Sovereign alternative to 1Password
1Password keeps your secrets well, but it is proprietary software, published in Canada and billed per user. Vaultwarden covers the same use cases in open source, compatible with the Bitwarden apps, and Bunker hosts it in Europe on your dedicated instance.
1Password is a polished password manager, praised for its ergonomics. It is also a proprietary service, published by a Canadian company, whose vault is hosted by the vendor, in a region you pick (United States, Canada or European Union) but on infrastructure it operates. Billing is per user per month, and the code stays closed: you can neither audit it nor bring it back in-house.
Vaultwarden answers the same need in free software. It is a lightweight reimplementation of the Bitwarden server, compatible with its official apps. Bunker hosts it in Europe on an instance reserved for you, with end-to-end encryption. Your secrets stay on the continent, on sovereign infrastructure, and the instance re-internalizes whenever you decide.
Point-by-point comparison
| Criterion | Vaultwarden (Bunker) | 1Password |
|---|---|---|
| Model | Open source (GPLv3), auditable | Proprietary, closed code |
| Vault hosting | Your instance, in Europe | Vendor cloud (US, Canada or EU region of your choice) |
| Publisher | Bunker (Europe) | 1Password (Canada) |
| Encryption | End-to-end, client-side (AES-256) | End-to-end |
| Client compatibility | Official Bitwarden apps | 1Password clients only |
| Billing | Flat rate per instance | Per user per month |
| Two-factor authentication | TOTP, WebAuthn | TOTP, hardware keys |
| Import from 1Password | Yes (CSV / JSON) | N/A |
| On-premise reversibility | Yes, re-internalizable | No |
A proprietary vault you do not control
1Password encrypts your data correctly, but the whole thing rests on closed software and an infrastructure run by the vendor, even if you can pick the region. You trust the vendor for security, without being able to audit the code or host the vault yourself. The day you want to leave, there is no version you could host yourself.
Vaultwarden flips the logic. The code is open, the data lives on an instance reserved for you in Europe, and you keep the option to bring everything back onto your own servers. Security no longer depends on a commercial promise but on verifiable software.
Bitwarden compatibility, without a per-user license
Vaultwarden speaks the Bitwarden protocol. Your teams install the Bitwarden browser extensions, mobile apps and desktop clients, then point them at your instance. The daily experience stays that of a modern manager: generator, autofill, sharing by organization, two-factor authentication.
The difference shows on the invoice. Where 1Password counts every user, the managed Vaultwarden service is billed at a flat rate for your instance. You add accounts without watching the cost climb with every hire.
When 1Password still makes sense
To be fair: 1Password offers a very refined interface, dedicated commercial support and mature enterprise features (security reports, packaged SSO integrations). For an organization that values that turnkey comfort and has no sovereignty requirement, it does the job well.
Managed Vaultwarden becomes the right call as soon as you want open software, hosting in Europe with no US subprocessor, flat-rate billing and the freedom to bring your vault back. You import your 1Password export so nothing is lost along the way.
Frequently asked questions
Is Vaultwarden as secure as 1Password?
Yes, on the principle that matters: encryption happens client-side with AES-256, before any upload, and the master password never leaves your device. No one can read your vault, Bunker included. Because the code is open source, that level of security is verifiable by anyone, rather than resting on the vendor’s word.
Can I migrate my 1Password vault to Vaultwarden?
Yes. You export your 1Password vault as CSV or JSON, then import it from a Bitwarden client connected to your instance. Logins, secure notes and folders come across. Remember to delete the export file once the migration is done.
How is managed Vaultwarden more sovereign than 1Password?
Your vault is hosted in Europe, on a dedicated instance, with no subprocessor under US jurisdiction. The software is open, you decide on retention, and you can bring everything back onto your own infrastructure. 1Password stays a proprietary service whose hosting and code you do not choose.
Your passwords, encrypted and hosted in Europe
Dedicated Vaultwarden instance, Bitwarden-compatible, end-to-end encryption, reversible whenever you want.
Bunker is not affiliated with 1Password. "1Password" is a trademark of its publisher, referenced here for comparison to designate the competing service.