# 1Password vs Bitwarden Secrets Manager for developers > 1Password and Bitwarden Secrets Manager compared for developer secrets: CI tokens, environments, self-hosting, member removal and pricing model, from both docs. URL: https://crunu.com/compare/1password-vs-bitwarden-secrets-manager Language: en Updated: 2026-10-30 Both encrypt on your devices, so neither service sees plaintext in normal use. 1Password adds Environments, Connect servers and OIDC sign-in for GitHub Actions in preview, priced per user on Business. Bitwarden Secrets Manager is cheaper to start, with a free plan, public source code and self-hosting on Enterprise. 1Password and Bitwarden Secrets Manager are built on the same promise, encryption and decryption on your devices, so the difference for developers is not who can read secrets but how each one gets them to code. 1Password gives developers Environments, a CLI, Connect servers inside your infrastructure and, in public preview, sign-in for GitHub Actions with the job's OIDC token. Bitwarden Secrets Manager is a separate product from Bitwarden's password manager, with machine accounts and access tokens, a cross-platform CLI, public source code and a free plan. Most comparisons of these two look at password managers. This one looks only at the developer side: CI, tokens, environments, self-hosting and what happens when someone leaves. > **Note:** Crunu wrote this comparison. We make a third option, described near the end, and we compared 1Password and Bitwarden Secrets Manager using only their own documentation, white paper and pricing pages, checked on October 30, 2026. Sources are listed with this page. If something is out of date, tell us at . ## Who each one fits **1Password fits** companies that already use 1Password Business for logins and want developer secrets in the same place, under the same admins, single sign-on and provisioning. Its developer tools include Environments with locally mounted `.env` files that are never written to disk, service accounts, Connect servers that cache secrets in your infrastructure, and Kubernetes integrations. **Bitwarden Secrets Manager fits** teams that want a lower-cost start and public code. The free plan covers up to 2 users, 3 projects and 3 machine accounts. Paid plans are priced per user and include machine accounts: up to 20 on Teams and up to 50 on Enterprise. Enterprise organizations can self-host it with Docker on Linux and Windows. ## Side by side | | 1Password | Bitwarden Secrets Manager | | --------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------- | | Where secrets are decrypted | On your devices; 1Password never has the unencrypted vault key. Credential Broker, in preview, decrypts inside a 1Password enclave. | On the client: the access token's key decrypts the organization key locally, then the secrets | | How secrets are grouped | Vaults and Environments; each vault has its own key | Projects; each secret belongs to one project, and one organization key decrypts all secrets | | Machine access | Service accounts, up to 100, with hourly and daily rate limits; Connect servers cache secrets for unlimited re-requests | Machine accounts with access tokens; tokens never expire by default | | CI pipelines | A service account token stored as a CI secret, or Credential Broker with GitHub's OIDC token in public preview on Business | A machine account access token stored as a CI secret; no OIDC sign-in documented | | Removing a member | Removal is not cryptographically enforced and vault keys are not changed; a new vault gets a new key | Not documented publicly | | Self-hosting | Connect servers run in your infrastructure; accounts and vaults stay on 1Password's service | Enterprise plan only, with Docker on Linux or Windows | | Source code | Not published; SDKs, Connect helpers and integrations are on GitHub | Public; the server core is AGPL, Secrets Manager modules and the SDK use Bitwarden's own licenses | | Audit | Business audit log keeps 365 days; usage reports show items each member used | Event logs on Teams and Enterprise, exportable and retained indefinitely | | Kubernetes | Operator, Secrets Injector and Helm charts | Operator deployed with Helm | | Pricing model | No free team plan; Teams Starter Pack for 10 to 20 members, Business per user, 14-day trial | Free plan for 2 users; Teams and Enterprise per user, with machine accounts included | ## CI and machine access This is the area where the two products differ most for developers. 