Bitwarden vs 2FAS

Agent access

1. ai-native userPoint an agent at llms.txt or agent-oriented docs

   weight 2 · round drawn
   Bitwarden✓fullprobed9/10

   Bitwarden serves a live llms.txt at bitwarden.com/llms.txt (HTTP 200) with structured content, and help pages ship real per-page markdown mirrors (e.g., cli.md) confirming genuine agent-oriented documentation rather than a stub. This is directly confirmed by runtime probes, not just claims. Missing for 10: no independent third-party corroboration of an agent actually consuming these docs end-to-end in a workflow.

   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”
   • [probe] “PROBE runtime (recorded 2026-09-15): bitwarden.com serves a live llms.txt ('# Bitwarden — The most trusted open source password manager...')…”

   proof ↗⚑ flag

   2FAS✓fullprobed9/10

   Direct probe confirms a live llms.txt with an explicit 'For AI agents' section, plus modular per-section llms files, llms-full.txt, per-page .md mirrors, and Accept: text/markdown rendering — strong first-party agent-oriented docs infrastructure verified via runtime probes. Missing for 10: no independent/community corroboration of agents actually consuming these docs in practice.

   • [probe] “PROBE llms.txt: HTTP 200 at https://2fas.com/llms.txt # 2FAS — Password Manager and Authenticator > Local-first password manager (2FAS Pass…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

2. ai-native userRun the product headlessly / in CI for automation

   weight 2 · round to Bitwarden
   Bitwarden✓fullprobed8/10

   Bitwarden ships an official CLI with API-key authentication explicitly documented as suitable for automated workflows/CI, plus a Public API for org automation and a headless 'bw serve' mode confirmed at runtime. missing for 10: no CI-specific tutorial/example pipeline (e.g., GitHub Actions) in evidence, and one community report notes CLI 'bw list' unexpectedly dumping plaintext secrets, a minor safety caveat for automation use.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a mobile authenticator/password manager with no CLI, headless mode, or API for CI/automation; the product's own llms.txt explicitly declares 'Public API: None' and is local-first by design, meaning it cannot be run headlessly or scripted in CI.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

3. ai-native userConnect an agent via an official MCP server

   weight 3 · round to Bitwarden
   Bitwarden✓fullprobed9/10

   Bitwarden ships a first-party, GPL-3.0 MCP server (bitwarden/mcp-server) published to npm, and a runtime probe confirms it completes a full stdio handshake, showing it works as documented rather than just being an announcement. Missing for 10: independent third-party review of the MCP server's tool set/security beyond the vendor probe.

   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a password/2FA manager, not an agent, so an MCP server axis could plausibly apply to its ecosystem; however evidence explicitly states 'Public API: None' and no OpenAPI/MCP endpoint exists, with probes confirming no API surface for agents to connect to.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

4. ai-native userUse an official CLI

   weight 2 · round to Bitwarden
   Bitwarden✓fullprobed9/10

   Bitwarden ships a documented, fully-featured official CLI (bw) with vault management, API key auth for automated workflows, and a runtime-verified 'bw serve' mode exposing a local REST API well-suited to agentic/AI use. missing for 10: independent third-party benchmarking of agent integration quality beyond one community anecdote about plaintext output behavior.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “official CLI documented at https://bitwarden.com/help/cli/”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a mobile/browser 2FA and password-manager app with no evidence of an official CLI; docs explicitly note 'Public API: None' and no CLI tool is mentioned anywhere in the evidence pack.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

5. ai-native userDrive the product through a documented public API

   weight 3 · round to Bitwarden
   Bitwarden✓fullprobed8/10

   Bitwarden documents a Public API for organization management (bitwarden-docs-8), a personal API key for automated/programmatic access (bitwarden-docs-9), and a full-featured CLI (bitwarden-docs-7, bitwarden-probe-4) with a documented `bw serve` REST mode enabling agent-driven vault access (bitwarden-probe-rt-1); this constitutes a documented public API surface an AI-native user could drive. missing for 10: a public OpenAPI/swagger spec resolves 404 on probed endpoints (bitwarden-probe-2), and one community report flags a CLI safety/UX issue (bitwarden-comm-13) showing rough edges in automation ergonomics.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS explicitly states 'Public API: None' in its own llms.txt, and OpenAPI/swagger probes all return 404, confirming there is no documented public API to drive the product programmatically — it is local-first by design.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

6. ai-native userIssue scoped/least-privilege API credentials for an agent

   weight 2 · round to Bitwarden
   Bitwarden~partialprobed4/10

   Bitwarden documents a personal API key for CLI/automated workflows and a Public API/CLI (including `bw serve` and an official MCP server) that an agent could use, but there's no evidence of fine-grained, least-privilege scoping (e.g., read-only, per-item, or per-collection API keys) — the personal API key and CLI access appear to grant broad vault access rather than scoped permissions, and a hands-on report shows `bw list` dumping full plaintext secrets rather than a restricted subset. missing for 10: documented scoped/restricted API key types, per-agent permission grants, or evidence that MCP/CLI access can be limited to specific vault items rather than the whole vault.

   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a local-first authenticator/password manager with no public API; its own llms.txt explicitly states 'Public API: None' and no agent-callable endpoint for token generation, so there is no mechanism to issue scoped/least-privilege API credentials for an agent.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

7. ai-native userBuild against official SDKs

   weight 2 · round to Bitwarden
   Bitwarden~partialprobed4/10

   Evidence shows Bitwarden exposes a Public API, CLI, personal API keys for automation, and an official MCP server (all of which an AI-native builder could integrate against), but there is no evidence of a dedicated, language-specific 'official SDK' (e.g., a bitwarden/sdk repo) and the OpenAPI/swagger spec probes all returned 404, suggesting no machine-readable API contract is published. missing for 10: explicit official SDK repositories/language bindings, published OpenAPI spec, independent developer corroboration of SDK usage.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”
   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS explicitly declares 'Public API: None' and has no OpenAPI/SDK endpoints; probes confirm no SDK or API surface exists for developers to build against.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

8. ai-native userSubscribe to events via webhooks

   weight 2 · round drawn
   Bitwarden—none0/10

   Bitwarden's evidence covers event logs via the Public API and a CLI/MCP server for vault access, but nothing describes webhook subscriptions for events—no documented webhook endpoints, registration API, or push-event mechanism.

