CITT

    Scan results

    Bitwarden Password Manager

    Android

    Recognized as best password manager by PCMag, WIRED, The Verge, CNET, G2. Secure your digital life with end-to-end encrypted password vault. Generate and save unique passwords, use passkeys, and manage accounts across unlimited devices with no ads or data selling.

    CITT SCORE
    92
    out of 100
    TRUSTED

    Quick Verdict

    Best for: Managing passwords across all your devices

    What It Means For You

    Passwords and vault data are encrypted on the device before syncing. If the app crashes, diagnostic information is sent to the developer via Firebase Crashlytics. Push notifications for vault updates arrive through Firebase Cloud Messaging. No advertising or behavioral tracking services are present.

    Method and Limitations

    Static analysis only. CITT reviewed the code of this build without running the app, so runtime behavior was not observed. The findings below describe the analyzed build and may not reflect server-side controls or later versions. CITT makes no determination about compliance with any law or platform policy; it reports what the artifacts contain and cites the published guidance so a reader can compare.

    How CITT scores an app

    Findings (17)

    Data Security

    5 total
    2 Low
    3 Info

    Network Security

    5 total
    1 Medium
    4 Info

    Code Security

    6 total
    2 Low
    4 Info

    Privacy

    1 total
    1 Info

    Third-Party Services

    Firebase Crashlytics, Firebase Cloud Messaging, Firebase Sessions, Firebase Installations, OkHttp3, Retrofit2, AndroidX Room, AndroidX WorkManager, Glide, ZXing, Google Tink, JNA (Java Native Access), Google Play Core, Timber, AndroidX Security, AndroidX Camera

    Security Strengths

    • ✓All auth tokens and cryptographic keys stored in hardware-backed EncryptedSharedPreferences
    • ✓Vault data encrypted end-to-end by Bitwarden Rust SDK before SQLite storage
    • ✓HTTPS enforced globally with user CA certificates excluded from Bitwarden domain trust
    • ✓Android Auto Backup fully disabled across all storage domains
    • ✓Auth flows use Chrome Custom Tabs — zero WebView usage eliminates JavaScript bridge attack surface
    What changed since the last scan

    Version diff is on the Developer plan. See developer plans.

    Context Tags

    sensitive data
    financial
    credentials
    password manager
    encryption
    security tool

    Package

    com.x8bit.bitwarden

    Version

    2025.12.1 (versionCode: 21060; metadata shows 2026.1.1 release branch)

    Analysis Date

    Feb 17, 2026

    Classes Analyzed

    14,385

    Was this analysis helpful?

    Feedback helps us improve our analysis

    View on Play Store

    Recommendation: Very Secure

    Key Findings

    Data Security - 5 findings (2 low, 3 info)

    Network Security - 5 findings (1 medium, 4 info)

    Code Safety - 0 findings

    Privacy - 1 finding (1 info)

    Privacy Concerns

    What Data is Collected

    Bitwarden collects minimal data. Crash reports and diagnostic information are sent to Firebase Crashlytics when the app encounters an error. Device installation identifiers are used by Firebase Installations to maintain a connection to push notification services. No personal browsing behavior, location data, or advertising identifiers are collected.

    Third-Party Data Sharing

    Vault contents are never shared with third parties. Diagnostic crash data is shared with Google's Firebase platform for stability monitoring. Push notification delivery for vault sync alerts routes through Firebase Cloud Messaging. No data is shared with advertising networks or data brokers.

    Understanding the Scores

    CategoryScore
    Security88/100
    Privacy95/100
    Data Security90/100
    Network Security95/100
    Code Safety93/100
    Data Collection100/100
    Data Sharing100/100
    User Control100/100

    Positive Security Features

    • Vault data is encrypted on the device before it is transmitted, meaning the developer cannot access stored passwords
    • No advertising networks, behavioral profiling services, or data broker integrations are present
    • Established, audited cryptographic libraries are used for all encryption operations
    • Full user control over vault data, including the option to self-host a server
    • No third-party analytics services that profile in-app activity are included

    Areas for Improvement

    • Crash diagnostic data is automatically transmitted to Firebase when the app encounters an error. An explicit in-app opt-out for this reporting would give users more direct control.
    • Some network communication settings could be further tightened to better protect data when connected to untrusted public networks.
    • Clearer in-app disclosure about what diagnostic information is collected and when it is sent would improve transparency for privacy-conscious users.

    About This Analysis

    This scorecard is generated from automated static analysis of the app's published code and configuration. Scores reflect the security and privacy practices observed at the time of the scan. Apps are updated frequently and practices may change with new versions.

    App Details

    FieldValue
    Package IDcom.x8bit.bitwarden
    Version2025.12.1
    Scan DateFebruary 17, 2026
    PlatformAndroid

    Right of Reply

    Developer not yet contacted