Skip to content
ProductArena

How Bitwarden’s scores are calculated

The full audit trail, recomputed from the verdict data at build time through the same code that produced the leaderboard: verdict × quality × story weight per cell, cells sum to dimension scores, dimensions blend into the PA Score. Every number on the product page is reproducible from this page alone; for why the formula looks like this, see the methodology.

verdict factors: full ×1.0 · partial ×0.6 · disputed ×0.3 · none ×0.0 · n/a excluded from both sides · cell points = weight × quality × factor · cell max = weight × 10

PA Score37/100

Agent-ready 62.6 × 0.30 = 18.78

API quality 0.0 × 0.20 = 0.00

Openness 68.4 × 0.20 = 13.68

Built-in AI 17.8 × 0.15 = 2.67

Automation 14.4 × 0.15 = 2.16

(18.78 + 0.00 + 13.68 + 2.67 + 2.16) ÷ (0.30 + 0.20 + 0.20 + 0.15 + 0.15) = 37.29 ÷ 1.00 = 37.3

Scores are stored to 1 decimal; the product page’s pills round to whole numbers for display. Each dimension below shows the stories, verdicts, and cited evidence behind its number.

Agent-ready62.6/100×0.30 of the PA blend

Outside-in: can YOUR agent reach and drive this product — API, MCP, CLI, headless runs, agent docs.

Point an agent at llms.txt or agent-oriented docsweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

  • [probe] https://bitwarden.com/llms.txt“PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passkeys, and secrets — for business, enterp”
  • [probe] https://bitwarden.com/llms.txt“PROBE runtime (recorded 2026-09-15): bitwarden.com serves a live llms.txt ('# Bitwarden — The most trusted open source password manager...'), and help pages ship real per-page .md mirrors — https://bitwarden.com/help/cli.md returns markdown starting '# Password Manager CLI'.”

Run the product headlessly / in CI for automationweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [community] https://news.ycombinator.com/item?id=47876043“I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including passwords and current totp codes in plaintext.”

Plug MCP servers into this product so it can use their toolsweight 3

n/a — not applicable to this product: excluded from numerator and denominator

  • [probe] https://github.com/bitwarden/mcp-server“official MCP server documented at https://github.com/bitwarden/mcp-server”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”

Connect an agent via an official MCP serverweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

  • [probe] https://github.com/bitwarden/mcp-server“official MCP server documented at https://github.com/bitwarden/mcp-server”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”

Use an official CLIweight 2

2 (weight) × 9 (quality) × 1.0 (full) = 18.0 of 20 max

  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [probe] https://bitwarden.com/help/cli/“official CLI documented at https://bitwarden.com/help/cli/”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [community] https://news.ycombinator.com/item?id=47876043“I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including passwords and current totp codes in plaintext.”

Drive the product through a documented public APIweight 3

3 (weight) × 8 (quality) × 1.0 (full) = 24.0 of 30 max

  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [probe] https://bitwarden.com/openapi.json“PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/openapi.json, https://bitwarden.com/.well-known/openapi.json)”
  • [community] https://news.ycombinator.com/item?id=47876043“I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including passwords and current totp codes in plaintext.”

Issue scoped/least-privilege API credentials for an agentweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”
  • [community] https://news.ycombinator.com/item?id=47876043“I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including passwords and current totp codes in plaintext.”

Build against official SDKsweight 2

2 (weight) × 4 (quality) × 0.6 (partial) = 4.8 of 20 max

  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [probe] https://bitwarden.com/openapi.json“PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/openapi.json, https://bitwarden.com/.well-known/openapi.json)”
  • [probe] https://github.com/bitwarden/mcp-server“official MCP server documented at https://github.com/bitwarden/mcp-server”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”

Subscribe to events via webhooksweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Agent-ready = 112.6 ÷ 180 × 100 = 62.6

API quality0.0/100×0.20 of the PA blend

The programmable surface once an agent is there — machine-readable spec, interactive docs, sandbox, versioning discipline.

Explore an interactive API reference with runnable examplesweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [probe] https://bitwarden.com/openapi.json“PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/openapi.json, https://bitwarden.com/.well-known/openapi.json)”

Download a machine-readable API spec (OpenAPI or equivalent)weight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [probe] https://bitwarden.com/openapi.json“PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/openapi.json, https://bitwarden.com/.well-known/openapi.json)”

Test against a sandbox environment without touching production dataweight 1

1 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 10 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Rely on versioned APIs with a documented deprecation policyweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [probe] https://bitwarden.com/openapi.json“PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/openapi.json, https://bitwarden.com/.well-known/openapi.json)”

API quality = 0.0 ÷ 70 × 100 = 0.0

Openness68.4/100×0.20 of the PA blend

Can you leave, inspect, or self-host — data export, open source, portability.

Do everything through the API that I can do in the UIweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [community] https://news.ycombinator.com/item?id=47876043“I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including passwords and current totp codes in plaintext.”