   ⚑ flag

   2FAS—none0/10

   2FAS is explicitly local-first with no public API ('Public API: None' per its own llms.txt), and no evidence anywhere mentions webhooks or event subscriptions; this is a password/2FA app, not an event-driven platform.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Agentic features

1. ai-native userSet up automations that run autonomously in the background

   weight 2 · round drawn
   Bitwarden—none0/10

   Bitwarden offers CLI/API/MCP server access that agents could use, but there is no evidence of a mechanism for setting up autonomous, scheduled, or background-running automations (e.g., triggers, workflows, cron-like jobs) — it only provides interfaces for on-demand vault access. missing for 10: any documented scheduling/trigger/workflow automation feature, evidence of background/autonomous execution, or vendor claims of persistent automation setup.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

2. ai-native userOperate the product with natural-language commands

   weight 2 · round to Bitwarden
   Bitwarden✓fullprobed8/10

   Bitwarden ships an official MCP server (bitwarden/mcp-server) that completed a live stdio handshake, letting AI agents/assistants issue natural-language commands to manage the vault, backed by a full-featured CLI and llms.txt for AI-friendly docs. Missing for 10: no independent hands-on demonstration of a natural-language command actually retrieving/creating vault items via the MCP server, and community feedback flags CLI output risks (e.g., plaintext dumps) that complicate safe agentic use.

   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Api quality

1. ai-native userExplore an interactive API reference with runnable examples

   weight 2 · round drawn
   Bitwarden—none0/10

   Bitwarden documents a Public API for org management (bitwarden-docs-8) but there is no evidence of an interactive API reference with runnable examples (e.g., Swagger/OpenAPI explorer); a direct probe for openapi.json/swagger.json endpoints returned 404 on all candidate paths (bitwarden-probe-2), indicating no such interactive reference is exposed.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence of an interactive API reference or runnable examples; openapi probe returned 404s across all candidate paths and llms.txt explicitly states 'Public API: None' since 2FAS is local-first with no agent-callable endpoints.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

2. ai-native userDownload a machine-readable API spec (OpenAPI or equivalent)

   weight 2 · round drawn
   Bitwarden—none0/10

   Bitwarden documents a Public API and CLI, but a probe for common OpenAPI/Swagger spec URLs (openapi.json, swagger.json, .well-known/openapi.json) all returned 404, and no evidence pack item shows a downloadable machine-readable API spec. Missing for 10: any documented OpenAPI/Swagger file, spec download link, or API reference generator output.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”

   proof ↗⚑ flag

   2FAS—none0/10

   Direct probes for OpenAPI/swagger specs all returned 404, and the product's own llms.txt explicitly states 'Public API: None,' confirming no machine-readable API spec is offered.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

3. ai-native userRely on versioned APIs with a documented deprecation policy

   weight 2 · round drawn
   Bitwarden—none0/10

   Bitwarden documents a Public API and CLI/personal API key access, but there is no evidence of API versioning scheme or a documented deprecation policy; probes for an OpenAPI spec (bitwarden-probe-2) all returned 404s, and no docs mention version headers, breaking-change policy, or sunset timelines.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE openapi: all candidate paths 404 (https://bitwarden.com/openapi.json, https://bitwarden.com/swagger.json, https://bitwarden.com/api/op…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS explicitly declares 'Public API: None' and has no OpenAPI/swagger endpoints (all probes 404), meaning there is no versioned API at all, let alone a documented deprecation policy.

   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

1. ai-native userPerform bulk operations across many items at once

   weight 2 · round to Bitwarden
   Bitwarden~partialcommunity6/10

   The CLI (bw list/create/edit/delete) and Public API expose scriptable, item-level access that can be chained for bulk operations, and import/export functions handle whole-vault bulk transfers of many items at once; community evidence (bw list dumping the entire vault) confirms bulk read actually works. However, there is no first-party documentation of a dedicated bulk-edit/bulk-tag/bulk-delete command or batch endpoint — bulk operations require the user to script them themselves rather than a built-in bulk API. Missing for 10: documented native bulk-update/bulk-delete commands, batch API endpoints for many items, and independent hands-on confirmation of large-scale automated edits succeeding.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a local-first authenticator/password manager with no public API (explicitly declared 'Public API: None'), and no evidence of bulk operations across items (e.g., batch import/export beyond single-file import, bulk edit/delete of tokens or vault entries) that an AI agent could invoke. There's no scripting, CLI, or API surface for programmatic bulk actions.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

1. ai-native userDo everything through the API that I can do in the UI

   weight 2 · round to Bitwarden
   Bitwarden~partialprobed6/10

   Bitwarden ships a fully-featured CLI and a Vault Management API (`bw serve`) covering item/vault CRUD, TOTP retrieval, and org management via a Public API and personal API key for automated workflows, giving strong but not fully documented parity with the UI. There's no explicit vendor claim or evidence that every UI feature (e.g., passkey autofill, browser-context auto-fill, vault health reports) is exposed via API/CLI, and a hands-on report shows the CLI's `bw list` behaves differently than expected (dumping all secrets) rather than mirroring UI workflows cleanly. missing for 10: explicit API/CLI equivalents for passkey autofill and browser-based auto-fill, API access to vault health reports, and a documented feature-parity statement.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS's own llms.txt explicitly declares 'Public API: None' and probes confirm no OpenAPI/swagger spec exists at any candidate path, meaning there is no API surface at all through which a user could replicate UI actions.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExport all of my data in open formats and leave

   weight 3 · round to Bitwarden
   Bitwarden✓fullclaimed9/10

   Bitwarden's docs explicitly support exporting full vault data (logins, notes) for backup or transfer, plus separate authenticator/TOTP export in open formats (JSON), and CLI/API access for automated bulk export. This directly satisfies the 'export all data in open formats and leave' story with strong first-party documentation. Missing for 10: no independent/hands-on confirmation of export format fidelity or completeness verification by a third party.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS explicitly supports exporting/backing up data (encrypted export files, self-host freedom, import/export in free tier) and even imports from competitor formats, showing some portability. However, there's no evidence the export format itself is documented as an open/standard schema (e.g., JSON spec or standard otpauth migration format), and the backup is typically encrypted for 2FAS's own re-import rather than a documented open format for third-party tools. missing for 10: explicit open/standard export format spec, independent confirmation the exported file is usable outside 2FAS ecosystem, and details on the exact format encoding.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

3. ai-native userRead the product's source under an open license

   weight 2 · round to 2FAS
   Bitwarden~partialprobed6/10

   Community evidence and the MCP server repo confirm Bitwarden ships components under open licenses (e.g., bitwarden/mcp-server is GPL-3.0) and is broadly known/marketed as 'the most trusted open source password manager,' and users cite valuing its open client source. However, the same evidence documents a real controversy where Bitwarden relicensed its SDK away from a fully open license, only reversing course after backlash — a concrete counter-example to unconditional openness. missing for 10: explicit license file/repo evidence for the core vault clients, resolution details confirming all components are now uniformly open-licensed, independent audit confirming no remaining non-open components.

