From bitwarden's home page[1]: > Since all of your data is fully encrypted before it ever leaves your device, only you have access to it. Not even the team at

From bitwarden's home page[1]: > Since all of your data is fully encrypted before it ever leaves your device, only you have access to it. Not even the team at bitwarden can read your data, even if we wanted to. I wish all these password manager companies would stop telling this lie. Your passwords may be encrypted on their servers, but since they provide the clients, an attacker only needs to slip in a single commit to any of the clients' source code repositories. In less than 10 lines of code, one could decrypt every single password locally on the device and then ship the payload out to an external API. All it takes is a single disgruntled employee. Or one of these companies to be coerced by government to backdoor the clients. Or a third party attacker to social engineer their way to having write access to the source code repositories. bitwarden, like their competition, offers a web-based UI for managing your passwords. If done properly, the decryption of your stored items is performed directly in the browser with javascript - not on the server side. And yet, this web client is another target for attackers to attempt to compromise. Unlike the popular proprietary options, at least bitwarden has an open source option. This means you could audit it yourself, and compile the software for your personal use. Of course, you have to audit every update to make sure you're not pulling compromised changes. tldr; No password manager provided by a 3rd party company is ever completely safe to use. You're trusting that company to never betray you. Do they monitor their source code to the point where ever single write operation is explicitly approved by world-class security experts? Probably not. [1] https://bitwarden.com/ https://bitwarden.com/