Password managers used to be an easy recommendation: pay Bitwarden ten dollars a year and stop worrying. That advice is out of date. On 21 January 2026 Bitwarden doubled Premium to $19.80 a year, announced inside a feature blog post rather than a pricing notice, with existing subscribers getting roughly fifteen days’ warning. The gap that made this decision obvious has narrowed sharply.
What they actually cost in 2026
| Free tier | Personal | Family | |
|---|---|---|---|
| Bitwarden | Yes — unlimited passwords, unlimited devices | $19.80/year | $47.88/year, 6 users |
| 1Password | No (14-day trial) | $3.99/month list ($2.99 first year) | $5.99/month list, 5 users |
| Proton Pass | Yes — unlimited passwords, 10 aliases | $1.99/month annual | Pass Family, 6 users |
Watch the asterisks. 1Password’s widely-quoted $2.99 is a first-year promotional rate for new customers; you renew at $3.99, and Families covers five people where the other two cover six. Proton Pass Plus at $1.99 is the annual rate, unchanged since January 2024, and is now the cheapest paid tier of the three by a clear margin.
The honest headline: Bitwarden’s free tier is still the best free password manager available, and still stores unlimited passwords on unlimited devices. What changed is the value of upgrading. At $19.80 a year against Proton’s $23.88, the “obviously cheapest paid option” argument is gone.
What happens if you die, or lose everything
This is the feature nobody compares and everybody eventually needs, and the three approach it very differently.
Bitwarden has real emergency access, on paid tiers only. You nominate trusted contacts and set a waiting period; if you do not actively reject the request before it expires, access is granted automatically. Two levels: View gives read access to your individual vault, Takeover lets the contact set a new master password and removes your 2FA. Individual vaults only, not organisation vaults.
1Password has no emergency access feature at all. It has three other things: recovery codes (individual and family accounts only, with a one-hour wait after generation and a 24-hour lockout if you have signed in recently); family or team recovery, where an organiser can reset your account immediately, with no waiting period; and the Emergency Kit, a printable PDF holding your sign-in address, Secret Key and a blank line for your password. That last one is 1Password’s official answer to “what if I am hit by a bus” — print it, put it in a safe. It is a piece of paper, not a feature.
Proton launched Emergency Access on 28 August 2025, on any paid Proton plan. Up to five contacts, waiting periods from thirty days down to none. One thing to know before enabling it: a researcher at Zolder published a finding in May 2026 that with the wait set to “none”, someone with access to your account can add themselves as an emergency contact and reach the full Pass vault without the separate Pass password, then export it. Proton reportedly considers this by design. If you turn the feature on, set a waiting period.
Proton’s wider recovery story needs a warning too: the 12-word recovery phrase is the only method that recovers encrypted data. Email and SMS recovery reset your password and leave every previously encrypted item unreadable.
Can you leave? Test it before you commit
A password manager you cannot walk away from is a trap. Check the exit before you move ten years of credentials in.
- Bitwarden exports to plaintext JSON, CSV, encrypted JSON, or a ZIP with attachments. Only the ZIP carries attachments, and only for individual vaults. TOTP secrets do export. CSV silently drops cards, identities, passkeys and SSH keys — use JSON. Nothing exports Trash or Sends. One trap: the account-restricted encrypted export only re-imports into that exact account, and becomes permanently unreadable if you rotate your encryption key. Use the password-protected variant.
- 1Password exports to .1pux or CSV. The .1pux format is genuinely thorough — documents, attachments, password history, archived items, custom fields. CSV drops security questions, linked items and custom fields. Passkeys cannot be exported from desktop at all, only from iOS 26+ or Android 14+. And you cannot export at all with “Unlock with SSO” enabled.
- Proton Pass exports to a PGP-encrypted ZIP, an unencrypted ZIP, or CSV — but not from the mobile apps. Proton’s documentation does not state whether attachments, TOTP secrets or aliases are included, and we are not going to guess. Run a test export before you rely on it.