   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [community] “Props for them to step in the right direction, it wasn’t obvious at all for a few days what they would do (re: SDK relicensing controversy).”
   • [community] “Thank you to Bitwarden for relicensing back to Free/Open License... I no longer recommend Bitwarden for normal people because the built-in p…”
   • [community] “I’m relieved... I hope they realized that being FOSS is their moat... I’m still not sure how I feel about them now. Trust in the company has…”
   • [community] “I use BitWarden because I'd never trust a password manager with closed source clients... Needless to say I move to the next ethical e2ee pas…”
   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly points to its GitHub repositories for both the auth app and browser extension, describing itself as open-source, and the probe confirms 'open-source two-factor authentication' positioning with 'Freedom to self-host your data.' missing for 10: explicit license name (e.g., MIT/GPL) is not stated in evidence, and no independent audit confirming license terms.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
   • [claimed-docs] “Freedom to self-host your data”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

4. ai-native userSelf-host the core product

   weight 3 · round to Bitwarden
   Bitwarden✓fullprobed9/10

   Bitwarden provides official, well-documented on-premise/self-hosting instructions for Linux servers, and it is open-source, aligning strongly with an AI-native user's openness needs. missing for 10: independent hands-on verification of self-hosted deployment specifically (evidence is docs-only, not community confirmation of self-hosting success).

   • [claimed-docs] “This article will walk you through the procedure to install and deploy Bitwarden to your own Linux server.”
   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS explicitly markets 'Freedom to self-host your data' and lets users choose their own cloud/WebDAV/external drive storage for vaults, and the core apps are open-source on GitHub for self-hosting/auditing. However, this is self-hosting of data/storage, not the full core service (no self-hostable server/backend, no API for self-managed infrastructure), and community commentary questions how this differs meaningfully from server-reliant competitors. Missing for 10: a self-hostable backend/server component, documentation of running the whole product on own infrastructure, and independent confirmation that self-hosted storage removes all vendor dependency.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Storage

1. everyday userThe app stores passkeys and signs me into websites and apps with them, not just TOTP codes

   weight 3 · round to Bitwarden
   Bitwarden✓fullclaimed8/10

   Bitwarden documents storing passkeys in the vault and using the browser extension or mobile apps to autofill/sign in with them across websites and apps, going beyond TOTP-only support (bitwarden-docs-4), which aligns directly with the story's requirement of passkey-based sign-in, not just TOTP codes. Missing for 10: independent/hands-on user reports specifically confirming passkey sign-in reliability (community evidence only discusses TOTP/autofill issues, not passkeys) and detail on cross-platform (desktop app) passkey support beyond browser/mobile.

   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a TOTP authenticator (2FAS Auth) and separately a password manager (2FAS Pass); evidence covers token/2FA codes, vault items, and password autofill, but nothing describes passkey (WebAuthn/FIDO2) storage or passkey-based sign-in to websites/apps.

   ⚑ flag

Sync

1. power userMy passkeys sync across ecosystems — iOS, Android, Windows, Linux, browsers — instead of being locked to one platform vendor

   weight 2 · round to Bitwarden
   Bitwarden~partialclaimed6/10

   Bitwarden explicitly stores passkeys in the vault and lets the browser extension and mobile apps autofill them across apps and sites, which is the platform-agnostic model (unlike Apple/Google's device-locked passkey sync) [bitwarden-docs-4]. However, the docs only call out browser extension and mobile apps, not desktop apps on Windows/Linux specifically, and there's no independent hands-on confirmation of passkey sync working seamlessly across all five named platforms. Missing for 10: explicit desktop (Windows/Linux) passkey autofill documentation, and independent/community verification of cross-platform passkey sync reliability.

   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence pack describes 2FAS Auth's 2FA token sync and 2FAS Pass's password vault sync (iCloud, Google Drive, WebDAV, browser extension) but contains no mention of 'passkey' or WebAuthn/FIDO2 credential support or storage anywhere. Since passkey sync is a distinct capability from OTP tokens or password items, there's no evidence this product delivers it.

   ⚑ flag

Export

1. power userExport all my TOTP secrets in an open, readable format and leave for another app whenever I choose — no lock-in

   weight 3 · round to 2FAS
   Bitwarden~partialclaimed4/10

   Bitwarden documents a general vault export (JSON/CSV) for 'logins and notes' and back-up/transfer purposes, but the evidence never explicitly confirms that TOTP secrets are included in that export or specifies an open, human-readable format for them — only import paths for other authenticators (Google Authenticator QR, LastPass JSON, 2FAS) are detailed, which is the opposite direction (lock-in mitigation on entry, not exit). Missing for 10: explicit confirmation that TOTP seeds are present in the standard export file, documentation of the exact readable TOTP export format, and any independent/hands-on verification that exported TOTP secrets can be reimported elsewhere.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   2FAS explicitly supports imports from other apps (Aegis, Raivo, Google Authenticator, etc.) and offers 2FAS export files for backup/sync, with optional password-based encryption of backups. However, evidence doesn't confirm the export format is an open/readable standard (e.g., plaintext otpauth URIs or documented JSON schema) rather than a proprietary encrypted blob, and there's no explicit statement about exporting TO other apps' formats for migration away from 2FAS. missing for 10: documented open/standard export format spec, explicit 'export to other apps' migration path, independent confirmation the export file is human-readable/portable.

   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Import

1. power userImport tokens in bulk from other authenticator apps instead of re-enrolling every account by hand

   weight 2 · round to Bitwarden
   Bitwarden✓fullclaimed8/10

   Bitwarden's official docs explicitly support bulk import of TOTP/authenticator tokens from Google Authenticator (QR), LastPass Authenticator (JSON), and 2FAS (.2fas) backups, directly enabling power users to migrate accounts without re-enrolling each one by hand. This is a first-party, documented dedicated import flow, not a workaround. missing for 10: independent hands-on confirmation of the bulk import UX working smoothly, and coverage of additional popular authenticator export formats (e.g., Authy, Microsoft Authenticator).

   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   2FAS docs explicitly list bulk import support from Aegis, Raivo, LastPassAegis, Stratum, and Google Authenticator, directly supporting the power-user portability story. However, the list is limited to a handful of named apps, no evidence of a generic/universal import format (e.g., OTP URI batch, QR export from arbitrary apps), and no independent hands-on verification of the import process working smoothly. Missing for 10: broader import coverage beyond five named apps, independent/community confirmation of successful bulk import, and details on edge cases (e.g., failed imports, partial data loss).

