1Password vs Bitwarden

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   1Password✓fullprobed9/10

   1Password.dev and support.1password.com both serve confirmed llms.txt/llms-full.txt files plus markdown mirrors of every docs page, and this is directly verified via live probes, not just claims. missing for 10: independent third-party (non-vendor) confirmation that agents actually consume these files successfully in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://support.1password.com/llms.txt # 1Password Support > LLM-friendly exports of English public support gui…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1password.dev serves llms.txt ('# 1Password Developer Documentation') plus llms-full.txt, and every doc…”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Bitwarden✓fullprobed9/10

   Bitwarden serves a live llms.txt at bitwarden.com/llms.txt (HTTP 200) with structured content, and help pages ship real per-page markdown mirrors (e.g., cli.md) confirming genuine agent-oriented documentation rather than a stub. This is directly confirmed by runtime probes, not just claims. Missing for 10: no independent third-party corroboration of an agent actually consuming these docs end-to-end in a workflow.

   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”
   • [probe] “PROBE runtime (recorded 2026-09-15): bitwarden.com serves a live llms.txt ('# Bitwarden — The most trusted open source password manager...')…”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round drawn
   1Password✓fullprobed8/10

   1Password ships a dedicated CLI (confirmed packaged via Homebrew cask), Service Accounts explicitly for automating secrets in CI/infrastructure without extra services, Connect Servers exposing a REST API for machine workflows, and a Credential Broker for CI/CD short-lived access — all first-party documented and headless by design. Missing for 10: independent hands-on case studies/community reports specifically validating CI pipeline usage rather than just vendor docs.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”

   proof ↗⚑ flag

   Bitwarden✓fullprobed8/10

   Bitwarden ships an official CLI with API-key authentication explicitly documented as suitable for automated workflows/CI, plus a Public API for org automation and a headless 'bw serve' mode confirmed at runtime. missing for 10: no CI-specific tutorial/example pipeline (e.g., GitHub Actions) in evidence, and one community report notes CLI 'bw list' unexpectedly dumping plaintext secrets, a minor safety caveat for automation use.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Bitwarden
   1Password✓fullprobed8/10

   1Password ships an official Environments MCP Server that lets MCP clients (Claude Code, Codex, Cursor, Kiro) securely manage 1Password Environments without exposing secrets to the agent, and a runtime probe confirms a live keyless MCP initialize handshake against 1Password's own MCP endpoint. This is first-party documentation plus real runtime corroboration of the server actually working. Missing for 10: broader independent/community hands-on reports beyond the vendor probe, and clarity since the Environments MCP server is explicitly marked Beta.

   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “official MCP server documented at https://www.1password.dev/environments/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Bitwarden✓fullprobed9/10

   Bitwarden ships a first-party, GPL-3.0 MCP server (bitwarden/mcp-server) published to npm, and a runtime probe confirms it completes a full stdio handshake, showing it works as documented rather than just being an announcement. Missing for 10: independent third-party review of the MCP server's tool set/security beyond the vendor probe.

   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round drawn
   1Password✓fullprobed9/10

   1Password ships an official `op` CLI with detailed docs, reference commands, Homebrew packaging, and integration with secrets automation, service accounts, and SSH/Git workflows, making it well-suited to AI-native/agentic scripting. missing for 10: independent hands-on review or benchmark of the CLI's use in agentic workflows beyond vendor docs and packaging.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”
   • [claimed-docs] “Use the 1Password SSH Agent to authenticate all your Git and SSH workflows.”

   proof ↗⚑ flag

   Bitwarden✓fullprobed9/10

   Bitwarden ships a documented, fully-featured official CLI (bw) with vault management, API key auth for automated workflows, and a runtime-verified 'bw serve' mode exposing a local REST API well-suited to agentic/AI use. missing for 10: independent third-party benchmarking of agent integration quality beyond one community anecdote about plaintext output behavior.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “official CLI documented at https://bitwarden.com/help/cli/”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to 1Password
   1Password✓fullprobed9/10

   1Password exposes a well-documented public API surface for programmatic control: a scriptable CLI (op), official SDKs in Go/JS/Python, a Connect Server REST API, Service Accounts, Events API, and even a public MCP server for AI agents — all backed by first-party docs and confirmed via runtime probes (CLI packaged in Homebrew, MCP handshake succeeding, llms.txt/markdown mirrors of docs). This directly satisfies an AI-native user's need to drive the product via documented APIs rather than only a GUI. Missing for 10: independent third-party developer testimonials/case studies of building against these APIs beyond vendor docs and probes.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [github] “Build integrations that programmatically interact with 1Password.”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “official MCP server documented at https://www.1password.dev/environments/mcp-server”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1password.dev serves llms.txt ('# 1Password Developer Documentation') plus llms-full.txt, and every doc…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Bitwarden✓fullprobed8/10

   Bitwarden documents a Public API for organization management (bitwarden-docs-8), a personal API key for automated/programmatic access (bitwarden-docs-9), and a full-featured CLI (bitwarden-docs-7, bitwarden-probe-4) with a documented `bw serve` REST mode enabling agent-driven vault access (bitwarden-probe-rt-1); this constitutes a documented public API surface an AI-native user could drive. missing for 10: a public OpenAPI/swagger spec resolves 404 on probed endpoints (bitwarden-probe-2), and one community report flags a CLI safety/UX issue (bitwarden-comm-13) showing rough edges in automation ergonomics.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to 1Password
   1Password~partialprobed6/10

   1Password Service Accounts and Connect Servers support scoped, vault-limited, short-lived credentials for machine/agent workflows, and the Environments MCP Server explicitly avoids returning secrets to the agent, which aligns with least-privilege agent access. However, evidence doesn't show fine-grained per-agent scoping controls, credential rotation/expiry specifics, or audit tooling tailored to AI agents specifically (vs generic machine/service workflows). missing for 10: documentation of granular per-agent permission scoping, credential lifecycle/expiry controls for agents, and independent/hands-on verification of least-privilege enforcement in agent contexts.

   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Bitwarden~partialprobed4/10

   Bitwarden documents a personal API key for CLI/automated workflows and a Public API/CLI (including `bw serve` and an official MCP server) that an agent could use, but there's no evidence of fine-grained, least-privilege scoping (e.g., read-only, per-item, or per-collection API keys) — the personal API key and CLI access appear to grant broad vault access rather than scoped permissions, and a hands-on report shows `bw list` dumping full plaintext secrets rather than a restricted subset. missing for 10: documented scoped/restricted API key types, per-agent permission grants, or evidence that MCP/CLI access can be limited to specific vault items rather than the whole vault.

   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to 1Password
   1Password✓fullprobed8/10

   1Password ships official SDKs for Go, JavaScript, and Python for programmatically interacting with vaults, secrets, and items, backed by GitHub repos, docs, and complementary CLI/Connect/Service Accounts tooling for automation workflows. missing for 10: independent third-party developer testimonials/case studies validating real-world SDK usage beyond vendor docs and GitHub repo descriptions.

   • [claimed-docs] “Secure your applications: Load secrets into your code with secret references or read environment variables from 1Password Environments.”
   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [github] “Build integrations that programmatically interact with 1Password.”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Bitwarden~partialprobed4/10

   Evidence shows Bitwarden exposes a Public API, CLI, personal API keys for automation, and an official MCP server (all of which an AI-native builder could integrate against), but there is no evidence of a dedicated, language-specific 'official SDK' (e.g., a bitwarden/sdk repo) and the OpenAPI/swagger spec probes all returned 404, suggesting no machine-readable API contract is published. missing for 10: explicit official SDK repositories/language bindings, published OpenAPI spec, independent developer corroboration of SDK usage.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”
   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   1Password—none0/10

   1Password documents an Events API for retrieving account activity and forwarding it to a SIEM system, but this is a pull-based polling API, not a webhook subscription mechanism. No evidence anywhere in the pack shows a webhook registration/callback capability for AI-native or any consumers.

