Is Bitwarden Safe? Permissions, Privacy and Ownership Checked

Is Bitwarden safe to use in 2026?

Bitwarden is safe for most people, including for banking and email logins, provided you pick a strong master password and turn on two-step login. The design means a stolen copy of Bitwarden's database would still be unreadable without your master password.

Three things put it ahead of most rivals on trust. The client and server code is published on GitHub, so anyone can inspect it. Bitwarden commissions third-party security audits and publishes the results. And you can host the whole service yourself if you would rather not rely on Bitwarden's cloud at all.

The realistic risks sit on your side of the screen: a weak or reused master password, a phishing page that copies the Bitwarden login, malware on your computer, or a browser full of extensions you no longer need. This guide walks through each of those, plus the extension's permissions and the company behind it. For our general rules on judging add-ons, see how to tell if a Chrome extension is safe.

How does Bitwarden protect your vault?

Bitwarden uses end-to-end, zero-knowledge encryption: your master password is turned into an encryption key on your device, and only encrypted data ever leaves it. Bitwarden never receives your master password, which is also why it cannot reset it for you.

Vault items are encrypted with AES-256. The step that turns your master password into a key is called the key derivation function (KDF), and Bitwarden lets you choose between PBKDF2 and Argon2id. Both are deliberately slow, which makes guessing attacks against a stolen vault expensive. Argon2id is the stronger option against attackers using graphics cards.

Zero-knowledge

The server stores your vault but has no key to open it. Staff, hosting providers and anyone who steals the database see only ciphertext.

Master password

The one secret that unlocks everything. It is never sent to Bitwarden in usable form, so a forgotten master password means a lost vault unless you set up emergency access or account recovery in an organisation.

KDF iterations

How much work it takes to test one password guess. Higher settings slow down attackers but also slow unlocking on older phones.

Two-step login

A second factor at sign-in: an authenticator app, email code, or a hardware security key. It protects the account, not the encryption itself.

The technical details are laid out in the Bitwarden security white paper. The short version: the strength of your vault equals the strength of your master password multiplied by the KDF cost. A long passphrase of four or more random words does more for your safety than any other single choice.

What permissions does the Bitwarden Chrome extension ask for?

The Bitwarden extension asks to read and change data on all websites, because it has to spot login forms anywhere and fill them. That sounds alarming, but it is the same access every autofilling password manager needs, including 1Password.

The list below explains the permissions a Bitwarden install typically shows and why each exists. Exact wording can change between versions, so check your own copy at chrome://extensions > Bitwarden > Details > Site access and Permissions. Our Chrome permissions glossary covers each warning in more depth.

What makes broad site access acceptable here is who holds it and whether you can see what they do with it. Bitwarden's extension code is public, it follows Manifest V3, and the vault it caches locally stays encrypted until you unlock it. If you want Bitwarden to fill only when asked, restrict it in Site access to On click, at the cost of the save-login prompts appearing less reliably.

Has Bitwarden ever been hacked?

No. Bitwarden has not disclosed any breach of its servers or of customer vaults as of September 2026. There have been reported weaknesses and phishing campaigns, which is different from attackers getting into stored data.

The notable episodes are worth knowing because they show where the real risks lie:

• Autofill in embedded frames (2023): researchers showed that with the optional 'autofill on page load' setting switched on, credentials could be filled into an iframe from a different domain on a page. Bitwarden changed how the extension handles cross-domain frames. Auto-fill on page load has always been off by default.
• Malicious search ads (2023): fake ads led to phishing copies of the Bitwarden web vault that tried to capture master passwords. Nothing at Bitwarden was compromised; users who typed the address or used a bookmark were unaffected.
• Researcher-reported bugs: issues such as a flaw in how the desktop app stored a key used for Windows Hello unlock were reported through Bitwarden's public bug bounty and patched.

Compare that with LastPass, where attackers took encrypted vault backups in 2022. That incident is the main reason many people now search for a safer option; our Bitwarden vs LastPass comparison covers the practical differences if you are switching.

Who owns Bitwarden, and what was the controversy?

