# Bitwarden Secrets Manager alternative: Crunu vs Bitwarden > Crunu vs Bitwarden Secrets Manager: both decrypt on the client. Compare keys per environment, token lifetime and revocation, CI sign-in, hosting and price. URL: https://crunu.com/alternatives/bitwarden-secrets-manager Language: en Updated: 2026-10-30 Both decrypt on the client, so neither server can read your secrets. Bitwarden is open source, shares a plan with its password manager and has SDKs in nine languages. Crunu adds a key per environment, CI sign-in with OIDC, machine leases and a removal flow that rotates keys and lists what someone received. Bitwarden Secrets Manager and Crunu both decrypt secrets on the client, so the real differences are in environments, tokens and what happens when access ends. Bitwarden Secrets Manager is the developer product of the Bitwarden password manager: projects hold secrets, machine accounts get access tokens, and the `bws` CLI passes values to your programs. Crunu is a vault built only for environment variables, cloud credentials and API keys, organized into projects and environments, with an agent for machines and CI. Neither server can read your values, and we will not pretend otherwise. This page is about the layer above encryption: how keys are split, how long a machine's access lasts, how CI signs in, and what you learn when someone leaves. > **Note:** We checked every statement about Bitwarden Secrets Manager against Bitwarden's help center, product page and license file on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **Bitwarden Secrets Manager fits** teams that already use Bitwarden for passwords, or that want a client-side encrypted secrets store with public source code. It fits teams that need SDKs in many languages, a CLI on Windows, macOS and Linux, a Kubernetes operator, or a free plan for two people to start. **Crunu fits** teams whose secrets are organized by environment and who want that split enforced by keys, not just by permissions. It fits teams that want CI to sign in with OIDC, servers to hold their secrets on a lease, and a removal flow that rotates keys and shows exactly what a departing person received. ## Side by side | | Bitwarden Secrets Manager | Crunu | | -------------------------- | ------------------------------------------------------------------------------------------------------------ | --------------------------------------------------------------------------------------------------------------------------------------------- | | Where values are decrypted | On the client: the access token's key decrypts the organization key locally, then the secrets | Only in the browser and the `crunu` agent. The server stores ciphertext and signed documents. | | Keys | One organization key decrypts all secrets | Each environment has its own key, sealed separately to each person and machine allowed to read it | | Environments | Each secret belongs to one project at a time; projects group secrets for access | Projects contain environments such as `development`, `staging` and `production`; each is a unit of encryption and access | | Machine access | Machine accounts with access tokens that never expire by default | Enrolled machines with a lease, 24 hours by default, and service tokens with a lease, a usage limit and optional network binding | | After revoking a token | New sign-ins stop at once; a machine that already signed in can keep decrypting for up to one hour | A revoked machine drops its environments within minutes while it is online, and the keys it held are rotated | | CI sign-in | The documented GitHub Actions setup stores an access token as a GitHub secret; no OIDC sign-in is documented | Service tokens bound by OIDC to repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any issuer | | Removing a member | What happens to keys is not documented publicly | The keys of every environment they could read are rotated, with an exposure report and a reissue checklist | | Hosting | Bitwarden's cloud; self-hosting with Docker on Linux or Windows on the Enterprise plan | Crunu cloud at app.crunu.com; on the Enterprise plan, also your own server on Docker, Cloudflare Workers, Vercel or Google Cloud Run | | Source code | Public: the server core is AGPL; Secrets Manager modules use the Bitwarden License | Not published | | Sharing with outsiders | Bitwarden Send, a separate Bitwarden tool, shares text or files through temporary links | Share links to selected files with an expiry, a view limit and a password; the key stays in the link after `#` | | SSO, SCIM and Kubernetes | Enterprise: SSO and SCIM provisioning. A Kubernetes Operator, deployed with Helm. | Not available | | Pricing model | Free plan for up to 2 users, 3 projects and 3 machine accounts; Teams and Enterprise billed per user | Free during early access in the Crunu cloud; self-hosting on the Enterprise plan | ## Who can decrypt your values *Figure: Diagram of who can decrypt Bitwarden Secrets Manager values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the Bitwarden Secrets Manager service stores only ciphertext and holds no key.