   • [claimed-docs] “The 1Password Events API allows you to retrieve information about activity in your 1Password Business account and send it to your security i…”

   proof ↗⚑ flag

   Bitwarden—none0/10

   Bitwarden's evidence covers event logs via the Public API and a CLI/MCP server for vault access, but nothing describes webhook subscriptions for events—no documented webhook endpoints, registration API, or push-event mechanism.

   ⚑ flag

Agentic features

1. ai-native userGet AI-generated insights and suggestions from my data inside the product

   weight 2 · round drawn
   1Password—none0/10

   1Password's evidence shows rule-based security features (Watchtower flags weak/breached passwords) and developer-facing MCP/SDK/CLI tooling for external agents to access secrets, but nothing about the product itself generating AI-driven insights or suggestions from a user's stored data. Missing for 10: any AI-generated analysis, recommendations, or summaries surfaced inside the 1Password app/UI itself.

   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Bitwarden—none0/10

   Bitwarden is a password/secrets manager; there is no evidence of any AI-generated insights or suggestions derived from the user's vault data (e.g., no AI-driven analysis, summarization, or recommendations beyond static, non-AI vault health reports). The MCP server and CLI enable agents to query vault data but do not themselves generate AI insights within the product.

   • [claimed-docs] “Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault... Reports... are run locally on …”
   • [claimed-docs] “Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault. Reports, such as the Reused Pass…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

2. ai-native userSet up automations that run autonomously in the background

   weight 2 · round to 1Password
   1Password~partialprobed5/10

   1Password provides machine-facing automation building blocks — Service Accounts, Connect Servers, Credential Broker, CLI, and SDKs — that let CI/CD pipelines and other unattended workflows fetch secrets autonomously in the background, and the Environments MCP Server lets AI agents manage secrets without human intervention. However, there's no evidence of a general-purpose scheduler, trigger system, or orchestration layer for building broader 'automations' beyond secrets retrieval/injection. Missing for 10: native scheduling/triggers, workflow orchestration UI, and evidence of autonomous multi-step automations beyond secret access.

   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “Secure your applications: Load secrets into your code with secret references or read environment variables from 1Password Environments.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”
   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”

   proof ↗⚑ flag

   Bitwarden—none0/10

   Bitwarden offers CLI/API/MCP server access that agents could use, but there is no evidence of a mechanism for setting up autonomous, scheduled, or background-running automations (e.g., triggers, workflows, cron-like jobs) — it only provides interfaces for on-demand vault access. missing for 10: any documented scheduling/trigger/workflow automation feature, evidence of background/autonomous execution, or vendor claims of persistent automation setup.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

3. ai-native userDelegate tasks to a built-in AI assistant inside the product

   weight 3 · round drawn
   1Password—none0/10

   Evidence shows 1Password exposes MCP servers, CLI, and SDKs so external AI agents (Claude Code, Cursor, Codex) can call into 1Password's data — the opposite of a built-in assistant inside 1Password itself. No evidence describes an in-product AI assistant a user can delegate tasks to.

   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Bitwarden—none0/10

   Evidence shows Bitwarden offers an MCP server and CLI so external AI agents can query the vault, but there is no evidence of a built-in AI assistant inside the Bitwarden product that a user can delegate tasks to.

   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”

   proof ↗⚑ flag

4. ai-native userOperate the product with natural-language commands

   weight 2 · round to Bitwarden
   1Password~partialprobed6/10

   1Password ships an official Environments MCP Server that lets AI agents (Claude Code, Codex, Cursor, Kiro) manage 1Password Environments via natural-language prompts through MCP clients, and a public docs MCP server for AI-readable documentation — genuine natural-language operability. However this is explicitly Beta and scoped only to Environments/secrets management, not the broader vault/login/passkey functionality that makes up most of 1Password's product surface, and the primary automation surface (CLI, SDKs) is structured commands, not natural language. Missing for 10: NL control over core password/vault/item management, general-availability status of the MCP server, independent hands-on verification of the NL workflow.

   • [claimed-docs] “The 1Password Environments MCP Server lets MCP clients such as Claude Code, Codex, Cursor, and Kiro securely manage your 1Password Environme…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”
   • [probe] “official MCP server documented at https://www.1password.dev/environments/mcp-server”

   proof ↗⚑ flag

   Bitwarden✓fullprobed8/10

   Bitwarden ships an official MCP server (bitwarden/mcp-server) that completed a live stdio handshake, letting AI agents/assistants issue natural-language commands to manage the vault, backed by a full-featured CLI and llms.txt for AI-friendly docs. Missing for 10: no independent hands-on demonstration of a natural-language command actually retrieving/creating vault items via the MCP server, and community feedback flags CLI output risks (e.g., plaintext dumps) that complicate safe agentic use.

   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   1Password—none0/10

   1Password ships CLI/SDK/API docs, llms.txt exports, and an MCP server, but nothing in the evidence describes an interactive API reference with runnable/try-it examples (e.g., an API console or embedded sandbox); the CLI reference is static text, not executable in-browser. missing for 10: an interactive API explorer/playground, evidence of runnable code samples, any 'try it' console for the REST or SDK APIs.

   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1password.dev serves llms.txt ('# 1Password Developer Documentation') plus llms-full.txt, and every doc…”

   proof ↗⚑ flag

   Bitwarden—none0/10

   Bitwarden documents a Public API for org management (bitwarden-docs-8) but there is no evidence of an interactive API reference with runnable examples (e.g., Swagger/OpenAPI explorer); a direct probe for openapi.json/swagger.json endpoints returned 404 on all candidate paths (bitwarden-probe-2), indicating no such interactive reference is exposed.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   1Password—none0/10

   1Password documents REST APIs (Connect Server, Events API) and SDKs, but no evidence pack item mentions a downloadable OpenAPI/Swagger spec or any machine-readable API schema for these APIs. Missing for 10: any OpenAPI/Swagger file, schema reference, or equivalent machine-readable spec for Connect, Events API, or SDKs.

   ⚑ flag

   Bitwarden—none0/10

   Bitwarden documents a Public API and CLI, but a probe for common OpenAPI/Swagger spec URLs (openapi.json, swagger.json, .well-known/openapi.json) all returned 404, and no evidence pack item shows a downloadable machine-readable API spec. Missing for 10: any documented OpenAPI/Swagger file, spec download link, or API reference generator output.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”

   proof ↗⚑ flag

3. ai-native userTest against a sandbox environment without touching production data

   weight 1 · round drawn
   1Password—none0/10

   1Password provides vaults, CLI, Connect, and Service Accounts for automation, but no evidence describes a dedicated sandbox/test environment (e.g., a staging API or non-production account) that would let an AI-native user validate integrations without touching real production vaults/secrets.

   ⚑ flag

   Bitwarden—none0/10

   No evidence of a sandbox/test environment offering for Bitwarden—docs and probes cover CLI, MCP server, import/export, TOTP, and self-hosting, but nothing describes a dedicated sandbox distinct from production data for testing purposes.

   ⚑ flag

4. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   1Password—none0/10

   The evidence pack shows 1Password has developer APIs, SDKs, CLI, and Connect servers, but nowhere does it document API versioning schemes or a formal deprecation policy for these interfaces. Missing for 10: explicit API version numbers/headers, a published deprecation/sunset policy, changelog or migration guides for breaking changes.