Export all of my data in open formats and leaveweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

  • [claimed-docs] https://bitwarden.com/help/export-your-data/“Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
  • [claimed-docs] https://bitwarden.com/help/export-your-data/“Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”
  • [claimed-docs] https://bitwarden.com/help/authenticator-import-export/“Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account export...”
  • [claimed-docs] https://bitwarden.com/help/authenticator-import-export/“Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account export... 2FAS (.2fas): Import a 2FAS backup file”
  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/import-data/“Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information and skip manual entry.”

Read the product's source under an open licenseweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”
  • [community] https://news.ycombinator.com/item?id=41940580“Props for them to step in the right direction, it wasn’t obvious at all for a few days what they would do (re: SDK relicensing controversy).”
  • [community] https://news.ycombinator.com/item?id=41940580“Thank you to Bitwarden for relicensing back to Free/Open License... I no longer recommend Bitwarden for normal people because the built-in password manager in Firefox is too good.”
  • [community] https://news.ycombinator.com/item?id=41940580“I’m relieved... I hope they realized that being FOSS is their moat... I’m still not sure how I feel about them now. Trust in the company has eroded a bit.”
  • [community] https://hn.algolia.com/api/v1/items/48163389“I use BitWarden because I'd never trust a password manager with closed source clients... Needless to say I move to the next ethical e2ee password manager if BitWarden turns its back on open source.”
  • [probe] https://bitwarden.com/llms.txt“PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passkeys, and secrets — for business, enterp”

Self-host the core productweight 3

3 (weight) × 9 (quality) × 1.0 (full) = 27.0 of 30 max

  • [claimed-docs] https://bitwarden.com/help/install-on-premise-linux/“This article will walk you through the procedure to install and deploy Bitwarden to your own Linux server.”
  • [probe] https://bitwarden.com/llms.txt“PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passkeys, and secrets — for business, enterp”

Openness = 68.4 ÷ 100 × 100 = 68.4

Built-in AI17.8/100×0.15 of the PA blend

Inside-out: how agentic the product itself is for its users — built-in assistants, autonomous features.

Get AI-generated insights and suggestions from my data inside the productweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [claimed-docs] https://bitwarden.com/help/reports/“Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault... Reports... are run locally on your client.”
  • [claimed-docs] https://bitwarden.com/help/reports/“Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault. Reports, such as the Reused Passwords and Weak Passwords report, are run locally on your client”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”

Set up automations that run autonomously in the backgroundweight 2

2 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 20 max

  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”

Delegate tasks to a built-in AI assistant inside the productweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

  • [probe] https://github.com/bitwarden/mcp-server“official MCP server documented at https://github.com/bitwarden/mcp-server”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”
  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”

Operate the product with natural-language commandsweight 2

2 (weight) × 8 (quality) × 1.0 (full) = 16.0 of 20 max

  • [probe] https://github.com/bitwarden/mcp-server“official MCP server documented at https://github.com/bitwarden/mcp-server”
  • [probe] https://github.com/bitwarden/mcp-server“PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarden/mcp-server` answered with serverInfo {"name":"Bitwarden MCP Server","version":"2026.7.0"}. First-party repo (bitwarden/mcp-server, GPL-3.0), published to npm.”
  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [probe] https://bitwarden.com/help/cli/“PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints its version — the CLI whose documented `bw serve` mode exposes the whole vault as a local RESTful API (Vault Management API) an agent can query for TOTP codes and items.”
  • [probe] https://bitwarden.com/llms.txt“PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passkeys, and secrets — for business, enterp”
  • [community] https://news.ycombinator.com/item?id=47876043“I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including passwords and current totp codes in plaintext.”

Built-in AI = 16.0 ÷ 90 × 100 = 17.8

Automation14.4/100×0.15 of the PA blend

Depth of automation primitives — rules, scheduling, bulk operations, webhooks.

Perform bulk operations across many items at onceweight 2

2 (weight) × 6 (quality) × 0.6 (partial) = 7.2 of 20 max

  • [claimed-docs] https://bitwarden.com/help/cli/“The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
  • [claimed-docs] https://bitwarden.com/help/public-api/“The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
  • [claimed-docs] https://bitwarden.com/help/personal-api-key/“Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
  • [claimed-docs] https://bitwarden.com/help/export-your-data/“Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
  • [claimed-docs] https://bitwarden.com/help/import-data/“Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information and skip manual entry.”
  • [community] https://news.ycombinator.com/item?id=47876043“I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including passwords and current totp codes in plaintext.”

Define rules that trigger actions automatically on eventsweight 3

3 (weight) × 0 (quality) × 0.0 (none) = 0.0 of 30 max

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Schedule recurring jobs or workflowsweight 2

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Version, review, and roll back my automationsweight 1

n/a — not applicable to this product: excluded from numerator and denominator

no evidence cited — the verdict rests on absence of evidence, re-checked on refresh

Automation = 7.2 ÷ 50 × 100 = 14.4