Passkeys, and the change that made them portable
All three store passkeys, but the platform limits differ enough to matter. Bitwarden creates and uses them in the browser extension and on iOS 17+ and Android 14+ — but the web vault and desktop app can only view and manage passkeys, not create or authenticate with them, and on Android a stored passkey cannot serve as passkey-based 2FA. 1Password handles them in the extension and both mobile apps. Proton supports them in the extension and on Android 14+ and iOS 17+, with Firefox on iPhone and iPad unsupported — and includes passkeys on its free plan.
The genuinely important 2026 development is the Credential Exchange Protocol, now live on iOS 26 and Android 14+. Bitwarden developed it alongside Apple, Google, Microsoft and 1Password, and it means passkeys can finally move between managers. Before this, adopting passkeys inside one manager was a one-way door. It no longer is.
Who has actually been audited
“Independently audited” appears on every marketing page. The difference is whether you can read the report.
Bitwarden is far ahead here, and every report is a public PDF. In 2025 alone: six separate Cure53 engagements, a cryptographic analysis by ETH Zurich’s Applied Cryptography Group conducted under a malicious-server assumption, Unit 42 on the mobile apps, and Fracture Labs on the web app. Cure53 has audited Bitwarden annually since 2018. It also holds SOC 2 Type 2, ISO 27001 and annually-audited HIPAA compliance.
1Password began publishing annual penetration-test reports through its Trust Center in November 2025 — a real improvement, because before that the most recent public assessment dated from 2020. It is ISO 27001, 27017, 27018 and 27701 certified. Its SOC 2 Type 2 report exists but is request-only.
Proton Pass was audited by Cure53 in 2023 and by Recurity Labs between January and April 2026. That second report is the most recent audit of any of the three: it covered the extensions, mobile apps, desktop apps and CLI, rated the codebase “well above par”, and found no remote exploits and no encryption bypasses. Both reports are public.
What each one is uniquely good at
Proton Pass has the best built-in email aliasing, and it is not close. Powered by SimpleLogin, you get up to ten hide-my-email aliases free and unlimited on Pass Plus, with custom domains and the ability to send from an alias on paid. Bitwarden has no first-party alias service — its generator calls out to SimpleLogin, Addy.io, Firefox Relay, Fastmail, Forward Email or DuckDuckGo, each needing its own API key and often its own subscription. 1Password supports Fastmail Masked Email only.
Bitwarden is the only one you can realistically self-host. The standard Linux deployment wants Docker 26+, 2GB of RAM minimum and 4GB recommended, and ships MSSQL Express. But the lighter option — renamed from “Bitwarden Unified” to Bitwarden lite in December 2025 — is a single container that runs in 200MB of RAM on ARM, meaning a Raspberry Pi or a NAS, and supports PostgreSQL, SQLite and MySQL as well as MSSQL. Bitwarden is explicit that lite is for home labs rather than businesses, and that database maintenance becomes your job.
1Password buys polish, which is a real argument rather than a soft one: a manager you actually use beats a cheaper one you abandon. If a clunky interface has made you give up before, the extra $2 a month is defensible.
What we would pick
- Most people: Bitwarden free. Unlimited passwords, unlimited devices, the most audited codebase of the three. Nothing about the price rise changes this.
- If you want emergency access on a budget: Proton Pass Plus at $1.99/month. Now cheaper than Bitwarden Premium, and the aliasing is better.
- If you will self-host: Bitwarden. Bitwarden lite on a Pi is the only genuinely practical option here.
- If interface quality is what stopped you before, or you are rolling this out to non-technical family: 1Password — but budget $3.99, not the promo price.
The wrong answer is still none of them. Any of these three is a large security improvement over reusing passwords, and the differences between them are small next to that.
Prices verified against vendor pricing pages in September 2026. This category has changed pricing repeatedly in the last eighteen months — check before you subscribe.
Leave a Reply