1Password's standard GitHub Actions guide stores a service account token in a repository secret named `OP_SERVICE_ACCOUNT_TOKEN`, and notes that setting it in the configure step "makes the value available to all subsequent steps". Its newer Credential Broker lets GitHub Actions jobs use their OIDC token instead, without managing service account tokens. That feature is in public preview, custom OIDC workflows are in public beta, and both need 1Password Business. Service accounts have hourly and daily rate limits; Connect servers avoid them after the first fetch, because they cache data in your infrastructure. *Figure: Diagram of who can decrypt 1Password values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the 1Password service stores only ciphertext and holds no key.* Bitwarden's GitHub Actions guide saves a machine account access token as a GitHub encrypted secret, and no OIDC sign-in is documented. Access tokens are created with an expiry that defaults to "Never". When you revoke one, Bitwarden says new sign-ins stop at once, but "a machine that has already authenticated may continue to retrieve and decrypt secrets for up to one hour". The `bws` CLI runs on Windows, macOS and Linux, and `bws run` passes secrets to a command as environment variables. *Figure: Diagram of who can decrypt Bitwarden Secrets Manager values, split into your side and the provider side. On your side, your team’s devices, your machines, and CI runners can decrypt. On the provider side, the Bitwarden Secrets Manager service stores only ciphertext and holds no key.* ## Environments and removing people Neither product has a separate key per environment out of the box. In 1Password, each vault has its own key, so keeping production in its own vault gives it its own key; Environments group project variables on top. In Bitwarden Secrets Manager, projects group secrets for access, "each secret can only be associated with a single project at a time", and one organization key decrypts all secrets. On removal, 1Password's white paper is unusually frank: removing someone from a vault "isn't cryptographically enforced" and keys are not changed, though the server stops sending them data. Its suggested mitigation is to move items to a new vault, which has a new key. Bitwarden does not document what happens to keys when a member leaves. In both cases, values the person already saw should be reissued at the provider. ## Where 1Password is stronger - **One tool for the whole company.** Logins, passkeys and developer secrets in one place, with SSO through an OIDC identity provider and SCIM provisioning on Business. - **OIDC for GitHub Actions.** Credential Broker removes the stored service account token, even if it is still in preview. - **Local .env files without disk writes.** Environments can mount `.env` files locally without writing credentials to disk. - **Connect servers.** A cache inside your infrastructure that serves unlimited re-requests after the first fetch. ## Where Bitwarden Secrets Manager is stronger - **Cost to start.** A free plan for 2 users, and paid plans that include machine accounts. - **Public source code and self-hosting.** The code is public, and Enterprise organizations can run it on their own servers. - **Cross-platform CLI.** One `bws` binary for Windows, macOS and Linux, also available from GitHub releases. - **Event log retention.** Event logs are exportable and retained indefinitely on paid plans. ## A third option: Crunu Crunu, which wrote this page, shares the same basic promise as both products: values are encrypted in the browser and the `crunu` agent, and the server stores only ciphertext. Crunu's sign-in model, a password plus a Secret Key, follows the design in 1Password's white paper. Where it differs is in the developer details. Each environment has its own key, sealed separately to each person, machine and pipeline. CI uses service tokens bound by OIDC to a repository, branch and deployment environment on GitHub Actions, GitLab CI, Bitbucket Pipelines or any OIDC issuer. Removing someone rotates the keys of every environment they could read and lists the values to reissue. You can use the Crunu cloud or, on the Enterprise plan, [host the server yourself](https://crunu.com/self-hosting). It is free during early access. The server still sees metadata such as names, email addresses and timestamps, as the [limitations page](https://crunu.com/security/limitations) explains. Crunu is not a fit if you also need a password manager, browser autofill, mobile apps, SSO, SCIM, a Windows agent, SDKs or Kubernetes integration; it has none of these. The full comparisons are [Crunu vs 1Password](https://crunu.com/alternatives/1password) and [Crunu vs Bitwarden Secrets Manager](https://crunu.com/alternatives/bitwarden-secrets-manager). ## FAQ ### Can 1Password or Bitwarden read my secrets? Not in normal use. Both encrypt and decrypt on your devices. 