   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”

   proof ↗⚑ flag

Migration

1. everyday userMoving to a new phone transfers all my tokens in one guided step

   weight 2 · round to 2FAS
   Bitwarden~partialcommunity6/10

   Bitwarden's cloud vault syncs logins, passkeys, and TOTP codes across devices automatically (docs-1, docs-2, docs-4), so logging into a new phone with the same account would pull in tokens without manual export/import — effectively delivering the outcome. However, no evidence describes a dedicated 'guided' new-device setup wizard, and one community report (bitwarden-comm-9) describes lost generated data tied to connectivity issues, raising reliability caveats for a seamless one-step transfer. Missing for 10: documented guided device-migration flow/wizard, and independent hands-on confirmation that TOTP/passkeys transfer flawlessly to a new phone.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [community] “I tried switching to Bitwarden and forced myself to live with it for 3 months. I gave up when it lost generated password. Apparently it is q…”

   proof ↗⚑ flag

   2FAS✓fullclaimed7/10

   2FAS Auth supports iCloud/Google Drive sync and encrypted export/backup files, letting a user restore tokens on a new device by simply enabling sync or importing the backup file, and 2FAS Pass has a dedicated recovery flow for restoring the vault on a different device via iCloud/Google Drive backups. missing for 10: a documented single-tap 'migrate to new phone' wizard UI and independent hands-on confirmation of the transfer experience.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”

   proof ↗⚑ flag

1. ai-native userChoose where my data is stored (region/residency)

   weight 2 · round to 2FAS
   Bitwarden—none0/10

   No evidence pack item mentions data residency, region selection, or self-hosting for regional compliance beyond a generic on-premise Linux install guide, which does not address choosing a storage region. Missing for 10: any documentation of region/data-residency selection (e.g., EU vs US data centers), enterprise residency options, or explicit control over where vault data is stored.

   ⚑ flag

   2FAS~partialcommunity7/10

   2FAS is local-first: users choose to keep data on-device, in their own iCloud/Google Drive, WebDAV, or fully self-hosted, giving strong control over storage location (2fas-docs-5, 2fas-docs-14, 2fas-docs-17). This satisfies the spirit of data residency choice, though it's not a formal 'select region/datacenter' feature and relies on user-configured third-party clouds rather than a first-party regional hosting option. Missing for 10: explicit region/datacenter selection controls, independent verification of self-host setup beyond marketing pages.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

2. ai-native userPrevent my data from being used to train AI models

   weight 3 · round to 2FAS
   Bitwarden—none0/10

   The evidence pack contains no documentation, policy statement, or setting from Bitwarden addressing whether vault data or user data is used to train AI models, nor any opt-out mechanism for such use. This is a fair privacy-posture question for a SaaS handling sensitive personal data, but nothing in the pack confirms or denies a stance, so it cannot be credited as delivered.

   ⚑ flag

   2FAS~partialprobed4/10

   2FAS is local-first with explicit 'no telemetry' claims and no public API for data collection (2fas-probe-rt-1, 2fas-probe-rt-2), which implies user data isn't centrally harvested and thus couldn't feed AI training pipelines. However, there is no explicit statement addressing AI model training or an opt-out policy specifically. Missing for 10: explicit AI-training data policy/opt-out statement, independent confirmation that no data is ever sent to third-party AI services.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

3. ai-native userControl data retention and deletion

   weight 2 · round to 2FAS
   Bitwarden~partialcommunity3/10

   Bitwarden docs show users can export their vault data (for backup or account transfer) and community evidence indicates an account-deletion path exists (export → delete account → recreate), but there is no dedicated, first-party documentation on data retention policies, granular deletion controls, or how these apply to AI/agent access (e.g., MCP server or CLI-served vault data). Missing for 10: explicit retention policy documentation, dedicated account/vault deletion docs, and clarity on data lifecycle when accessed via CLI/MCP for AI agents.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”
   • [community] “BitWarden has lost the trust. There was a blocker bug on iOS, they went radio silent on follow-ups, and their fix suggestion was 'export dat…”

   proof ↗⚑ flag

   2FAS~partialprobed6/10

   2FAS gives users explicit control over where data is stored (own cloud, external drive, self-hosting) and confirms no telemetry/tracking, which supports retention control (2fas-docs-5, 2fas-docs-14, 2fas-probe-rt-2). However there is no explicit documentation of a deletion/erasure workflow, data-retention policy, or account-deletion mechanism beyond implied local file control. Missing for 10: explicit data deletion/right-to-erasure documentation, retention period policy, and independent confirmation that deleting local/cloud copies fully removes data.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”

   proof ↗⚑ flag

4. ai-native userOpt out of telemetry and usage tracking

   weight 2 · round to 2FAS
   Bitwarden—none0/10

   The evidence pack contains no documentation, settings, or community reports describing a telemetry/usage-tracking opt-out control in Bitwarden clients, CLI, or self-hosted server. While the axis is fair to ask of any privacy-focused product, nothing here confirms such a toggle exists or how it works.

   ⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly states in its machine-readable pricing/docs that 2FAS Auth has 'no advertising, no telemetry,' meaning tracking is absent by design rather than requiring opt-out, and the product is positioned as local-first/open-source, reinforcing a privacy-first posture. Missing for 10: no explicit dedicated privacy-settings toggle documentation, and no independent audit confirming zero telemetry across 2FAS Pass as well as Auth.

   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

App lock

1. everyday userThe app itself locks behind biometrics or a PIN, so a borrowed phone doesn't expose my codes

   weight 2 · round to Bitwarden
   Bitwarden~partialcommunity3/10

   No official documentation in the evidence pack describes a PIN/biometric app-lock feature; the only signal is an indirect community comment implying fingerprint unlock already exists on some platforms but is missing on Linux, which weakly corroborates the capability without detailing scope or coverage. Missing for 10: first-party docs on biometric/PIN unlock, mobile-specific confirmation, and independent hands-on validation of the lock behavior.

   • [community] “Yeah it's nice and all but I wish they brought fingerprint auth to Linux already.”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence pack describes 2FAS Pass's tiered security and sync options, and confirms access to the browser extension/autofill must be approved in-app, but nowhere states that the 2FAS Auth or Pass app itself can be locked behind biometrics or a PIN to block access if the phone is borrowed. No docs or community evidence mention an app-lock/biometric-gate feature for the authenticator itself.

   • [claimed-docs] “2FAS Pass supports 3 Security Tiers for protecting your Items.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”

   proof ↗⚑ flag

Audits

1. security engineerThe vendor publishes independent security audits of the app and its sync protocol

   weight 2 · round drawn
   Bitwarden—none0/10

   No evidence pack items reference independent third-party security audits, penetration tests, or cryptographic/protocol reviews of Bitwarden's app or sync protocol; the pack only covers docs on features (TOTP, autofill, CLI, import/export) and community sentiment/complaints unrelated to audits. Missing for 10: published audit reports (e.g., Cure53), audit scope/dates, sync protocol review findings, remediation disclosures.

   ⚑ flag

   2FAS—none0/10

   Evidence shows only open-source code availability claims and general transparency messaging, with no mention of independent third-party security audits of the app or its sync protocol; community discussion even questions the trust model of cloud-based sync without referencing any audit report.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Monitoring

1. power userThe app warns me when a service I use is breached or a stored credential is weak, reused, or exposed

   weight 2 · round to Bitwarden
   Bitwarden~partialclaimed5/10

   Bitwarden's Vault Health Reports (docs-11/17) explicitly check for reused and weak passwords locally on the client, covering part of the story, but no evidence in the pack documents breach monitoring (e.g., known data-breach alerts) or an 'exposed passwords' check against breach databases. Missing for 10: evidence of breach/exposure alerts for compromised services, and any exposed-credential detection feature.