Bitwarden is made by Bitwarden, Inc., a US company based in Santa Barbara, California, founded by developer Kyle Spearrin. It has taken outside funding, with PSG and Battery Ventures among its investors, but it remains an independent company rather than part of a larger software group.

The best-known controversy came in late 2024, when a new internal SDK dependency in the Bitwarden clients carried a licence that was not compatible with the GPL. Open-source users worried the clients were drifting away from being free software. Bitwarden said the change was a packaging problem, adjusted the licensing so the clients could still be built under the GPL, and stated that its core clients would remain open source.

The episode did not affect security, but it is a fair reminder that investor-backed companies can change terms. Two safeguards limit the impact. Your data exports in plain JSON or CSV, so leaving is easy. And there is an unofficial compatible server, Vaultwarden, that the community maintains for self-hosters.

Does NASA use Bitwarden?

We could not find a public, verifiable statement from NASA or Bitwarden confirming it. Claims like this circulate on forums, but they are not a reason to trust a password manager either way. Audits, open code and your own settings are better evidence.

What data does Bitwarden collect about you?

Bitwarden stores your email address, account and billing details, and your encrypted vault. It cannot see the websites, usernames or passwords inside the vault, because vault items, including their names and URLs, are encrypted before upload.

Some metadata is unavoidable for any sync service: when you log in, from which device type and IP address, and how large your vault is. Bitwarden's Security FAQs describe what it can and cannot access. You can also choose where your data lives: Bitwarden runs a US cloud and a separate EU cloud, and you pick the region when you create the account.

• Maximum control: self-host the official Bitwarden server on your own hardware. You take on patching, backups and uptime.
• Data residency: create the account on the EU cloud if your organisation needs data kept in Europe. Moving between regions means exporting and re-importing.
• Minimal footprint: the free plan works with just an email address and master password; no phone number is required.

Compared with the built-in Chrome password manager, the key privacy difference is independence from your Google account. If that account is compromised or locked, Bitwarden is unaffected, and Bitwarden has no advertising business drawing on your data.

How do you make Bitwarden safer? Seven settings to change

The defaults are reasonable, but ten minutes in the settings closes the most common gaps. Do these in order; the first two matter most.

1. Use a passphrase master password. Four to six random words, never used anywhere else. Change it in the web vault under Settings > Security > Master password.
2. Turn on two-step login. In the web vault go to Settings > Security > Two-step login. An authenticator app is free; a hardware security key (FIDO2) is the strongest option. Save the recovery code offline.
3. Switch the KDF to Argon2id. Settings > Security > Keys, as covered above.
4. Set a vault timeout. In the extension open Settings > Account security > Vault timeout and choose a short interval, with Lock rather than Log out if you want PIN or biometric unlock.
5. Leave auto-fill on page load off. Use Ctrl+Shift+L (Cmd+Shift+L on Mac) or the inline menu to fill instead, so nothing fills without your action.
6. Disable Chrome's built-in manager. Go to chrome://password-manager/settings and turn off Offer to save passwords so two managers do not both hold your logins.
7. Check URI match detection. Keep the default Base domain for most sites; use Host for logins that must not fill on sibling subdomains.

Premium users also get vault health reports that flag reused, weak and exposed passwords. Free users can still run Bitwarden's data breach report from the web vault's Reports section.

Is Bitwarden safer than 1Password, LastPass or Chrome?

Bitwarden and 1Password are both strong choices with different trade-offs; LastPass carries more history, and Chrome's own manager is convenient but tied to your Google account. The table compares them on safety factors rather than features.

1Password's Secret Key means a stolen vault is useless even with a weak master password, which is a real advantage for people who will not use a long passphrase. Bitwarden's advantage is transparency and cost. Our Bitwarden vs 1Password comparison goes deeper, and the password manager hub lists every option we track.

Which extensions pair well with Bitwarden?

A password manager is only as safe as the browser around it. Fewer extensions with broad access is the goal, so add companions only where they close a specific gap: two-factor codes, malicious redirects that lead to phishing pages, and leftover browsing data on shared computers.

For more reviews in this series, see is uBlock Origin safe and is NordVPN safe, or browse the security and privacy category. Our scoring approach is explained on the methodology page.