VaultKeepR vs Bitwarden
Compare Bitwarden and VaultKeepR by encryption, storage, access, and export format. The notes below distinguish supported settings and account models.
Swipe or scroll sideways to see all columns. With a keyboard, focus the table and use the left and right arrow keys.
| Comparison | VaultKeepR | Bitwarden |
|---|---|---|
| Encryption and key derivation | XChaCha20-Poly1305 + Argon2id | AES-256 + PBKDF2 / Argon2id (account setting) |
| Storage location | Local encrypted vault / IPFS sync | Encrypted cloud vault (Azure) / self-hosted |
| Access & Auth | Password + Secret Key / compatible passkey | Email + Master Password |
| Open-source license | Yes | Yes |
| Public implementation for review | Public SDK; not an external security audit | Yes |
| Pricing | Free local vault and IPFS sync; Premium extras | Free (Premium: $19.80 / year, billed annually) |
Why users choose Bitwarden
- • Open-source clients
- • Self-hosting available
- • Free plan with unlimited passwords and devices
What to check with Bitwarden
- • Hosted service used by default
- • Self-hosting needs server administration
- • Premium for the integrated authenticator and emergency access
Encryption and key derivation
Bitwarden supports both PBKDF2-SHA256 and Argon2id for password-based key derivation. The account's selected KDF and its parameters matter. It is not accurate to describe every Bitwarden vault as PBKDF2-only or to present Argon2id as exclusive to VaultKeepR.
VaultKeepR encrypts vault contents with XChaCha20-Poly1305 and uses Argon2id for password-based key derivation. Argon2id raises the cost of offline guessing, but protection still depends on the unlocking secret, KDF parameters, and device security.
Vault copies and remote availability
Bitwarden's hosted service uses Microsoft Azure for encrypted vault storage. Official self-hosting is also available. Choosing self-hosting changes who runs the service and maintains its backups; it does not mean the hosted provider normally reads your passwords.
VaultKeepR keeps an encrypted local vault and syncs an encrypted vault blob through IPFS. Shamir recovery fragments are separate from that blob. Remote access depends on gateways, continued pinning, and the configured storage services, including S3 backup. Keep a local copy or export that you can unlock.
Account and unlocking methods
Bitwarden uses an email-based account with a master password in its password-based model. Other login and unlock options depend on the client and configuration. Check the methods and recovery settings actually enabled on your account.
VaultKeepR does not require an email-based vault account. Unlock methods depend on the app and compatible hardware. Removing email registration does not prevent phishing, compromised-device access, or metadata linkage.
Bitwarden hosting and Vaultwarden
Bitwarden's official hosted service and Vaultwarden are different products. Vaultwarden is an independent Rust implementation of the Bitwarden Client API for self-hosting. Its operator manages updates, HTTPS, backups, and availability. VaultKeepR uses local encryption and IPFS sync, but remote access still depends on storage services and gateways.
Recovery and independent backups
The local vault and IPFS sync are free. Shamir 3-of-5 fragmented recovery is part of Premium. Set it up before losing access; recovery requires the necessary fragments and recovery information.
If you lose the unlocking secrets without a usable recovery setup or another accessible vault copy, you can lose access to the vault. An email reset cannot recreate a lost encryption key. Test recovery and keep independent backups before relying on them.
Sources and scope
Facts checked on . Features depend on the client, format, KDF settings, and account model. Pricing can change by region, billing period, and promotion. USD prices are not converted to EUR here.
- KDF algorithms
- Security and hosting FAQ
- Vault export formats
- Premium annual billing in USD
- Vaultwarden project
VaultKeepR references: Architecture, threat model, recovery, pricing.
Frequently asked questions
How can I transfer my passwords from Bitwarden?
Open and unlock your Bitwarden vault. Export the vault as unencrypted JSON (.json), not an encrypted Bitwarden export. Import the unencrypted JSON file in VaultKeepR and check the transferred items. Attachments and some item types may need separate handling. An unencrypted export exposes your secrets. Use a trusted device, verify the transferred entries, and delete the unencrypted export after verification.
Can I access my passwords offline?
You can read a local vault without an internet connection once it is available on that device and you can unlock it. Syncing or downloading a remote copy requires network access. A new device needs a vault copy and a supported unlocking method.
Is VaultKeepR really free?
The local vault and IPFS sync are free. Shamir 3-of-5 fragmented recovery is part of Premium. Set it up before losing access; recovery requires the necessary fragments and recovery information.
Does VaultKeepR work with passkeys and biometrics?
VaultKeepR supports WebAuthn passkey unlocking through PRF on compatible browsers and authenticators. Biometric unlocking and autofill depend on the app, device, and OS support. Check your setup before relying on a passkey as your only way back into the vault.
Where is my data actually stored?
VaultKeepR keeps an encrypted local vault and syncs an encrypted vault blob through IPFS. Shamir recovery fragments are separate from that blob. Remote access depends on gateways, continued pinning, and the configured storage services, including S3 backup. Keep a local copy or export that you can unlock.
Switching managers is also a good time to close the accounts you no longer use. Our guides cover how to delete accounts on 15 major services.
Try a local-first vault
Use the transfer method for Bitwarden above, then verify the imported entries. Keep a backup and your unlocking material available.