pssmngr vs Bitwarden

Bitwarden pioneered open-source. We modernize the stack.

Bitwarden deserves credit for proving that open-source password management works. We build on that foundation with a different cryptographic profile (XChaCha20-Poly1305 + Argon2id vs Bitwarden's AES-CBC-HMAC-SHA256 with PBKDF2 or Argon2id), granular per-vault family access summaries, Arabic RTL-first design, and simpler imports. Where we focus is the proof surface: every claim — threat model, cryptographic boundary, zero-knowledge invariants, Q2 2026 internal review, continuous CI scans (Semgrep, Trivy, CodeQL, ZAP, Gitleaks), and the source files implementing each invariant — is indexed at docs/security/evidence.md and linked back to a real file you can read in our open repository. Self-hosters can verify the zero-knowledge boundary themselves with the Docker-only fresh-clone checklist in docs/self-hosting/index.en.md. Bitwarden has multiple independent Cure53 audits — that is a track record we acknowledge and do not yet match; our independent third-party audit is planned for Q4 2026 and not yet complete. If you're happy with Bitwarden, stay — it's a solid choice. If you want clearer evidence surfacing and a fresh take on password management, try pssmngr.