   ⚑ flag

   Bitwarden—none0/10

   Bitwarden documents a Public API and CLI/personal API key access, but there is no evidence of API versioning scheme or a documented deprecation policy; probes for an OpenAPI spec (bitwarden-probe-2) all returned 404s, and no docs mention version headers, breaking-change policy, or sunset timelines.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round drawn
   1Password~partialprobed6/10

   The 1Password CLI (`op item list`, etc.) and SDKs explicitly support programmatic, scriptable management of items ('Automate item management: Programmatically manage items in your 1Password account'), which enables bulk operations via scripting loops or SDK calls. However, there is no dedicated bulk-edit/batch-update command or documentation showing native multi-item bulk operations (e.g., bulk delete, bulk tag) — missing for 10: explicit bulk-operation commands/API endpoints, documented examples of bulk updates across many items, and independent verification of bulk-scale performance.

   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Bitwarden~partialcommunity6/10

   The CLI (bw list/create/edit/delete) and Public API expose scriptable, item-level access that can be chained for bulk operations, and import/export functions handle whole-vault bulk transfers of many items at once; community evidence (bw list dumping the entire vault) confirms bulk read actually works. However, there is no first-party documentation of a dedicated bulk-edit/bulk-tag/bulk-delete command or batch endpoint — bulk operations require the user to script them themselves rather than a built-in bulk API. Missing for 10: documented native bulk-update/bulk-delete commands, batch API endpoints for many items, and independent hands-on confirmation of large-scale automated edits succeeding.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

2. ai-native userDefine rules that trigger actions automatically on events

   weight 3 · round drawn
   1Password—none0/10

   1Password provides scripting/CLI/SDK automation (op CLI, Connect, service accounts) and an Events API for exporting activity to SIEM, but none of these constitute a user-defined rules engine that automatically triggers actions on events within the product itself; Watchtower only flags issues rather than acting on them. No evidence of an 'if this event happens, then do this action' automation/trigger system exists in the evidence pack.

   • [claimed-docs] “The 1Password Events API allows you to retrieve information about activity in your 1Password Business account and send it to your security i…”
   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”
   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”

   proof ↗⚑ flag

   Bitwarden—none0/10

   Bitwarden's evidence shows CLI, API, MCP server, and vault health reports, but nothing about defining rules that automatically trigger actions on events (e.g., breach detected → auto-rotate password, or policy-triggered workflows). This is a fair automation axis for a security product, but no evidence of any rule-based/event-triggered automation engine.

   ⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Bitwarden
   1Password~partialclaimed5/10

   1Password's CLI, SDKs (Go/JS/Python), Connect Server, and Service Accounts let AI/automation programmatically read, create, and manage vault items and secrets ([1password-docs-2],[1password-docs-4],[1password-docs-5],[1password-docs-8],[1password-docs-26]), which covers the core secrets-management workflows. However, many UI-only capabilities — passkey creation/autofill in the browser extension, Watchtower breach/weak-password monitoring, Apple Watch lookups, import/export flows, SSH agent autofill — have no documented API/CLI equivalent, so full UI/API parity is not evidenced. Missing for 10: API-exposed passkey management, Watchtower/security-alerts API, and full item-type/browser-feature parity via CLI or SDK.

   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”
   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “1Password lets you easily sign in to sites, use suggested passwords, and find what you need – all without leaving your browser.”

   proof ↗⚑ flag

   Bitwarden~partialprobed6/10

   Bitwarden ships a fully-featured CLI and a Vault Management API (`bw serve`) covering item/vault CRUD, TOTP retrieval, and org management via a Public API and personal API key for automated workflows, giving strong but not fully documented parity with the UI. There's no explicit vendor claim or evidence that every UI feature (e.g., passkey autofill, browser-context auto-fill, vault health reports) is exposed via API/CLI, and a hands-on report shows the CLI's `bw list` behaves differently than expected (dumping all secrets) rather than mirroring UI workflows cleanly. missing for 10: explicit API/CLI equivalents for passkey autofill and browser-based auto-fill, API access to vault health reports, and a documented feature-parity statement.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Bitwarden
   1Password~partialclaimed5/10

   1Password documents a built-in export feature explicitly for moving data to another app, and separately documents CSV import compatibility, implying an open-format export path (e.g. CSV) exists — but the evidence never states which formats export actually produces (1Password's native export is typically 1PUX, not just CSV) nor confirms full data coverage (attachments, SSH keys, secure notes) is included. missing for 10: explicit confirmation that exported format is open/interoperable (not proprietary 1PUX), evidence of full-fidelity data portability, and independent/hands-on confirmation of successful migration.

   • [claimed-docs] “You can export your information from the 1Password apps if you want to move it to a different app.”
   • [claimed-docs] “You can import data into 1Password from many different browsers and applications, including applications that export data in the comma-separ…”
   • [claimed-docs] “Learn how to transfer your passwords and other information from other applications into 1Password.”

   proof ↗⚑ flag

   Bitwarden✓fullclaimed9/10

   Bitwarden's docs explicitly support exporting full vault data (logins, notes) for backup or transfer, plus separate authenticator/TOTP export in open formats (JSON), and CLI/API access for automated bulk export. This directly satisfies the 'export all data in open formats and leave' story with strong first-party documentation. Missing for 10: no independent/hands-on confirmation of export format fidelity or completeness verification by a third party.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to Bitwarden
   1Password—none0/10

   1Password is closed-source proprietary software; the evidence pack shows CLI, SDKs, MCP servers and docs, but nothing indicating source code is published under an open license. Missing for 10: any evidence of an open-source license, public source repository, or statement of source availability.

   ⚑ flag

   Bitwarden~partialprobed6/10

   Community evidence and the MCP server repo confirm Bitwarden ships components under open licenses (e.g., bitwarden/mcp-server is GPL-3.0) and is broadly known/marketed as 'the most trusted open source password manager,' and users cite valuing its open client source. However, the same evidence documents a real controversy where Bitwarden relicensed its SDK away from a fully open license, only reversing course after backlash — a concrete counter-example to unconditional openness. missing for 10: explicit license file/repo evidence for the core vault clients, resolution details confirming all components are now uniformly open-licensed, independent audit confirming no remaining non-open components.

   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [community] “Props for them to step in the right direction, it wasn’t obvious at all for a few days what they would do (re: SDK relicensing controversy).”
   • [community] “Thank you to Bitwarden for relicensing back to Free/Open License... I no longer recommend Bitwarden for normal people because the built-in p…”
   • [community] “I’m relieved... I hope they realized that being FOSS is their moat... I’m still not sure how I feel about them now. Trust in the company has…”
   • [community] “I use BitWarden because I'd never trust a password manager with closed source clients... Needless to say I move to the next ethical e2ee pas…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Bitwarden
   1Password—none0/10

   1Password is a cloud-hosted SaaS vault; the only 'self-hosted' pieces are Connect Servers/Environments proxies that still require a cloud 1Password account behind them, not the core vault itself. Community comments explicitly confirm the loss of local/offline vault storage and no self-host option ('no native apps, no local vault storage... VC rot has already set in'), and there is no docs evidence of a self-hostable core product.

   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [community] “Use a tiny portion of that to continue support for local, non-cloud-based vault files please.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”

   proof ↗⚑ flag

   Bitwarden✓fullprobed9/10

   Bitwarden provides official, well-documented on-premise/self-hosting instructions for Linux servers, and it is open-source, aligning strongly with an AI-native user's openness needs. missing for 10: independent hands-on verification of self-hosted deployment specifically (evidence is docs-only, not community confirmation of self-hosting success).