1Password's Credential Broker, in public preview, is the exception: brokered requests are decrypted inside an attested 1Password enclave with a key that your workload supplies. ### Which one supports OIDC for GitHub Actions? 1Password, through Credential Broker, in public preview on 1Password Business. Bitwarden Secrets Manager's documented GitHub Actions setup stores a machine account access token as a GitHub secret, and no OIDC sign-in is documented. ### Is Bitwarden Secrets Manager free? Its free plan covers up to 2 users, 3 projects and 3 machine accounts. Teams and Enterprise are priced per user, with up to 20 and up to 50 machine accounts included. 1Password has no free team plan; Business is priced per user, with a 14-day trial. ### Can I self-host 1Password or Bitwarden Secrets Manager? Bitwarden's help pages say Enterprise organizations can self-host Secrets Manager with Docker, though its plans page also lists a self-host option as coming soon. 1Password runs Connect servers in your infrastructure, but accounts and vaults stay on 1Password's service. ### What happens when I remove a member? 1Password's white paper says removal is not cryptographically enforced and vault keys are not changed; moving items to a new vault gives them a new key. Bitwarden does not document key changes on removal. Either way, reissue the values the person could read. ## Sources - [1Password security design: Credential Broker](https://agilebits.github.io/security-design/credential-broker.html) (accessed 2026-10-30) - [1Password security design: vaults and keys](https://agilebits.github.io/security-design/leopard.html) (accessed 2026-10-30) - [1Password Connect](https://www.1password.dev/connect/) (accessed 2026-10-30) - [1Password service accounts](https://www.1password.dev/service-accounts/) (accessed 2026-10-30) - [1Password service account rate limits](https://www.1password.dev/service-accounts/rate-limits) (accessed 2026-10-30) - [1Password Environments](https://www.1password.dev/environments) (accessed 2026-10-30) - [1Password: GitHub Actions with a service account](https://www.1password.dev/ci-cd/github-actions) (accessed 2026-10-30) - [1Password Credential Broker for GitHub Actions](https://www.1password.dev/brokered-access/github-actions) (accessed 2026-10-30) - [1Password Business pricing](https://1password.com/pricing/business) (accessed 2026-10-30) - [1Password audit log](https://support.1password.com/activity-log/) (accessed 2026-10-30) - [1Password Kubernetes integrations](https://www.1password.dev/k8s) (accessed 2026-10-30) - [Bitwarden: secret decryption](https://bitwarden.com/help/secret-decryption/) (accessed 2026-10-30) - [Bitwarden Secrets Manager overview](https://bitwarden.com/help/secrets-manager-overview/) (accessed 2026-10-30) - [Bitwarden Secrets Manager plans](https://bitwarden.com/help/secrets-manager-plans/) (accessed 2026-10-30) - [Bitwarden: manage your Secrets Manager organization](https://bitwarden.com/help/manage-your-secrets-org/) (accessed 2026-10-30) - [Bitwarden: access tokens](https://bitwarden.com/help/access-tokens/) (accessed 2026-10-30) - [Bitwarden: secrets](https://bitwarden.com/help/secrets/) (accessed 2026-10-30) - [Bitwarden: machine accounts](https://bitwarden.com/help/machine-accounts/) (accessed 2026-10-30) - [Bitwarden Secrets Manager CLI](https://bitwarden.com/help/secrets-manager-cli/) (accessed 2026-10-30) - [Bitwarden: GitHub Actions integration](https://bitwarden.com/help/github-actions-integration/) (accessed 2026-10-30) - [Bitwarden server license](https://github.com/bitwarden/server/blob/main/LICENSE.txt) (accessed 2026-10-30) - [Bitwarden Secrets Manager Kubernetes Operator](https://bitwarden.com/help/secrets-manager-kubernetes-operator/) (accessed 2026-10-30)