* Here the two products agree. Bitwarden says all encryption and decryption of secrets happens on the client, so no sensitive data reaches its servers unencrypted. A machine account's access token carries its own encryption key, which decrypts the organization key locally, and the organization key then decrypts the secrets. Crunu also encrypts and decrypts only in the browser and the `crunu` agent. If a vendor that cannot read your values is your only requirement, both qualify. ## Environments, tokens and leaving *Figure: Each environment of payments-api at Kiteline, a fictional company, has its own key, sealed only to those on its access list. Jonas Lindqvist is an editor on development and staging through the Developers access profile, so those two keys are sealed to his key. The production list has Amara Okafor as a reader and the machine api-prod-1, but not Jonas, so nothing he holds opens production.* **Keys per environment.** In Bitwarden, a secret belongs to one project at a time, and projects group secrets for access. One organization key decrypts every secret, and projects control who may fetch what. In Crunu, the environment is the unit of encryption. Each environment has its own key, sealed separately to the public key of every person and machine allowed to read it. A developer with access to `development` never receives the `production` key, so access to one cannot leak into the other through a misconfigured permission. **How long machine access lasts.** A Bitwarden access token never expires unless you set an expiry when you create it. Revoking it stops new sign-ins at once, but a machine that already signed in can keep retrieving and decrypting secrets for up to one hour, and the CLI may keep working with a revoked token until its stored session expires. Crunu machines work on a lease: the `crunu daemon` keeps decrypted environments in memory, serves the last verified state through an outage until the lease ends, 24 hours by default, and drops everything within minutes of revocation while online. Revoking a machine rotates the keys of the environments it held. **How CI signs in.** Bitwarden's GitHub Actions guide saves an access token as an encrypted GitHub secret. Crunu [service tokens](https://crunu.com/features/ci-cd) can require the CI provider's OIDC token for one repository, branch and deployment environment, so a copied token without that JWT does not sign in. Tokens also take a lease, a usage limit and network binding. **When someone leaves.** Bitwarden does not publicly document what happens to keys when a member is removed. Crunu's [member removal flow](https://crunu.com/features/offboarding) rotates the keys of every environment the person could read, revokes their tokens and links, and shows which versions they received, when and from where. A checklist lists the values to reissue at providers. What they already saw cannot be taken back, as the [limitations page](https://crunu.com/security/limitations) explains. ## Where Bitwarden is stronger - **Open source.** Bitwarden's source code is public and, in its words, third-party audited. Crunu's source code is not published, and it has no external audit yet. - **One vendor for passwords and secrets.** An organization has the same plan across Bitwarden products. Crunu has no password manager or browser extension. - **Developer reach.** SDKs for Python, Ruby, Go, C++, C#, Rust, Java, JavaScript and PHP; `bws` on Windows, macOS, Linux and as a Docker image; a Kubernetes Operator. Crunu has no SDKs, no Windows agent and no Kubernetes support. - **Identity.** SSO and SCIM provisioning on Enterprise. Crunu has neither. ## Moving from Bitwarden Secrets Manager to Crunu > **Note:** Crunu has no importer for Bitwarden. You list each project's secrets with the `bws` CLI on a trusted computer and drag the resulting `.env` files into Crunu. 1. [Create an account](https://crunu.com/signup) and save your Emergency Kit. 2. Map each Bitwarden project to a Crunu environment, for example a `payments-api-prod` project to `payments-api` / `production`. 3. On a trusted computer, run `bws secret list --output env > .env` with an access token that can read the project. 4. Drag each file into the matching environment, then delete the plaintext copy. 5. Replace `bws run` with `crunu run --env payments-api/production -- npm start`, enroll servers as machines, and give pipelines service tokens with OIDC binding. 6. Revoke the old machine account access tokens in Bitwarden, and delete the `bws` state files on machines that used them. Bitwarden's event logs do not carry over, and the Kubernetes Operator's sync has no equivalent in Crunu. Plan for workloads that read secrets through the operator before you switch. > **Warning:** The files from step 3 hold plaintext secrets. Keep them out of Git and synced folders, and delete them after the import. ## Other Bitwarden Secrets Manager alternatives If you are comparing password manager vendors, [1Password](https://crunu.com/alternatives/1password) and [Keeper Secrets Manager](https://crunu.com/alternatives/keeper-secrets-manager) also decrypt on the client. 