   • [claimed-docs] “This article will walk you through the procedure to install and deploy Bitwarden to your own Linux server.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”

   proof ↗⚑ flag

Storage

1. everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes

   weight 3 · round drawn
   1Password✓fullclaimed8/10

   1Password's own support docs confirm passkey creation, storage, and sign-in on websites/apps directly through 1Password (browser extension and apps), plus Watchtower flagging logins that can upgrade to passkeys, going well beyond just TOTP storage which is also documented separately. Missing for 10: independent hands-on verification of passkey sign-in reliability across many sites and no explicit mobile-app (non-browser) passkey autofill confirmation.

   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “opening Watchtower in 1Password, which now flags all of your existing logins that could be updated with a passkey”
   • [claimed-docs] “You can use 1Password to save the passkeys you create for your accounts and sign in to websites with passkeys in your browser.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Bitwarden✓fullclaimed8/10

   Bitwarden documents storing passkeys in the vault and using the browser extension or mobile apps to autofill/sign in with them across websites and apps, going beyond TOTP-only support (bitwarden-docs-4), which aligns directly with the story's requirement of passkey-based sign-in, not just TOTP codes. Missing for 10: independent/hands-on user reports specifically confirming passkey sign-in reliability (community evidence only discusses TOTP/autofill issues, not passkeys) and detail on cross-platform (desktop app) passkey support beyond browser/mobile.

   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”

   proof ↗⚑ flag

Sync

1. power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor

   weight 2 · round drawn
   1Password~partialcommunity6/10

   1Password's docs show passkeys can be created, saved, and used from the browser extension across 'a growing number of websites and apps' and Watchtower flags logins for passkey upgrade, implying sync across whatever platform the extension/app runs on rather than vendor lock-in. However the evidence pack never explicitly confirms native passkey support/sync parity on Linux or Android apps (only browser extension and Apple-ecosystem mentions like Apple Watch/Touch ID), and an older community comment specifically raises concerns about a missing Linux client, leaving cross-platform parity unconfirmed by direct docs. Missing for 10: explicit Linux and Android app passkey documentation, independent hands-on confirmation of parity across all five listed platforms.

   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “opening Watchtower in 1Password, which now flags all of your existing logins that could be updated with a passkey”
   • [claimed-docs] “You can use 1Password to save the passkeys you create for your accounts and sign in to websites with passkeys in your browser.”
   • [community] “Mandatory 'No Linux client' comment :| Does anyone have any insight if this is a pure business decision or there's something holding them ba…”

   proof ↗⚑ flag

   Bitwarden~partialclaimed6/10

   Bitwarden explicitly stores passkeys in the vault and lets the browser extension and mobile apps autofill them across apps and sites, which is the platform-agnostic model (unlike Apple/Google's device-locked passkey sync) [bitwarden-docs-4]. However, the docs only call out browser extension and mobile apps, not desktop apps on Windows/Linux specifically, and there's no independent hands-on confirmation of passkey sync working seamlessly across all five named platforms. Missing for 10: explicit desktop (Windows/Linux) passkey autofill documentation, and independent/community verification of cross-platform passkey sync reliability.

   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”

   proof ↗⚑ flag

Export

1. power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in

   weight 3 · round drawn
   1Password~partialclaimed4/10

   1Password documents a general export feature to move data to another app ([1password-docs-15]), and TOTP/OTP storage is documented ([1password-docs-20]), but no evidence specifies that TOTP secrets are included in the export or that the export format is an open, readable standard (e.g., otpauth:// URIs or plain text) rather than 1Password's proprietary 1PUX format. Missing for 10: explicit confirmation that TOTP secrets are exportable, evidence of an open/readable export format, and independent/hands-on corroboration of successful migration of OTP secrets to another app.

   • [claimed-docs] “You can export your information from the 1Password apps if you want to move it to a different app.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Bitwarden~partialclaimed4/10

   Bitwarden documents a general vault export (JSON/CSV) for 'logins and notes' and back-up/transfer purposes, but the evidence never explicitly confirms that TOTP secrets are included in that export or specifies an open, human-readable format for them — only import paths for other authenticators (Google Authenticator QR, LastPass JSON, 2FAS) are detailed, which is the opposite direction (lock-in mitigation on entry, not exit). Missing for 10: explicit confirmation that TOTP seeds are present in the standard export file, documentation of the exact readable TOTP export format, and any independent/hands-on verification that exported TOTP secrets can be reimported elsewhere.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”

   proof ↗⚑ flag

Import

1. power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand

   weight 2 · round to Bitwarden
   1Password~partialclaimed4/10

   1Password documents general import from other apps/browsers via CSV and the newer Credential Exchange standard on iOS 26+, and it supports storing one-time passwords, but no evidence explicitly confirms bulk import of authenticator/OTP tokens specifically from other authenticator apps (e.g., Google Authenticator, Authy) rather than just passwords/logins. Missing for 10: explicit documentation of OTP-specific bulk import/migration flow from named authenticator apps, and any hands-on/community confirmation that OTP secrets survive the CSV or Credential Exchange import.

   • [claimed-docs] “You can import data into 1Password from many different browsers and applications, including applications that export data in the comma-separ…”
   • [claimed-docs] “If you use 1Password on iOS or iPadOS 26 or later, you can import data directly from apps that support the Credential Exchange standard.”
   • [claimed-docs] “Learn how to transfer your passwords and other information from other applications into 1Password.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Bitwarden✓fullclaimed8/10

   Bitwarden's official docs explicitly support bulk import of TOTP/authenticator tokens from Google Authenticator (QR), LastPass Authenticator (JSON), and 2FAS (.2fas) backups, directly enabling power users to migrate accounts without re-enrolling each one by hand. This is a first-party, documented dedicated import flow, not a workaround. missing for 10: independent hands-on confirmation of the bulk import UX working smoothly, and coverage of additional popular authenticator export formats (e.g., Authy, Microsoft Authenticator).

   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”

   proof ↗⚑ flag

Migration

1. everyday userMoving to a new phone transfers all my tokens in one guided step

   weight 2 · round to Bitwarden
   1Password—none0/10

   The evidence pack covers CLI/SDK/Connect integrations, browser passkeys, import/export from other apps, and OTP storage, but nothing describes a guided 'move to new phone' flow that automatically transfers all tokens/OTPs in one step. Cloud sync via account sign-in is 1Password's usual mechanism, but no citation confirms this specific onboarding experience or that it covers OTP/token migration seamlessly.

   ⚑ flag

   Bitwarden~partialcommunity6/10

   Bitwarden's cloud vault syncs logins, passkeys, and TOTP codes across devices automatically (docs-1, docs-2, docs-4), so logging into a new phone with the same account would pull in tokens without manual export/import — effectively delivering the outcome. However, no evidence describes a dedicated 'guided' new-device setup wizard, and one community report (bitwarden-comm-9) describes lost generated data tied to connectivity issues, raising reliability caveats for a seamless one-step transfer. Missing for 10: documented guided device-migration flow/wizard, and independent hands-on confirmation that TOTP/passkeys transfer flawlessly to a new phone.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [community] “I tried switching to Bitwarden and forced myself to live with it for 3 months. I gave up when it lost generated password. Apparently it is q…”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round drawn
   1Password—none0/10

   No evidence pack item mentions data residency, regional storage options, or the ability to choose where a vault/account's data is physically stored; 1Password's architecture appears to be a single managed cloud service without documented regional selection. Missing for 10: any documentation of region/residency selection, EU/US data center choice, or self-hosted storage location controls.

