VaultKeepR vs Bitwarden: storage, identity and recovery
Both products encrypt vault content on the client. This article examines storage dependencies, recovery rules and component transparency. The current product comparison covers commercial selection.
Architecture: Where Does Your Vault Live?
The client encrypts vault snapshots before upload. Storage can involve IPFS gateways, pinning services, hosted APIs and S3-compatible backends. These services handle ciphertext, while timing, size, CIDs and on-chain activity may remain observable. IPFS content addressing does not guarantee persistence: retain an independent encrypted backup and test retrieval. The sync documentation and threat model describe those dependencies.
Bitwarden offers a hosted service and a self-hosting option. Provider-held ciphertext does not establish provider-held decryption keys. IPFS does not remove every availability dependency.
Encryption: How Are Your Passwords Protected?
Bitwarden documents PBKDF2 and Argon2id. Do not describe a historical PBKDF2 parameter as its current configuration. VaultKeepR uses XChaCha20-Poly1305 and Argon2id for password-based paths.
Poly1305 and HMAC authenticate encrypted data; that is not a comparison of account login methods. Wallet signatures are not a universal requirement of current public clients.
Authentication: How Do You Prove It's You?
The public clients are the Chrome and Firefox extensions and the iOS and Android apps, available from Download. Creating a vault does not require an email address or an external wallet such as MetaMask. The passkey and smart-account flow is described in the passkey documentation; available unlock methods depend on the client and authenticator.
VaultKeepR Premium uses Shamir 3-of-5 recovery for the vault encryption key. The five configured channels are the device, remote storage, a trusted contact or QR handoff, a smart contract, and the API. Any three valid fragments can reconstruct the key; losing too many fragments or the recovery identifier can prevent recovery. See the current SDK defaults, channel distribution, and recovery guide. This recovers a vault key, not a hardware passkey or each seed phrase stored in the vault.
An email reset does not necessarily decrypt an existing vault. Distinguish identity recovery, vault deletion and recovery of vault keys.
Privacy: What Does the Provider Know About You?
Email-free identity does not mean metadata-free operation. Review account, payment and storage policies separately.
Pricing: Cost of Ownership
Bitwarden's personal Free plan is not limited to two devices; see its official plans. Old subscription numbers in this post should not be used as a current price list.
VaultKeepR Free provides the basic email-free vault. Premium is optional; subscriptions and crypto Lifetime are distinct. Check current pricing and the product comparison.
Open Source: Transparency Comparison
VaultKeepR is open-core: MIT SDK and contracts, private clients. Compare that scope with Bitwarden's published repositories and audit reports. Public source does not establish a completed third-party manual audit.
When to Choose Each
Choose by clients, administration requirements, storage dependencies and restore procedures. VaultKeepR may fit an email-free individual vault; do not describe it as a public family/team offering.
The Bottom Line
Distributed storage and client-side encryption answer different questions. Compare mechanisms that are actually available and test backups. Architecture alone does not justify a universal security winner.
Keep Reading
- What Is a Zero-Knowledge Password Manager?
- The Case for Decentralized Password Storage
- VaultKeepR vs 1Password — Which Privacy Model Fits You?
- VaultKeepR vs LastPass — Why Bitwarden Users Switch
- VaultKeepR vs Dashlane — Compared
- VaultKeepR vs NordPass — Compared
- Migrate from Bitwarden to VaultKeepR
FAQ
How do I migrate?
Follow the Bitwarden guide, check the export type and test import before closing the source vault.
Is Bitwarden Free limited to two devices?
No. Consult the official plans.
Does VaultKeepR remove servers?
No. The client encrypts vault snapshots before upload. Storage can involve IPFS gateways, pinning services, hosted APIs and S3-compatible backends. These services handle ciphertext, while timing, size, CIDs and on-chain activity may remain observable. IPFS content addressing does not guarantee persistence: retain an independent encrypted backup and test retrieval. The sync documentation and threat model describe those dependencies.
