yes source | Yes source |
| Local or self-hosted option Can the vault be kept locally or on your own server? | Yes source | Partial source |
| Full export Can every item be exported in an open format? | Yes source | Yes source |
Summaries
Bitwarden. Bitwarden scores 73 out of 100 (grade C) on the password managers criteria. It meets 8 of 11 criteria: open source, no ads or data sales, independent audit, TLS configuration, security headers, end-to-end encrypted vault, local or self-hosted option and full export. It does not meet no trackers or telemetry, transparency report and tells users about requests. It is based in the United States: Five Eyes member; subject to the US CLOUD Act. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade A+.
Proton Pass. Proton Pass scores 80 out of 100 (grade B) on the password managers criteria. It meets 7 of 11 criteria: no ads or data sales, independent audit, transparency report, tells users about requests, TLS configuration, end-to-end encrypted vault and full export. It partly meets open source, no trackers or telemetry, security headers and local or self-hosted option. It is based in Switzerland: Not in the Five, Nine or Fourteen Eyes; GDPR-style data protection law. Automated tests: SSL Labs grade A+ and Mozilla HTTP Observatory grade B+.