   ⚑ flag

   Bitwarden—none0/10

   No evidence pack item mentions data residency, region selection, or self-hosting for regional compliance beyond a generic on-premise Linux install guide, which does not address choosing a storage region. Missing for 10: any documentation of region/data-residency selection (e.g., EU vs US data centers), enterprise residency options, or explicit control over where vault data is stored.

   ⚑ flag

2. ai-native userPrevent my data from being used to train AI models

   weight 3 · round drawn
   1Password—none0/10

   No evidence in the pack addresses any policy, setting, or documentation about opting out of or preventing data use for AI model training; the pack covers CLI/SDK/Connect/SSH/passkeys but nothing about AI training data usage or opt-outs.

   ⚑ flag

   Bitwarden—none0/10

   The evidence pack contains no documentation, policy statement, or setting from Bitwarden addressing whether vault data or user data is used to train AI models, nor any opt-out mechanism for such use. This is a fair privacy-posture question for a SaaS handling sensitive personal data, but nothing in the pack confirms or denies a stance, so it cannot be credited as delivered.

   ⚑ flag

3. ai-native userControl data retention and deletion

   weight 2 · round to Bitwarden
   1Password—none0/10

   The pack shows data export/import and an MCP design that avoids returning secrets to agents, but there is no evidence of explicit controls for data retention policies or deletion (e.g., audit-log retention settings, vault/item purge, GDPR-style deletion) tailored to AI-native workflows. missing for 10: retention policy controls, explicit deletion/purge mechanisms for AI-consumed data, documentation tying these to AI agent use.

   ⚑ flag

   Bitwarden~partialcommunity3/10

   Bitwarden docs show users can export their vault data (for backup or account transfer) and community evidence indicates an account-deletion path exists (export → delete account → recreate), but there is no dedicated, first-party documentation on data retention policies, granular deletion controls, or how these apply to AI/agent access (e.g., MCP server or CLI-served vault data). Missing for 10: explicit retention policy documentation, dedicated account/vault deletion docs, and clarity on data lifecycle when accessed via CLI/MCP for AI agents.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”
   • [community] “BitWarden has lost the trust. There was a blocker bug on iOS, they went radio silent on follow-ups, and their fix suggestion was 'export dat…”

   proof ↗⚑ flag

4. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round drawn
   1Password—none0/10

   No evidence pack item addresses telemetry/usage-tracking opt-out settings or privacy controls for AI-native usage; all evidence covers unrelated features like CLI, SSH, SDKs, and password management. This is a fair axis for any product handling sensitive data, but no documentation or community evidence confirms or denies a telemetry opt-out option.

   ⚑ flag

   Bitwarden—none0/10

   The evidence pack contains no documentation, settings, or community reports describing a telemetry/usage-tracking opt-out control in Bitwarden clients, CLI, or self-hosted server. While the axis is fair to ask of any privacy-focused product, nothing here confirms such a toggle exists or how it works.

   ⚑ flag

App lock

1. everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes

   weight 2 · round to Bitwarden
   1Password—none0/10

   The evidence pack only covers CLI/SDK sign-in via system authentication (Touch ID/Windows Hello) for developer tooling, not the everyday consumer app's biometric/PIN lock screen protecting saved logins or OTP codes on a borrowed phone. No documentation or community evidence in the pack describes the mobile/desktop app requiring biometrics or PIN to unlock and view items like one-time passwords.

   ⚑ flag

   Bitwarden~partialcommunity3/10

   No official documentation in the evidence pack describes a PIN/biometric app-lock feature; the only signal is an indirect community comment implying fingerprint unlock already exists on some platforms but is missing on Linux, which weakly corroborates the capability without detailing scope or coverage. Missing for 10: first-party docs on biometric/PIN unlock, mobile-specific confirmation, and independent hands-on validation of the lock behavior.

   • [community] “Yeah it's nice and all but I wish they brought fingerprint auth to Linux already.”

   proof ↗⚑ flag

Audits

1. security engineerThe vendor publishes independent security audits of the app and its sync protocol

   weight 2 · round drawn
   1Password—none0/10

   No evidence in the pack references independent third-party security audits, pen-test reports, or cryptographic protocol reviews of 1Password's app or sync protocol (e.g., no mention of the publicly known white paper audits by NCC Group/etc.). All citations cover CLI, SDKs, SSH, passkeys, and general product docs, none addressing audit publication.

   ⚑ flag

   Bitwarden—none0/10

   No evidence pack items reference independent third-party security audits, penetration tests, or cryptographic/protocol reviews of Bitwarden's app or sync protocol; the pack only covers docs on features (TOTP, autofill, CLI, import/export) and community sentiment/complaints unrelated to audits. Missing for 10: published audit reports (e.g., Cure53), audit scope/dates, sync protocol review findings, remediation disclosures.

   ⚑ flag

Monitoring

1. power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed

   weight 2 · round to 1Password
   1Password✓fullclaimed8/10

   Watchtower explicitly flags breaches, weak passwords, duplicate/reused items, and other security problems across saved items, directly matching the story's requirements, and it's surfaced natively in the app/browser extension (also flagging passkey-upgrade opportunities). Missing for 10: independent hands-on verification of Watchtower's breach-detection accuracy/coverage beyond vendor docs.

   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”
   • [claimed-docs] “opening Watchtower in 1Password, which now flags all of your existing logins that could be updated with a passkey”

   proof ↗⚑ flag

   Bitwarden~partialclaimed5/10

   Bitwarden's Vault Health Reports (docs-11/17) explicitly check for reused and weak passwords locally on the client, covering part of the story, but no evidence in the pack documents breach monitoring (e.g., known data-breach alerts) or an 'exposed passwords' check against breach databases. Missing for 10: evidence of breach/exposure alerts for compromised services, and any exposed-credential detection feature.

   • [claimed-docs] “Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault... Reports... are run locally on …”
   • [claimed-docs] “Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault. Reports, such as the Reused Pass…”

   proof ↗⚑ flag

Push

1. it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies

   weight 2 · round drawn
   1Password—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   Bitwarden—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Server

1. it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter

   weight 2 · round to Bitwarden
   1Password!disputedcontradicted4/10

   1Password markets a 'Connect Server' that can be deployed in a company's own infrastructure to access items via REST API (docs-4), which sounds like partial self-hosting, but this is only a caching/access layer in front of 1Password's cloud vaults, not a full self-hosted sync server. Community evidence directly contradicts the idea that secrets can stay entirely within an admin's perimeter: users note 1Password has 'no local vault storage' anymore and ask the vendor to 'continue support for local, non-cloud-based vault files' (comm-7, comm-8), confirming that the cloud remains the source of truth. Missing for 10: any documented on-prem deployment of the full sync/vault backend, migration guide for self-hosted secret storage, or evidence that Connect Server operates without 1Password's cloud.

   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [community] “Use a tiny portion of that to continue support for local, non-cloud-based vault files please.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”

   proof ↗⚑ flag

   Bitwarden✓fullclaimed8/10

   Bitwarden provides official documentation for installing and deploying the self-hosted server on a Linux server, keeping vault data on the admin's own infrastructure — the core of this story. Missing for 10: independent hands-on verification of a real-world self-hosted deployment and details on ongoing maintenance/upgrade complexity for self-hosted instances.

   • [claimed-docs] “This article will walk you through the procedure to install and deploy Bitwarden to your own Linux server.”

   proof ↗⚑ flag

Source

1. security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed

   weight 2 · round to Bitwarden
   1Password—none0/10

   No evidence in the pack indicates 1Password's client apps are open source or available for community code review; all citations describe closed commercial SDKs, CLI, Connect servers, and browser extension features without any open-source licensing or public repository claims for the core vault/client apps themselves. missing for 10: any statement of open-source licensing for 1Password clients, a public source repository for the desktop/mobile/browser apps, or third-party audit citing open code review.

