is bitwarden safer than google password manager

However, the general consensus from experts is that stand-alone password managers, such as Bitwarden, are safer than browser-based password managers like those offered by Google, Firefox, or Safari.

reddit.com › r/bitwarden › an brief analysis of google password manager vs bitwarden

r/Bitwarden on Reddit: An brief analysis of Google Password Manager vs Bitwarden

August 31, 2022 -

This type of question has come up before in this forum, so I thought I do a short write up about the pros can cons of using google password manager vs Bitwarden. You can also substitute Bitwarden with other password manager.

Platform Support

Google password manager now works with Chrome, Android and even IOS. However, I believe it is still limited to the Chrome browser. Bitwarden tend to support more browsers.

Authentication

Google Password manager are authenticated using your google user name and password. Typically this is the same account you use to log into your google account, email, and google drive. To get into Bitwarden, you need to have the master password.

Both can be further protected by 2FA. Both support hardware keys for 2FA.

Autofill and Password Change

Both type of product can autofill webites and apps. Both can detect password changes and update the password in the vault. However, I find that the Chrome often does a bit of a better job on the browser side of detecting change password and autofilling.

Storage of Password and syncing

This is where some of the difference might matter. Bitwarden will store the vault encrypted in the cloud. Google password manager will store the password locally encrypted on the local drive and sync them across different devices. In addition, I believe Google probably stores a copy of your passwords and other items on their server.

Both Chrome and Bitwarden store a copy of the vault on local data. The main difference is that Bitwarden vault can only be accessed by the Bitwarden encryption key, while the Chrome vault can be decrypted by anything running as the user, so any program that runs on your account will be able to decrypt it, including any malware. However, if someone were to pull out your hard drive and try to read it, they won't be able to because you need to log as the user to decrypt.

Syncing on Chrome is encrypted. Most password manager also encrypt their stream. However, there is an optional setting to encrypt the data on the server so that Google can't read it. This implies google can read your password if you don't enable the option.

Import and Export

Chrome allows you to export and import your password as a CSV file. The export is going to be in clear text. Bitwarden can export and import encrypted and plaintext format.

I would suggest that you regularly backup your vault. In both use cases, your password vault is in the hands of a third party. If Bitwarden or Google decide to cut you off one day, you should be able to import the vault to a different password manager.

Password Security Review

One nice thing about google password manager is that they scan for password that might have been breached. I got the impression that Bitwarden might be more comprehesive, but only if you do the paid version.

My Thoughts

Google password manager have gotten better over the years. It no longer stores the password unecrypted. Now there is better integration with Android and IOS. However, I am a bit concern that the password can be decrypted by any user processes and I am concern that Google might be able to read the passwords.

Top answer

1 of 5

Google password manager will store the password locally encrypted on the local drive and sync them across different devices. In addition, I believe Google probably stores a copy of your passwords and other items on their server. My experience is that Bitwarden does this as well. When you are logged in there is a data.json on your hard drive that is your encrypted vault. This implies google can read your password if you don't enable the option. If true, this is an important difference. Most modern password managers are zero knowledge; there isn't even a capability for the provider to see the contents of your vault. Bitwarden can export and import encrypted and plaintext format. The Bitwarden encrypted format is deeply flawed. It does not allow importing to a different account or a different server I don't think this an effective differentiation. My Thoughts Google still doesn't have support for customized URI recognition, integrated TOTP generation, shared collections, password history, custom fields, notes, secure notes, and file attachments. Google's lack of a zero knowledge design still makes it a feature to push browser adoption as opposed to a capability to securely manage secrets that may include browser logins. The purpose and scope of the Google system slightly overlaps that of commercial password managers, but I doubt they will ever directly compete in the same market.

2 of 5

I know I'm late to the party but here are my thoughts. I've used the chrome password manager since they added the feature mainly because it seems to be able to autofill better than anything else. Especially since I use an android phone and it can autofill into apps. I also spent several hours changing all my passwords to have higher entropy. Before, I used the same password for everything but chrome's feature of checking for duplicates was useful. It isn't perfect since it doesnt know that the website and app for the same company aren't duplicates. Chrome does not save passwords for LAN logins. I used Lastpass for this and then transitioned to Bitwarden. It would seem to make sense to just put everything in bitwarden (or lastpass in the past). The main issue is autofill. Lastpass was pretty good but not perfect and I found it's UI annoying at times compared to chrome. Bitwarden is worse. I recognize that bitwarden may be considered more secure due to zero-knowledge, but I don't think the difference is that large. Anyone that is able to get access to google password manager will also be able to access my email and thus reset all my passwords. If bitwarden gets up to chrome's level of autofill, I may reconsider but we may no longer be using passwords anymore at that point. The main downside to using chrome's password manager and upside to bitwarden is that I'm basically locked into chrome. If I used bitwarden and lived with the inferior autofill experience, I could use any browser. Even if I did that, my attack surface is now larger because one can either get access to my email or get access to bitwarden. Is my thinking flawed?

Videos

youtube.com

What is the BEST Password Manager in 2024?