   • [claimed-docs] “Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault... Reports... are run locally on …”
   • [claimed-docs] “Vault health reports can help you evaluate the security of your Bitwarden individual or organization vault. Reports, such as the Reused Pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence of breach monitoring, weak/reused/exposed password detection, or security-posture alerts anywhere in the docs, community reports, or probes; 2FAS's evidence covers sync, tiers, self-hosting, and import/export but nothing about credential health warnings or breach alerts.

   ⚑ flag

Push

1. it adminPush-based sign-in includes phishing defenses — number matching, location context, and admin-enforced MFA policies

   weight 2 · round drawn
   Bitwarden—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

   2FAS—none0/10

   The axis applies to this product kind (peer products hold positive or none verdicts on this story), so lack of evidence for an applicable capability is "none", never "na". (na/none harmonized at arena bring-up — see pipeline/scripts/na-harmonize.ts.)

   ⚑ flag

Server

1. it adminSelf-host the sync server on my own infrastructure and keep every secret inside my perimeter

   weight 2 · round to Bitwarden
   Bitwarden✓fullclaimed8/10

   Bitwarden provides official documentation for installing and deploying the self-hosted server on a Linux server, keeping vault data on the admin's own infrastructure — the core of this story. Missing for 10: independent hands-on verification of a real-world self-hosted deployment and details on ongoing maintenance/upgrade complexity for self-hosted instances.

   • [claimed-docs] “This article will walk you through the procedure to install and deploy Bitwarden to your own Linux server.”

   proof ↗⚑ flag

   2FAS~partialcommunity4/10

   2FAS advertises 'freedom to self-host your data' and lets users choose where encrypted vault/token data lives (own cloud, WebDAV, external drive) rather than relying on 2FAS-hosted storage, which partially satisfies the perimeter-control need. However there is no evidence of an actual downloadable/self-hostable 'sync server' component (e.g. a Vaultwarden-style server binary) — it's more bring-your-own-storage for encrypted files/backups, and community commentary explicitly questions whether this differs meaningfully from relying on third-party server infrastructure. Missing for 10: a dedicated self-hosted sync-server artifact/deployment docs, and independent confirmation that all sync traffic stays fully within admin-controlled infra.

   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [claimed-docs] “Freedom to self-host your data”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Source

1. security engineerThe client apps are open source, so the code handling my seeds can be inspected and community-reviewed

   weight 2 · round to 2FAS
   Bitwarden~partialprobed6/10

   Bitwarden markets itself as 'the most trusted open source password manager' and community members explicitly cite open-source clients as the reason they trust it with secrets (bitwarden-probe-1, bitwarden-comm-15). However, the evidence also documents a real controversy where SDK code (used by clients) was briefly relicensed away from a fully open license before being reverted after community pressure, which shows scrutiny worked but also that openness has not always been airtight (bitwarden-comm-1, bitwarden-comm-3, bitwarden-comm-4). Missing for 10: direct links to client-app GitHub repos, explicit confirmation that seed/TOTP-handling code specifically is open and audited, and independent third-party code audits corroborating the open-source claim.

   • [probe] “PROBE llms.txt: HTTP 200 at https://bitwarden.com/llms.txt # Bitwarden > The most trusted open source password manager for passwords, passk…”
   • [community] “I use BitWarden because I'd never trust a password manager with closed source clients... Needless to say I move to the next ethical e2ee pas…”
   • [community] “Props for them to step in the right direction, it wasn’t obvious at all for a few days what they would do (re: SDK relicensing controversy).”
   • [community] “Thank you to Bitwarden for relicensing back to Free/Open License... I no longer recommend Bitwarden for normal people because the built-in p…”
   • [community] “I’m relieved... I hope they realized that being FOSS is their moat... I’m still not sure how I feel about them now. Trust in the company has…”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS explicitly markets itself as open-source and points to a public GitHub repo for code review, including for the browser extension backend ('delve deep into the intricacies'), and invites community contribution/code review. The core apps (2FAS Auth, described as 'Free, Open-source 2FA Authenticator App') are confirmed open-source via probe data. Missing for 10: no independent security audit report or third-party code-review corroboration is cited, and evidence doesn't explicitly confirm the mobile app repos (vs. just extension) are inspectable.

   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”
   • [claimed-docs] “Join our GitHub project and contribute to 2FAS by running code review and committing your ideas.”
   • [claimed-docs] “Check out our GitHub repository and delve deep into the intricacies of the browser extension back-end.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can fetch a current TOTP code programmatically — via CLI or API — to complete a 2FA login inside an automated workflow

   weight 2 · round to Bitwarden
   Bitwarden✓fullprobed8/10

   Bitwarden's integrated authenticator generates TOTP codes (bitwarden-docs-1) and the CLI is documented as a full vault-management tool suitable for automated workflows via personal API key (bitwarden-docs-7, bitwarden-docs-9); runtime probes confirm 'bw serve' exposes a local REST Vault Management API and an official MCP server completes a full handshake, both surfaces an agent could use to fetch TOTP codes programmatically (bitwarden-probe-rt-1, bitwarden-probe-rt-2). Hands-on community evidence independently corroborates that 'bw list' actually returns current TOTP codes in plaintext, confirming the CLI does return live TOTP data (bitwarden-comm-13). Missing for 10: explicit documentation naming a dedicated 'get totp' command/API endpoint and a clean (non-complaint) hands-on workflow example.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [community] “I had a really bad experience with the bitwarden cli. I ran 'bw list', assuming it would list names, but it listed everything including pass…”

   proof ↗⚑ flag

   2FAS—none0/10

   The evidence explicitly states 2FAS has no public API for programmatic TOTP retrieval ('Public API: None — local-first by design, no agent-callable endpoint for token generation'), and no CLI is documented anywhere in the pack; OpenAPI probes all 404. This directly rules out agent-driven fetching of TOTP codes via CLI or API.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

2. ai-native userExpose the vault through a local programmatic endpoint an agent can query for codes and secrets without screen-scraping the app

   weight 1 · round to Bitwarden
   Bitwarden✓fullprobed8/10

   Bitwarden's CLI supports a documented `bw serve` mode exposing the vault as a local RESTful API, and Bitwarden ships an official MCP server (bitwarden/mcp-server) that completed a live stdio handshake, both giving agents programmatic access to vault items and TOTP codes without screen-scraping. missing for 10: no independent hands-on validation of `bw serve` specifically for TOTP retrieval by an agent, and no broader third-party corroboration beyond the vendor-run probes.