   ⚑ flag

   Bitwarden~partialprobed6/10

   Bitwarden markets itself as 'the most trusted open source password manager' and community members explicitly cite open-source clients as the reason they trust it with secrets (bitwarden-probe-1, bitwarden-comm-15). However, the evidence also documents a real controversy where SDK code (used by clients) was briefly relicensed away from a fully open license before being reverted after community pressure, which shows scrutiny worked but also that openness has not always been airtight (bitwarden-comm-1, bitwarden-comm-3, bitwarden-comm-4). Missing for 10: direct links to client-app GitHub repos, explicit confirmation that seed/TOTP-handling code specifically is open and audited, and independent third-party code audits corroborating the open-source claim.

   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”
   • [community] “I use BitWarden because I'd never trust a password manager with closed source clients... Needless to say I move to the next ethical e2ee pas…”
   • [community] “Props for them to step in the right direction, it wasn’t obvious at all for a few days what they would do (re: SDK relicensing controversy).”
   • [community] “Thank you to Bitwarden for relicensing back to Free/Open License... I no longer recommend Bitwarden for normal people because the built-in p…”
   • [community] “I’m relieved... I hope they realized that being FOSS is their moat... I’m still not sure how I feel about them now. Trust in the company has…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow

   weight 2 · round to Bitwarden
   1Password~partialprobed4/10

   1Password docs confirm OTP storage/lookup in the app (docs-20, docs-24, docs-19) and a general-purpose CLI/SDK for programmatic item access (docs-1, docs-2, docs-26, probe-rt-3), which together imply an agent could retrieve a TOTP field via CLI, but no evidence explicitly documents a TOTP-specific command or API response format for pulling a live 2FA code in an automated workflow. missing for 10: explicit CLI/API documentation of TOTP field retrieval (e.g., a `--otp` flag or field type), and any example/community confirmation of an agent completing 2FA end-to-end.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Bitwarden✓fullprobed8/10

   Bitwarden's integrated authenticator generates TOTP codes (bitwarden-docs-1) and the CLI is documented as a full vault-management tool suitable for automated workflows via personal API key (bitwarden-docs-7, bitwarden-docs-9); runtime probes confirm 'bw serve' exposes a local REST Vault Management API and an official MCP server completes a full handshake, both surfaces an agent could use to fetch TOTP codes programmatically (bitwarden-probe-rt-1, bitwarden-probe-rt-2). Hands-on community evidence independently corroborates that 'bw list' actually returns current TOTP codes in plaintext, confirming the CLI does return live TOTP data (bitwarden-comm-13). Missing for 10: explicit documentation naming a dedicated 'get totp' command/API endpoint and a clean (non-complaint) hands-on workflow example.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

2. ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app

   weight 1 · round drawn
   1Password✓fullprobed8/10

   The 1Password CLI (`op`) and SDKs/Connect Server provide a local, scriptable, programmatic interface (not screen-scraping) that returns items, secrets, and OTP codes directly, and this is corroborated by real-world packaging (Homebrew cask) confirming it's a genuine local endpoint agents can shell out to. Missing for 10: no direct hands-on evidence of an AI agent actually querying the CLI/Connect Server for codes, and the newer MCP server explicitly withholds raw secrets from the agent, so full 'codes and secrets' access is only fully realized via CLI/SDK, not MCP.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “op item list --vault Private”
   • [claimed-docs] “Use the 1Password Credential Broker to give CI/CD and other machine workflows short-lived access to secrets, without managing service accoun…”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [probe] “official CLI documented at https://www.1password.dev/cli/get-started”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 1Password's public docs MCP server at https://www.1password.dev/mcp completed a FULL keyless initialize…”

   proof ↗⚑ flag

   Bitwarden✓fullprobed8/10

   Bitwarden's CLI supports a documented `bw serve` mode exposing the vault as a local RESTful API, and Bitwarden ships an official MCP server (bitwarden/mcp-server) that completed a live stdio handshake, both giving agents programmatic access to vault items and TOTP codes without screen-scraping. missing for 10: no independent hands-on validation of `bw serve` specifically for TOTP retrieval by an agent, and no broader third-party corroboration beyond the vendor-run probes.

   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”

   proof ↗⚑ flag

Browser

1. everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them

   weight 2 · round drawn
   1Password✓fullcommunity8/10

   Docs confirm browser extension autofills passkeys during sign-in and stores/retrieves one-time passwords (TOTP), covering both parts of the story, with community corroboration of browser extension quality and iframe-aware autofill behavior. Missing for 10: explicit first-party statement or hands-on demo showing TOTP codes specifically autofilled (rather than just 'stored/accessed') and independent confirmation of passkey autofill working reliably across sites.

   • [claimed-docs] “you can now create, manage, and sign in with passkeys on a growing number of websites and apps directly from the 1Password browser extension”
   • [claimed-docs] “You can use 1Password to save the passkeys you create for your accounts and sign in to websites with passkeys in your browser.”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “1Password lets you easily sign in to sites, use suggested passwords, and find what you need – all without leaving your browser.”
   • [community] “1Password fills iframes based on their domain rather than the parents... In my opinion this is the right security model.”
   • [community] “Both the Fastmail and Privacy integrations have made 1Password a joy to use in the past few years. I've used premium BitWarden in the past, …”

   proof ↗⚑ flag

   Bitwarden✓fullcommunity8/10

   Docs confirm browser extension autofills matching credentials on login pages (docs-12), autofills stored passkeys across apps/websites (docs-4), and generates/syncs TOTP codes (docs-1, docs-2) which are surfaced during autofill in the extension. One community mention notes TOTP setup friction, but no concrete evidence contradicts the core autofill-of-TOTP/passkeys capability. Missing for 10: independent hands-on confirmation specifically that TOTP codes (not just passwords/passkeys) are auto-filled into login forms without manual copy-paste.

   • [claimed-docs] “When you visit a website, the browser extension recognizes it and enters matching credentials from your vault into the login fields.”
   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [community] “I always enjoyed the value that Bitwarden provides: free to use, password generator, and a vault to keep other texts. But somehow I never go…”

   proof ↗⚑ flag

Desktop

1. power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile

   weight 2 · round drawn
   1Password~partialcommunity5/10

   Evidence confirms a desktop 1Password app exists (CLI integrates with 'the 1Password app' via Touch ID/Windows Hello, and community references to the Electron-based desktop client) and that vault/OTP data is stored centrally and accessible from apps generally, but no evidence pack item explicitly documents desktop-specific vault UI or OTP display screens, and community notes flag desktop app quality concerns (Electron complaints, no native app comments). missing for 10: dedicated desktop-app feature docs (OTP display, vault browsing UI on Mac/Windows/Linux), first-party screenshots or hands-on confirmation of parity with mobile, and resolution of the Electron/native-app criticism.