1Password's Credential Broker adds CI sign-in with OIDC for GitHub Actions in public preview; Keeper is a paid add-on to Keeper's business plans that runs in Keeper's cloud, or on your own infrastructure with Self-Managed Keeper. [1Password vs Bitwarden Secrets Manager](https://crunu.com/compare/1password-vs-bitwarden-secrets-manager) compares those two directly. If you want a developer-first tool with client-side encryption, [Phase](https://crunu.com/alternatives/phase) is the closest model to Crunu: a key per environment, MIT-licensed code outside its enterprise directories and a free self-hosted plan. [Akeyless](https://crunu.com/alternatives/akeyless) can also be set up so that it cannot complete decryption without you, but only with its optional Customer Fragment. If you mainly want syncs, rotation and dynamic secrets, [Doppler](https://crunu.com/alternatives/doppler) and [Infisical](https://crunu.com/alternatives/infisical) offer them, with decryption on their servers. The guide [CI/CD secrets with OIDC](https://crunu.com/guides/ci-cd-secrets-with-oidc) covers how each approach handles pipelines. ## FAQ ### Is Crunu an alternative to Bitwarden Secrets Manager? Yes. Both decrypt on the client, so you keep that property. Crunu adds a key per environment, CI sign-in with OIDC, machines on a lease and a removal flow with an exposure report. Bitwarden keeps the edge on open source, SDKs, Windows and Kubernetes. ### How do I move from Bitwarden Secrets Manager to Crunu? List each project's secrets with `bws secret list --output env > .env` on a trusted computer, drag the file into a Crunu environment and delete the plaintext copy. Then switch `bws run` to `crunu run` and revoke the old access tokens. ### Does Bitwarden Secrets Manager encrypt on the client? Yes. Bitwarden says all encryption and decryption of secrets data happens on the client, and the access token's key decrypts the organization key locally. Crunu works the same way at that level; the differences are keys per environment, token lifetime and CI sign-in. ### Do Bitwarden access tokens expire? Not by default: the expiry is set to never unless you choose a date. After you revoke a token, a machine that already signed in can keep decrypting secrets for up to one hour. Crunu machine and service token access runs on a lease, and revocation rotates keys. ### Can I self-host Bitwarden Secrets Manager? Bitwarden's help center says Enterprise organizations can self-host it with Docker on Linux and Windows, while its plans page still lists a self-host option as coming soon. Crunu offers self-hosting on its Enterprise plan too, under a signed agreement: its server can be [self-hosted](https://crunu.com/self-hosting) on Docker, Cloudflare Workers, Vercel or Google Cloud Run. ## Sources - [Bitwarden: Secrets Manager product page](https://bitwarden.com/products/secrets-manager/) (accessed 2026-10-30) - [Bitwarden Help: Secrets Manager overview](https://bitwarden.com/help/secrets-manager-overview/) (accessed 2026-10-30) - [Bitwarden Help: Secret decryption](https://bitwarden.com/help/secret-decryption/) (accessed 2026-10-30) - [Bitwarden Help: Secrets](https://bitwarden.com/help/secrets/) (accessed 2026-10-30) - [Bitwarden Help: Access tokens](https://bitwarden.com/help/access-tokens/) (accessed 2026-10-30) - [Bitwarden Help: Secrets Manager CLI](https://bitwarden.com/help/secrets-manager-cli/) (accessed 2026-10-30) - [Bitwarden Help: GitHub Actions integration](https://bitwarden.com/help/github-actions-integration/) (accessed 2026-10-30) - [Bitwarden Help: Manage your secrets organization](https://bitwarden.com/help/manage-your-secrets-org/) (accessed 2026-10-30) - [Bitwarden Help: Secrets Manager plans](https://bitwarden.com/help/secrets-manager-plans/) (accessed 2026-10-30) - [Bitwarden Help: Kubernetes Operator](https://bitwarden.com/help/secrets-manager-kubernetes-operator/) (accessed 2026-10-30) - [Bitwarden Help: About Send](https://bitwarden.com/help/about-send/) (accessed 2026-10-30) - [Bitwarden server license](https://github.com/bitwarden/server/blob/main/LICENSE.txt) (accessed 2026-10-30) - [1Password Security Design white paper: Server infrastructure](https://agilebits.github.io/security-design/infra.html) (accessed 2026-10-30) - [1Password Developer: Credential Broker in GitHub Actions](https://www.1password.dev/brokered-access/github-actions) (accessed 2026-10-30) - [Keeper Secrets Manager product page](https://www.keepersecurity.com/secrets-manager.html) (accessed 2026-10-30) - [Self-Managed Keeper](https://www.keepersecurity.com/self-managed-keeper/) (accessed 2026-10-30) - [Keeper docs: Security and encryption model](https://docs.keeper.io/en/keeperpam/secrets-manager/about/security-encryption-model) (accessed 2026-10-30) - [Phase security](https://phase.dev/security/) (accessed 2026-10-30) - [Phase pricing](https://phase.dev/pricing/) (accessed 2026-10-30) - [Phase console license](https://github.com/phasehq/console/blob/main/LICENSE) (accessed 2026-10-30) - [Akeyless docs: Customer Fragment](https://docs.akeyless.io/docs/zero-knowledge-architecture) (accessed 2026-10-30) - [Doppler security fact sheet](https://docs.doppler.com/docs/security-fact-sheet) (accessed 2026-10-30) - [Infisical security internals](https://infisical.com/docs/internals/security) (accessed 2026-10-30)