   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”
   • [probe] “official MCP server documented at https://github.com/bitwarden/mcp-server”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”

   proof ↗⚑ flag

   2FAS—none0/10

   The product's own llms.txt explicitly states 'Public API: None' and no OpenAPI/local endpoint was found; 2FAS is local-first by design with no agent-callable interface for querying codes or secrets programmatically.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Browser

1. everyday userA browser extension autofills my TOTP codes and passkeys during login instead of making me retype them

   weight 2 · round to Bitwarden
   Bitwarden✓fullcommunity8/10

   Docs confirm browser extension autofills matching credentials on login pages (docs-12), autofills stored passkeys across apps/websites (docs-4), and generates/syncs TOTP codes (docs-1, docs-2) which are surfaced during autofill in the extension. One community mention notes TOTP setup friction, but no concrete evidence contradicts the core autofill-of-TOTP/passkeys capability. Missing for 10: independent hands-on confirmation specifically that TOTP codes (not just passwords/passkeys) are auto-filled into login forms without manual copy-paste.

   • [claimed-docs] “When you visit a website, the browser extension recognizes it and enters matching credentials from your vault into the login fields.”
   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [community] “I always enjoyed the value that Bitwarden provides: free to use, password generator, and a vault to keep other texts. But somehow I never go…”

   proof ↗⚑ flag

   2FAS✓fullcommunity7/10

   2FAS's browser extension is documented to autofill TOTP tokens with confirmation via the mobile app ('You don't have to retype anything'), and the 2FAS Pass extension supports autofill for passwords/passkeys confirmed in the vault app, with the free tier confirmed by community reports to include auto-fill. However, evidence is vendor-documented with only partial independent corroboration and no explicit hands-on confirmation of passkey autofill specifically working smoothly in-browser. Missing for 10: independent hands-on validation of passkey autofill UX, more detail on cross-browser support, and confirmation of friction-free flow beyond vendor claims.

   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”
   • [claimed-docs] “You can easily take a look at our code - reflecting our transparent and user-first approach. Check out our GitHub repository”

   proof ↗⚑ flag

Desktop

1. power userA first-class desktop app gives me codes and vault access on my computer, not just on mobile

   weight 2 · round to Bitwarden
   Bitwarden~partialprobed5/10

   Evidence confirms TOTP codes sync across 'Bitwarden apps' and vault access is available via browser extension and CLI on a computer, implying desktop-class access, but no citation explicitly documents a native desktop application (GUI) separate from the browser extension/CLI. Missing for 10: explicit desktop app documentation, screenshots/feature parity claims, and independent confirmation that a first-class desktop GUI (not just extension/CLI) exists and works well.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “When you visit a website, the browser extension recognizes it and enters matching credentials from your vault into the login fields.”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”

   proof ↗⚑ flag

   2FAS—none0/10

   Evidence only shows mobile apps (iOS/Android) plus a browser extension, and the extension explicitly requires confirmation via the mobile app (2fas-docs-3, 2fas-docs-19) rather than functioning as an independent desktop client. No native desktop app for code generation or vault access is documented anywhere in the pack.

   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Access through the Browser Extension or using Autofill must be confirmed in 2FAS Pass.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Watch

1. everyday userRead my codes from my smartwatch without pulling out my phone

   weight 1 · round to 2FAS
   Bitwarden—none0/10

   The evidence pack covers TOTP generation, syncing, browser extension, CLI, and API features, but contains no mention of a smartwatch app, Wear OS/watchOS companion, or any glanceable code display for wearables. This is a fair capability question for a password manager with a built-in authenticator, but no evidence shows it is delivered.

   ⚑ flag

   2FAS~partialclaimed5/10

   2FAS explicitly markets 'Apple Watch — Improved convenience and accessibility' as a feature, indicating watch support exists, but there's no detail on what functionality is available on the watch (e.g., whether codes are viewable standalone or require phone proximity) and no independent/hands-on confirmation of the experience. missing for 10: details on watch app functionality/UX, confirmation codes can be read without unlocking phone, independent hands-on review of the watch experience.

   • [claimed-docs] “Apple Watch Improved convenience and accessibility.”
   • [claimed-docs] “Apple WatchImproved convenience and accessibility.”

   proof ↗⚑ flag

Backup

1. security engineerBackups are end-to-end encrypted with a key the vendor never holds, and the encryption design is documented

   weight 3 · round drawn
   Bitwarden~partialclaimed4/10

   Docs confirm Bitwarden supports vault export/import and mention an 'encrypted exports' option (bitwarden-docs-5, bitwarden-docs-6, bitwarden-docs-16), implying some backups can be encrypted, but no evidence pack item documents the underlying encryption design, key derivation, or explicitly states the vendor cannot access backup contents. missing for 10: a linked security whitepaper or architecture doc describing zero-knowledge key management for exports, explicit vendor-can't-decrypt-backups statement, and independent verification of the encrypted export format.

   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault”

   proof ↗⚑ flag

   2FAS~partialcommunity4/10

   2FAS documents that backups/sync can be encrypted with a user password (docs-9, docs-17, docs-18) and that vault storage location is user-controlled, but the encryption is presented as optional ('we encourage you to do that') rather than guaranteed end-to-end by default, and there is no detailed technical whitepaper describing key derivation, zero-knowledge architecture, or threat model. Community discussion (2fas-comm-1) explicitly questions whether backups to iCloud/WebDAV truly avoid vendor/server trust, further undercutting a strong E2E claim. missing for 10: a dedicated cryptographic design document (algorithms, key derivation, zero-knowledge proof), confirmation that encryption is mandatory/default rather than opt-in, and independent security audit corroboration.

   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
   • [claimed-docs] “You decide where to store your Items. You can store it in your own cloud or keep it as an encrypted file on an external drive.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Multi device

1. everyday userMy tokens are available on my phone, tablet, and computer at the same time, kept in sync automatically

   weight 2 · round to 2FAS
   Bitwarden!disputedcontradicted6/10

   Bitwarden's docs describe cloud-based vault sync (TOTP codes staying synchronized across apps, passkeys usable across browser extension and mobile apps, auto-fill working consistently) which underlies cross-device availability of stored items (bitwarden-docs-2, bitwarden-docs-4, bitwarden-docs-12). However, a hands-on community report describes losing a generated password due to sync failures on bad connections, calling it 'quite common' (bitwarden-comm-9), directly contradicting the claim of seamless automatic sync. missing for 10: independent verification of reliable real-time sync across phone/tablet/computer simultaneously, and resolution/acknowledgment of the reported data-loss-on-sync issue.

