At University of Toronto Press, the password problem had an unexpected shape. People were already using password managers. They had simply chosen different ones. Each person had a little island of security; the organization had an archipelago. Getting a credential from one island to another remained awkward.
- A free vault holds unlimited passwords across unlimited devices.
- Paid plans sell extra protection and control over shared access.
- Open code invites inspection. It also invites uncomfortable findings.
In Bitwarden’s account of the rollout, the publisher solved this with collections: shared credentials grouped for developers, retail support, and privileged administrators. The team also used command-line automation for onboarding and encrypted links for handoffs. It estimated saving 10 hours of IT time a week. The breakthrough was getting separate good habits to cooperate.
The case also suggests a buying discipline: test the handoff. A tool can work beautifully for one employee and still fail at the moment a second person needs access. The publisher’s reported time saving belongs to its own workflow; another organization should measure its own onboarding and sharing tasks before expecting the same result.
01 The inconvenience that became a company
Kyle Spearrin recognized a similar mismatch before launching Bitwarden in August 2016. Existing managers could be difficult to set up or unavailable on platforms he wanted. Open source alternatives existed, but choosing and assembling them required judgment. He wanted inspectable software with the convenience of a finished service.
He shared his first version on Reddit, Hacker News, and Product Hunt. The response surprised him. So did the community that followed: people who would help shape the product, beyond simply using it. Publishing the code had started as a way to earn trust.
“I chose open source in the beginning to ensure transparency,” Spearrin said in a 2022 interview. That decision made a particular bargain possible: use the hosted product for convenience, examine its workings if you have the expertise, or run the server yourself.
02 Forget the password. Keep the key.
The everyday product is straightforward. Bitwarden generates a different password for each account, stores it in an encrypted vault, and fills it into supported websites and apps. Browser extensions, desktop clients, and mobile apps put that vault where people actually work. It also stores passkeys, secure notes, cards, and identity details.
The security architecture separates storage from the ability to read what is stored. Vault contents are encrypted and decrypted on the user’s device. Bitwarden calls this zero-knowledge encryption. The cloud can synchronize encrypted information without routinely holding the keys needed to read it.
There is a consequence to that separation. Support cannot simply recover a forgotten master password. Emergency access and eligible enterprise recovery can help when configured, but recovery requires planning. Self-hosting adds another responsibility: someone has to operate and maintain the infrastructure. Control comes with chores.
03 The price of getting everyone aboard
Bitwarden’s free individual plan includes unlimited passwords on unlimited devices. That matters because a password habit confined to one computer is easily abandoned on the next screen. Charging for every additional place someone logs in would put friction precisely where the product needs continuity.
Annual billing. Prices checked October 23, 2026; taxes excluded.
Subscriptions pay for the company. Premium adds features including emergency access, an integrated authenticator, attachments, and security reports. In January 2026, Bitwarden raised Premium to $19.80 annually and Families to $47.88, while adding vault health alerts, password coaching, and more storage. The basic free offer remained.
Workplaces pay for coordination. Teams costs $4 per user per month with annual billing; Enterprise costs $6. Event logs, provisioning, policies, and single sign-on address questions an individual rarely asks: who owns this credential, who should receive it, and what happens when an employee leaves?
Each person had a little island of security; the organization had an archipelago.
The company practices a version of this distributed coordination itself. Its careers page describes a fully remote team and four values: Gratitude, Responsibility, Innovation, and Trust. Public code and community feedback give that last word a practical outlet.
Alternatives include 1Password, LastPass, Dashlane, Keeper, and Proton Pass. Browser managers handle many everyday logins, too. Bitwarden’s particular combination is a usable free tier, publicly inspectable code, and a self-hosting option. Which matters most depends on whether the buyer is protecting a household or administering a workforce.
04 A password company looks beyond passwords
In September 2022, Bitwarden announced a $100 million growth investment led by PSG, with Battery Ventures participating. Management said the money would accelerate expansion into developer secrets, passwordless technology, and authentication while preserving the free tier and self-hosting. The financing was a minority investment.
The subsequent products followed that direction. Bitwarden acquired Passwordless.dev in January 2023 to help developers add passkey authentication. Secrets Manager addresses API keys and other machine credentials. A standalone Authenticator generates verification codes. These products follow sensitive information beyond the familiar username-and-password pair.
By September 2026, the company was previewing Privileged Controls: time-limited credential access, approval rules, password rotation, and audit logs. It was a private preview, with wider availability planned. Meanwhile, its October fill-assist update described tailored rules for awkward login forms. Expansion still depends on getting the small interaction right.
05 Trust needs an open door
Inspection has teeth. In February 2026, ETH Zurich researchers reported 12 attacks against Bitwarden under a malicious-server model, where the server actively misbehaves. These were research demonstrations, not a reported customer breach. They challenged the idea that encryption alone settles every question about a cloud vault.
Bitwarden’s response grouped the original findings into ten issues: seven resolved or undergoing remediation, and three accepted as design decisions. That distinction matters. Publishing code and audits helps people examine a security claim; it does not make the claim unconditional.
The practical lesson is modest enough to copy. Make unique credentials easy to use. Give shared credentials an owner and a defined audience. Arrange recovery before anyone needs it. Bitwarden reports more than 15 million users and 80,000 businesses. Its premise remains human-sized: the secure routine has to fit an ordinary day.