   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”
   • [community] “It would be nice to say goodbye to Electron, though... (referring to 1Password's desktop app).”
   • [community] “Mandatory 'No Linux client' comment :| Does anyone have any insight if this is a pure business decision or there's something holding them ba…”

   proof ↗⚑ flag

   Bitwarden~partialprobed5/10

   Evidence confirms TOTP codes sync across 'Bitwarden apps' and vault access is available via browser extension and CLI on a computer, implying desktop-class access, but no citation explicitly documents a native desktop application (GUI) separate from the browser extension/CLI. Missing for 10: explicit desktop app documentation, screenshots/feature parity claims, and independent confirmation that a first-class desktop GUI (not just extension/CLI) exists and works well.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “When you visit a website, the browser extension recognizes it and enters matching credentials from your vault into the login fields.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”

   proof ↗⚑ flag

Watch

1. everyday userRead my codes from my smartwatch without pulling out my phone

   weight 1 · round to 1Password
   1Password✓fullclaimed8/10

   1Password explicitly documents Apple Watch support for quickly looking up saved information including one-time passwords, letting users read codes without pulling out their phone. This directly matches the story, though evidence is limited to Apple Watch (no mention of other smartwatch platforms like Wear OS) and lacks independent hands-on corroboration. Missing for 10: evidence of Android/Wear OS smartwatch support, independent user reviews confirming the watch OTP experience.

   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”

   proof ↗⚑ flag

   Bitwarden—none0/10

   The evidence pack covers TOTP generation, syncing, browser extension, CLI, and API features, but contains no mention of a smartwatch app, Wear OS/watchOS companion, or any glanceable code display for wearables. This is a fair capability question for a password manager with a built-in authenticator, but no evidence shows it is delivered.

   ⚑ flag

Backup

1. security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented

   weight 3 · round to Bitwarden
   1Password—none0/10

   The evidence pack contains no documentation of 1Password's end-to-end encryption architecture, Secret Key design, or zero-knowledge claims for vaults/backups — it only covers CLI/SDK/Connect/SSH tooling and unrelated community commentary on UX and pricing. Without any citation describing the encryption design or vendor-key-never-held guarantee, this axis is unevidenced.

   ⚑ flag

   Bitwarden~partialclaimed4/10

   Docs confirm Bitwarden supports vault export/import and mention an 'encrypted exports' option (bitwarden-docs-5, bitwarden-docs-6, bitwarden-docs-16), implying some backups can be encrypted, but no evidence pack item documents the underlying encryption design, key derivation, or explicitly states the vendor cannot access backup contents. missing for 10: a linked security whitepaper or architecture doc describing zero-knowledge key management for exports, explicit vendor-can't-decrypt-backups statement, and independent verification of the encrypted export format.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”

   proof ↗⚑ flag

Multi device

1. everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically

   weight 2 · round to 1Password
   1Password✓fullcommunity6/10

   Docs show 1Password stores and retrieves one-time-passwords (tokens) across the browser, Apple Watch, and other apps (docs-20, docs-19/24, docs-21), implying that the same vault (and thus tokens) is accessible from phone, tablet, and desktop, and a community comment confirms 'desktop and mobile work great' (comm-9), suggesting real-world cross-device consistency. However none of the evidence explicitly describes the automatic sync mechanism or confirms real-time consistency across all three device types simultaneously. Missing for 10: explicit documentation of the cloud-sync architecture ensuring instant multi-device consistency, and independent testing/benchmarks of sync latency or conflict handling.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “1Password lets you easily sign in to sites, use suggested passwords, and find what you need – all without leaving your browser.”
   • [community] “I've used 1password for years and so far haven't had any problem, all apps (desktop and mobile) work great, but I don't understand why they …”

   proof ↗⚑ flag

   Bitwarden!disputedcontradicted6/10

   Bitwarden's docs describe cloud-based vault sync (TOTP codes staying synchronized across apps, passkeys usable across browser extension and mobile apps, auto-fill working consistently) which underlies cross-device availability of stored items (bitwarden-docs-2, bitwarden-docs-4, bitwarden-docs-12). However, a hands-on community report describes losing a generated password due to sync failures on bad connections, calling it 'quite common' (bitwarden-comm-9), directly contradicting the claim of seamless automatic sync. missing for 10: independent verification of reliable real-time sync across phone/tablet/computer simultaneously, and resolution/acknowledgment of the reported data-loss-on-sync issue.

   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [claimed-docs] “When you visit a website, the browser extension recognizes it and enters matching credentials from your vault into the login fields.”
   • [community] “I tried switching to Bitwarden and forced myself to live with it for 3 months. I gave up when it lost generated password. Apparently it is q…”

   proof ↗⚑ flag

Recovery

1. everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device

   weight 3 · round to Bitwarden
   1Password—none0/10

   The evidence pack covers 1Password's password/OTP storage, sync, import/export between apps, SSH/passkey features, and developer tooling, but contains no documentation of a lost-device recovery path (e.g., Emergency Kit, Secret Key re-enrollment, account recovery flow) that would restore an everyday user's tokens on a new device after losing their phone. Missing for 10: documented device-loss/account-recovery procedure, evidence of Secret Key or Emergency Kit restoration flow, any confirmation that OTPs specifically survive a lost-device scenario.

   ⚑ flag

   Bitwarden~partialcommunity6/10

   Bitwarden's docs show that TOTP codes are synced across the Bitwarden apps (docs-2) and that vault data (including logins) can be exported/imported to restore to a new install (docs-5, docs-6), which together give a de facto path to recover accounts/tokens on a new device after losing a phone. However there is no explicit 'lost my phone' recovery guide, and community reports mention TOTP/sync reliability problems (bitwarden-comm-12, bitwarden-comm-9) that add real-world caveats. Missing for 10: a dedicated 'device loss/account recovery' doc, evidence of automatic cloud vault sync restoring a fresh install without manual export/import, and confirmation that community-reported sync/TOTP glitches don't block this flow.

   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”
   • [community] “I always enjoyed the value that Bitwarden provides: free to use, password generator, and a vault to keep other texts. But somehow I never go…”
   • [community] “I tried switching to Bitwarden and forced myself to live with it for 3 months. I gave up when it lost generated password. Apparently it is q…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces

   weight 2 · round drawn
   1Password✓fullprobed7/10

   1Password documents multiple programmatic surfaces (CLI, SDKs in Go/JS/Python, Connect Servers REST API, Service Accounts) explicitly for 'Automate item management: Programmatically manage items in your 1Password account,' which covers creating and updating vault entries including credentials. These are official, well-documented interfaces suitable for agent-driven automation. Missing for 10: an explicit documented example/field reference for seeding TOTP secrets via these APIs, and independent/hands-on verification that write operations (create/update, not just read) work reliably in practice.

   • [claimed-docs] “Automate item management: Programmatically manage items in your 1Password account.”
   • [claimed-docs] “1Password SDKs allow you to build integrations that programmatically interact with 1Password using Go, JavaScript, or Python.”
   • [claimed-docs] “1Password Connect Servers allow you to securely access your 1Password items and vaults in your company's apps and cloud infrastructure using…”
   • [claimed-docs] “1Password Service Accounts help automate secrets management in your applications and infrastructure without the need to deploy additional se…”
   • [claimed-docs] “1Password CLI brings 1Password to your terminal. Learn how to install the CLI, then integrate it with your 1Password app and sign in with To…”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official op CLI is packaged in Homebrew as the 1password-cli cask ('Command-line interface for 1Pas…”

   proof ↗⚑ flag

   Bitwarden✓fullprobed7/10

   Bitwarden documents multiple programmatic surfaces for vault management — the fully-featured CLI (which supports create/edit item operations and a `bw serve` mode exposing a local REST API for TOTP/items), a personal API key explicitly recommended for 'automated workflows' and 'external applications,' and an official first-party MCP server that completed a live stdio handshake, giving agents a documented path to create and update vault entries including TOTP secrets. Missing for 10: an explicit doc/code example showing the exact CLI/API call syntax for adding a TOTP field to a new item, and independent (non-vendor) confirmation that an agent successfully created/updated entries end-to-end via these surfaces.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “official CLI documented at https://bitwarden.com/help/cli/”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

Policy

1. it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app

   weight 1 · round to Bitwarden
   1Password—none0/10

   The evidence pack covers CLI/SDK developer tooling, personal password features, import/export, and community sentiment, but contains no documentation of admin console policies for enforcing app lock, restricting export, or mandating master password strength across an organization. This axis clearly applies to a business password manager, but no supporting evidence is present.

