Bitwarden Secrets Manager alternative: Crunu vs Bitwarden

Bitwarden Secrets Manager and Crunu both decrypt secrets on the client, so the real differences are in environments, tokens and what happens when access ends. Bitwarden Secrets Manager is the developer product of the Bitwarden password manager: projects hold secrets, machine accounts get access tokens, and the bws CLI passes values to your programs. Crunu is a vault built only for environment variables, cloud credentials and API keys, organized into projects and environments, with an agent for machines and CI.

Neither server can read your values, and we will not pretend otherwise. This page is about the layer above encryption: how keys are split, how long a machine's access lasts, how CI signs in, and what you learn when someone leaves.

Who each one fits

Bitwarden Secrets Manager fits teams that already use Bitwarden for passwords, or that want a client-side encrypted secrets store with public source code. It fits teams that need SDKs in many languages, a CLI on Windows, macOS and Linux, a Kubernetes operator, or a free plan for two people to start.

Crunu fits teams whose secrets are organized by environment and who want that split enforced by keys, not just by permissions. It fits teams that want CI to sign in with OIDC, servers to hold their secrets on a lease, and a removal flow that rotates keys and shows exactly what a departing person received.

Who can decrypt your values

Here the two products agree. Bitwarden says all encryption and decryption of secrets happens on the client, so no sensitive data reaches its servers unencrypted. A machine account's access token carries its own encryption key, which decrypts the organization key locally, and the organization key then decrypts the secrets. Crunu also encrypts and decrypts only in the browser and the crunu agent. If a vendor that cannot read your values is your only requirement, both qualify.

Environments, tokens and leaving

Keys per environment. In Bitwarden, a secret belongs to one project at a time, and projects group secrets for access. One organization key decrypts every secret, and projects control who may fetch what. In Crunu, the environment is the unit of encryption. Each environment has its own key, sealed separately to the public key of every person and machine allowed to read it. A developer with access to development never receives the production key, so access to one cannot leak into the other through a misconfigured permission.

How long machine access lasts. A Bitwarden access token never expires unless you set an expiry when you create it. Revoking it stops new sign-ins at once, but a machine that already signed in can keep retrieving and decrypting secrets for up to one hour, and the CLI may keep working with a revoked token until its stored session expires. Crunu machines work on a lease: the crunu daemon keeps decrypted environments in memory, serves the last verified state through an outage until the lease ends, 24 hours by default, and drops everything within minutes of revocation while online. Revoking a machine rotates the keys of the environments it held.

How CI signs in. Bitwarden's GitHub Actions guide saves an access token as an encrypted GitHub secret. Crunu service tokens can require the CI provider's OIDC token for one repository, branch and deployment environment, so a copied token without that JWT does not sign in. Tokens also take a lease, a usage limit and network binding.

When someone leaves. Bitwarden does not publicly document what happens to keys when a member is removed. Crunu's member removal flow rotates the keys of every environment the person could read, revokes their tokens and links, and shows which versions they received, when and from where. A checklist lists the values to reissue at providers. What they already saw cannot be taken back, as the limitations page explains.

Where Bitwarden is stronger

• Open source. Bitwarden's source code is public and, in its words, third-party audited. Crunu's source code is not published, and it has no external audit yet.
• One vendor for passwords and secrets. An organization has the same plan across Bitwarden products. Crunu has no password manager or browser extension.
• Developer reach. SDKs for Python, Ruby, Go, C++, C#, Rust, Java, JavaScript and PHP; bws on Windows, macOS, Linux and as a Docker image; a Kubernetes Operator. Crunu has no SDKs, no Windows agent and no Kubernetes support.
• Identity. SSO and SCIM provisioning on Enterprise. Crunu has neither.

Moving from Bitwarden Secrets Manager to Crunu

Bitwarden's event logs do not carry over, and the Kubernetes Operator's sync has no equivalent in Crunu. Plan for workloads that read secrets through the operator before you switch.

Other Bitwarden Secrets Manager alternatives

If you are comparing password manager vendors, 1Password and Keeper Secrets Manager also decrypt on the client. 1Password's Credential Broker adds CI sign-in with OIDC for GitHub Actions in public preview; Keeper is a paid add-on to Keeper's business plans that runs in Keeper's cloud, or on your own infrastructure with Self-Managed Keeper. 1Password vs Bitwarden Secrets Manager compares those two directly.

If you want a developer-first tool with client-side encryption, Phase is the closest model to Crunu: a key per environment, MIT-licensed code outside its enterprise directories and a free self-hosted plan. Akeyless can also be set up so that it cannot complete decryption without you, but only with its optional Customer Fragment.

If you mainly want syncs, rotation and dynamic secrets, Doppler and Infisical offer them, with decryption on their servers. The guide CI/CD secrets with OIDC covers how each approach handles pipelines.