   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Save passkeys in your Bitwarden vault and use the browser extension or mobile apps to autofill them across the apps and websites you use eve…”
   • [claimed-docs] “When you visit a website, the browser extension recognizes it and enters matching credentials from your vault into the login fields.”
   • [community] “I tried switching to Bitwarden and forced myself to live with it for 3 months. I gave up when it lost generated password. Apparently it is q…”

   proof ↗⚑ flag

   2FAS~partialcommunity6/10

   2FAS documents syncing tokens across devices via iCloud/Google Drive and lists 'Multi-device sync (encrypted)' as a feature, and computer access is possible through a browser extension that confirms via the mobile app. However, this cross-device access relies on manual confirmation from the phone rather than tokens being independently and automatically available on a tablet/computer at all times, and multi-device sync appears gated behind a paid tier for the Pass product. Missing for 10: evidence of true simultaneous, always-available token access across phone/tablet/computer without per-use phone confirmation, and confirmation that Auth (not just Pass) multi-device sync is free and automatic.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Click the browser extension icon when you need to enter a 2FA token, then confirm in the mobile app. You don't have to retype anything.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”

   proof ↗⚑ flag

Recovery

1. everyday userLosing my phone doesn't lose my accounts — a documented recovery path restores my tokens on a new device

   weight 3 · round to 2FAS
   Bitwarden~partialcommunity6/10

   Bitwarden's docs show that TOTP codes are synced across the Bitwarden apps (docs-2) and that vault data (including logins) can be exported/imported to restore to a new install (docs-5, docs-6), which together give a de facto path to recover accounts/tokens on a new device after losing a phone. However there is no explicit 'lost my phone' recovery guide, and community reports mention TOTP/sync reliability problems (bitwarden-comm-12, bitwarden-comm-9) that add real-world caveats. Missing for 10: a dedicated 'device loss/account recovery' doc, evidence of automatic cloud vault sync restoring a fresh install without manual export/import, and confirmation that community-reported sync/TOTP glitches don't block this flow.

   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Export your vault data, including logins and notes, to back up important information or transfer to a new Bitwarden vault.”
   • [claimed-docs] “Import logins and data from different password managers, other Bitwarden vaults, or encrypted exports to instantly transfer your information…”
   • [community] “I always enjoyed the value that Bitwarden provides: free to use, password generator, and a vault to keep other texts. But somehow I never go…”
   • [community] “I tried switching to Bitwarden and forced myself to live with it for 3 months. I gave up when it lost generated password. Apparently it is q…”

   proof ↗⚑ flag

   2FAS✓fullcommunity8/10

   2FAS documents multi-device sync via iCloud/Google Drive/encrypted export files for the Auth app, plus a dedicated recovery page explaining how to restore or run the Pass Vault on a new device using the cloud-synced encrypted vault file, and supports importing from other authenticator apps for migration scenarios. This directly addresses losing a phone and restoring tokens elsewhere, though community commentary raises trust questions about relying on third-party cloud storage rather than disputing that recovery works. Missing for 10: independent hands-on verification of the actual recovery flow succeeding, and clearer detail on recovery when no cloud sync was enabled beforehand.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Learn how to restore access to your 2FAS Pass Vault or run it on a different device.”
   • [claimed-docs] “If you have enabled sync with iCloud (on iOS) or Google Drive (on Android), your encrypted 2FAS Pass Vault file is right there.”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”
   • [claimed-docs] “We support imports from Aegis, Raivo, LastPassAegis, Stratum (formerly Authenticator Pro) and Google Authenticator.”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”

   proof ↗⚑ flag

Automation

1. ai-native userAn agent can create and update vault entries — seeding new TOTP secrets, storing credentials — through documented programmatic surfaces

   weight 2 · round to Bitwarden
   Bitwarden✓fullprobed7/10

   Bitwarden documents multiple programmatic surfaces for vault management — the fully-featured CLI (which supports create/edit item operations and a `bw serve` mode exposing a local REST API for TOTP/items), a personal API key explicitly recommended for 'automated workflows' and 'external applications,' and an official first-party MCP server that completed a live stdio handshake, giving agents a documented path to create and update vault entries including TOTP secrets. Missing for 10: an explicit doc/code example showing the exact CLI/API call syntax for adding a TOTP field to a new item, and independent (non-vendor) confirmation that an agent successfully created/updated entries end-to-end via these surfaces.

   • [claimed-docs] “The Bitwarden command-line interface (CLI) is a powerful, fully-featured tool for accessing and managing your vault.”
   • [claimed-docs] “Using the personal API key for CLI authentication is suitable for automated workflows, for providing access to an external appli”
   • [probe] “official CLI documented at https://bitwarden.com/help/cli/”
   • [probe] “PROBE runtime (recorded 2026-09-15): the official bw CLI installs keylessly from npm (@bitwarden/cli, registry latest 2026.8.0) and prints i…”
   • [probe] “PROBE runtime (recorded 2026-09-15): Bitwarden's OFFICIAL MCP server completed a FULL keyless stdio initialize handshake — `npx -y @bitwarde…”

   proof ↗⚑ flag

   2FAS—none0/10

   No programmatic API exists for creating/updating vault entries or seeding TOTP secrets; the product's own llms.txt explicitly states 'Public API: None' and openapi probes all 404, confirming no agent-callable surface for this workflow.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE openapi: all candidate paths 404 (https://2fas.com/openapi.json, https://2fas.com/swagger.json, https://2fas.com/api/openapi.json, htt…”

   proof ↗⚑ flag

Policy

1. it adminEnforce org-wide policies — require app lock, restrict export, mandate strong master credentials — across every member's app

   weight 1 · round to Bitwarden
   Bitwarden~partialclaimed3/10

   The evidence only shows that Bitwarden's Public API lets organizations manage 'members, collections, groups, event logs, and policies,' implying policy management exists, but there is no documentation shown for specific policies like app-lock enforcement, export restriction, or master-password strength requirements. Missing for 10: explicit documentation of individual policy types (master password strength, disable personal vault export, require app lock/timeout), admin console UI screenshots or workflow, and any hands-on confirmation that these policies are enforced across all members' apps.

   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is a consumer-focused authenticator/password manager with no evidence of centralized org policy management, admin dashboards, enforced app-lock policies, export restrictions, or credential strength mandates across users; it is explicitly local-first with no public API for such control (2fas-probe-rt-1). No IT-admin console or MDM/policy feature is documented anywhere in the pack.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [claimed-docs] “Freedom to self-host your data”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Sharing

1. it adminMy team can share TOTP-protected logins through shared vaults or collections with per-member access control

   weight 2 · round to Bitwarden
   Bitwarden~partialcommunity6/10

   Bitwarden's docs confirm built-in TOTP generation/sync (bitwarden-docs-1, bitwarden-docs-2) and its Public API supports managing organization members, collections, and groups (bitwarden-docs-8), and a real-world team user cites 'safer account sharing, including 2FA' as a killer feature (bitwarden-comm-8). However, the evidence pack lacks explicit documentation tying TOTP fields to collection-level per-member permissions/access control, so the granular sharing mechanics aren't directly evidenced. Missing for 10: dedicated docs on collection permission levels (view/edit/manage) applied to TOTP-containing items, and independent confirmation of this exact workflow.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “The Bitwarden Public API provides organizations a suite of tools for managing members, collections, groups, event logs, and policies.”
   • [community] “We use BitWarden at work, paying $3600/year. Their product is great for teams... The killer feature for me has been safer account sharing, i…”

   proof ↗⚑ flag

   2FAS—none0/10

   2FAS is positioned as a personal, local-first authenticator/password manager with individual sync (iCloud/Google Drive/self-host) and multi-device sync for a single user, not team/organization features. No evidence of shared vaults, collections, or per-member access control for an IT-admin-managed team; the HN community discussion even questions its single-user 'local-only' security model, but nothing addresses team sharing at all.