   ⚑ flag

   Bitwarden~partialclaimed3/10

   The evidence only shows that Bitwarden's Public API lets organizations manage 'members, collections, groups, event logs, and policies,' implying policy management exists, but there is no documentation shown for specific policies like app-lock enforcement, export restriction, or master-password strength requirements. Missing for 10: explicit documentation of individual policy types (master password strength, disable personal vault export, require app lock/timeout), admin console UI screenshots or workflow, and any hands-on confirmation that these policies are enforced across all members' apps.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”

   proof ↗⚑ flag

Sharing

1. it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control

   weight 2 · round to Bitwarden
   1Password—none0/10

   The evidence pack covers 1Password's developer tooling (CLI, SDKs, Connect, SSH agent) and personal features (Watchtower, OTP storage, passkeys) but contains no mention of shared vaults, collections, group/per-member permissions, or admin controls for team sharing of TOTP items. Missing for 10: documentation of shared vaults/collections, per-member access control settings, or admin console screenshots showing granular sharing permissions for TOTP logins.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”

   proof ↗⚑ flag

   Bitwarden~partialcommunity6/10

   Bitwarden's docs confirm built-in TOTP generation/sync (bitwarden-docs-1, bitwarden-docs-2) and its Public API supports managing organization members, collections, and groups (bitwarden-docs-8), and a real-world team user cites 'safer account sharing, including 2FA' as a killer feature (bitwarden-comm-8). However, the evidence pack lacks explicit documentation tying TOTP fields to collection-level per-member permissions/access control, so the granular sharing mechanics aren't directly evidenced. Missing for 10: dedicated docs on collection permission levels (view/edit/manage) applied to TOTP-containing items, and independent confirmation of this exact workflow.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [community] “We use BitWarden at work, paying $3600/year. Their product is great for teams... The killer feature for me has been safer account sharing, i…”

   proof ↗⚑ flag

Enrollment

1. everyday userScan a QR code and immediately start generating TOTP codes for a new account

   weight 3 · round to Bitwarden
   1Password~partialclaimed4/10

   Docs confirm 1Password stores and generates one-time passwords for two-step verification (docs-20, docs-19/24), which implies TOTP support, but no evidence explicitly describes the QR-code scanning flow for adding a new TOTP account. Missing for 10: explicit documentation or screenshots of QR code scanning to add a new TOTP entry, and independent/hands-on confirmation of the immediate code-generation experience.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”

   proof ↗⚑ flag

   Bitwarden~partialcommunity6/10

   Docs confirm Bitwarden's integrated authenticator automatically generates rotating TOTP codes once a key/QR is added to a login item (bitwarden-docs-1, bitwarden-docs-13), which covers the core capability, but the pack lacks explicit documentation of the actual camera-scan-QR flow for a brand-new account (only QR-based *import* from another authenticator app is documented, bitwarden-docs-3/14). One community report also describes difficulty getting TOTP working at all (bitwarden-comm-12), though it's anecdotal and not a concrete reproducible failure. missing for 10: explicit doc/screenshot of scanning a QR to add a brand-new TOTP secret (not import), and independent hands-on confirmation that codes generate immediately after scan.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Let's start your Bitwarden browser extension journey by adding a new login item to your vault”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [community] “I always enjoyed the value that Bitwarden provides: free to use, password generator, and a vault to keep other texts. But somehow I never go…”

   proof ↗⚑ flag

Offline

1. power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes

   weight 2 · round to 1Password
   1Password!disputedcontradicted3/10

   1Password does store and display OTP codes (docs-20, docs-24), but the product fundamentally requires a 1Password account/subscription and cloud-synced vault to unlock and view items — community evidence explicitly states 1Password has moved away from local, non-cloud vault storage ('no native apps, no local vault storage... The VC rot has already set in'), directly contradicting the 'no vendor account required' claim. Missing for 10: any first-party or independent confirmation of a fully offline mode with no account signup/sync dependency, and no evidence disputes this gap.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [community] “My 1Password installation is grandfathered from a time when it was just a standalone app, without subscription. Will it just stop working on…”
   • [community] “Use a tiny portion of that to continue support for local, non-cloud-based vault files please.”
   • [community] “Except they have already started to diminish what used to make 1P great. We now get no native apps, no local vault storage, no upfront payme…”

   proof ↗⚑ flag

   Bitwarden—none0/10

   Bitwarden's TOTP generation is tightly coupled to the vault: codes are stored and computed inside a Bitwarden vault item, which requires a Bitwarden account/vault (docs-1, docs-2) and typically syncs across the vendor's cloud infrastructure. No evidence describes a standalone, account-free offline TOTP mode; self-hosting (docs-10) still requires an account/server setup, not a vendor-free path. missing for 10: evidence of a no-account, no-vendor-server offline TOTP mode; confirmation that code generation works without ever creating/authenticating a Bitwarden account.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “This article will walk you through the procedure to install and deploy Bitwarden to your own Linux server.”

   proof ↗⚑ flag

Organization

1. power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away

   weight 2 · round to Bitwarden
   1Password~partialclaimed3/10

   Docs confirm 1Password stores and quickly surfaces one-time passwords (including via Apple Watch) and flags login issues via Watchtower, but the pack provides no evidence of folder/tag/group organization, dedicated search, or service icons for TOTP entries specifically. missing for 10: explicit search functionality, folder/tag/group organization for TOTP items, service icon display for OTP entries, independent hands-on validation of organizing many tokens.

   • [claimed-docs] “Learn how to use 1Password to store and quickly access your one-time passwords when you turn on two-step verification for a website.”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords, bank account details, pa…”
   • [claimed-docs] “Use 1Password on your Apple Watch to quickly look up information: credit card numbers and PINs, one-time passwords”
   • [claimed-docs] “Watchtower tells you about breaches, weak passwords, duplicate items, and other security problems with the items you have saved in 1Password…”

   proof ↗⚑ flag

   Bitwarden~partialclaimed4/10

   Docs confirm Bitwarden generates and syncs TOTP codes across devices and lets users import/export authenticator data (bitwarden-docs-1, bitwarden-docs-2, bitwarden-docs-3), which supports storing many tokens, but nothing in the evidence pack speaks to search, folders/groups, or service icons specifically for TOTP entries — organization is only implied through the general vault (login) item structure. missing for 10: explicit documentation of folder/collection organization for TOTP items, search functionality across TOTP entries, and service icon display for stored codes.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”

   proof ↗⚑ flag

Variants

1. power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths

   weight 2 · round drawn
   1Password—none0/10

   The evidence only confirms basic one-time password storage (docs-20, docs-19) but contains no mention of Steam Guard tokens, HOTP counter-based codes, or custom period/digit-length TOTP support. Missing for 10: any documentation of Steam Guard support, HOTP counter handling, or custom period/digit configuration.

   ⚑ flag

   Bitwarden—none0/10

   The evidence only describes Bitwarden's standard TOTP support (six-digit SHA-1 codes rotating every 30 seconds) with no mention of Steam Guard tokens, HOTP counters, or custom periods/digit lengths anywhere in the docs, community, or probe items.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”

   proof ↗⚑ flag