   • [claimed-docs] “Synchronize your Tokens with 2FAS export files, iCloud or Google Drive.”
   • [claimed-docs] “Multi-device sync (encrypted)”
   • [community] “Skeptical about 'local-only' claim: 2FAS Pass supports backups to iCloud, WebDAV and local file, meaning passwords rely on a server's securi…”
   • [community] “Free tier of 2FAS Pass includes auto-fill, import/export, and standard password generator; paid tier adds multi-device sync, more than 200 v…”

   proof ↗⚑ flag

Enrollment

1. everyday userScan a QR code and immediately start generating TOTP codes for a new account

   weight 3 · round to Bitwarden
   Bitwarden~partialcommunity6/10

   Docs confirm Bitwarden's integrated authenticator automatically generates rotating TOTP codes once a key/QR is added to a login item (bitwarden-docs-1, bitwarden-docs-13), which covers the core capability, but the pack lacks explicit documentation of the actual camera-scan-QR flow for a brand-new account (only QR-based *import* from another authenticator app is documented, bitwarden-docs-3/14). One community report also describes difficulty getting TOTP working at all (bitwarden-comm-12), though it's anecdotal and not a concrete reproducible failure. missing for 10: explicit doc/screenshot of scanning a QR to add a brand-new TOTP secret (not import), and independent hands-on confirmation that codes generate immediately after scan.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Let's start your Bitwarden browser extension journey by adding a new login item to your vault”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”
   • [community] “I always enjoyed the value that Bitwarden provides: free to use, password generator, and a vault to keep other texts. But somehow I never go…”

   proof ↗⚑ flag

   2FAS~partialprobed5/10

   2FAS Auth is a well-known TOTP app and docs reference connecting accounts via video tutorials, but the evidence pack lacks any direct documentation or hands-on confirmation of the core QR-scan-to-code-generation flow. missing for 10: explicit documentation/screenshots of QR scanning UX, confirmation that codes generate immediately post-scan, independent/hands-on corroboration of the onboarding flow.

   • [claimed-docs] “use our quick and easy-to-follow video tutorials to connect your online accounts.”
   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”

   proof ↗⚑ flag

Offline

1. power userCodes generate fully offline — no network, no vendor account required just to see my TOTP codes

   weight 2 · round to 2FAS
   Bitwarden—none0/10

   Bitwarden's TOTP generation is tightly coupled to the vault: codes are stored and computed inside a Bitwarden vault item, which requires a Bitwarden account/vault (docs-1, docs-2) and typically syncs across the vendor's cloud infrastructure. No evidence describes a standalone, account-free offline TOTP mode; self-hosting (docs-10) still requires an account/server setup, not a vendor-free path. missing for 10: evidence of a no-account, no-vendor-server offline TOTP mode; confirmation that code generation works without ever creating/authenticating a Bitwarden account.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “This article will walk you through the procedure to install and deploy Bitwarden to your own Linux server.”

   proof ↗⚑ flag

   2FAS✓fullprobed8/10

   2FAS Auth is described as open-source, local-first with no public API for token generation, and pricing docs confirm it's free with no telemetry, consistent with fully offline TOTP generation without vendor account requirement. Community evidence questions cloud-sync/backup security but this concerns 2FAS Pass (password manager), not the core Auth TOTP generation flow. missing for 10: independent hands-on confirmation that TOTP codes generate with device fully offline (airplane mode test), and explicit documentation stating no account/signup is ever required.

   • [probe] “PROBE runtime (recorded 2026-09-15): 2fas.com serves the most agent-forward docs plumbing in the arena — llms.txt with a literal 'For AI age…”
   • [probe] “PROBE runtime (recorded 2026-09-15): machine-readable pricing verified live at https://2fas.com/.well-known/pricing.md — '# 2FAS Pricing... …”
   • [claimed-docs] “data can be encrypted with your password, so we encourage you to do that.”

   proof ↗⚑ flag

Organization

1. power userKeep dozens of tokens organized — search, folders or groups, and service icons — so the right code is always two taps away

   weight 2 · round to 2FAS
   Bitwarden~partialclaimed4/10

   Docs confirm Bitwarden generates and syncs TOTP codes across devices and lets users import/export authenticator data (bitwarden-docs-1, bitwarden-docs-2, bitwarden-docs-3), which supports storing many tokens, but nothing in the evidence pack speaks to search, folders/groups, or service icons specifically for TOTP entries — organization is only implied through the general vault (login) item structure. missing for 10: explicit documentation of folder/collection organization for TOTP items, search functionality across TOTP entries, and service icon display for stored codes.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”
   • [claimed-docs] “Connect Authenticator with Password Manager to sync your verification codes. Once activated, the Bitwarden apps stay synchronized with any c…”
   • [claimed-docs] “Google Authenticator (QR code): Import from Google Authenticator using a QR code... LastPass (JSON): Import a LastPass Authenticator account…”

   proof ↗⚑ flag

   2FAS~partialclaimed6/10

   Docs confirm token customization with 'full control over groups, badges, icons, and labels' and Apple Watch access, directly supporting organization by groups/icons for quick access, but there is no mention of search functionality within the token list, no detail on folder/group UX depth, and no independent hands-on account of managing 'dozens of tokens' at scale. missing for 10: explicit search feature evidence, hands-on/independent validation of organization UX at scale, deeper detail on folder vs group implementation.

   • [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Apple Watch Improved convenience and accessibility.”
   • [claimed-docs] “Apple WatchImproved convenience and accessibility.”

   proof ↗⚑ flag

Variants

1. power userNon-standard tokens work too — Steam Guard, HOTP counters, custom periods and digit lengths

   weight 2 · round drawn
   Bitwarden—none0/10

   The evidence only describes Bitwarden's standard TOTP support (six-digit SHA-1 codes rotating every 30 seconds) with no mention of Steam Guard tokens, HOTP counters, or custom periods/digit lengths anywhere in the docs, community, or probe items.

   • [claimed-docs] “it automatically produces the time-based one-time passwords (TOTPs), six-digit codes using SHA-1 that rotate every 30 seconds”

   proof ↗⚑ flag

   2FAS—none0/10

   No evidence in the pack addresses Steam Guard tokens, HOTP counter-based codes, or custom period/digit-length configuration for 2FAS Auth — the docs only mention generic 'token customization' for groups/badges/icons/labels, which is unrelated to non-standard token algorithms.

   • [claimed-docs] “Token customization Full control over the groups, badges, icons, and labels.”
   • [claimed-docs] “Token customizationFull control over the groups, badges, icons, and labels.”

   proof ↗⚑ flag