A team password manager on Vaultwarden, running on your own machines and private network, with the apps your staff already know from Bitwarden.
- Replacing
- 1Password, by AgileBits Inc. (1Password)
- With
- Vaultwarden, Passbolt
- Runs on
- Your servers, or Pilae Cloud in Switzerland and the EU
- Migration
- Included in onboarding, at a fixed price
Why teams leave 1Password
The vault never faces the internet
Vaultwarden answers only on your private network. Even encrypted, the vault is not sitting on a public endpoint for anyone to probe.
Your country, your machines
The encrypted vault, its metadata and its backups are held on hardware you control, in the country you choose, not in a vendor region.
No per-seat bill
Adding a contractor or a whole department is a line in your directory, not a renegotiation. Machine size, not seat count, is what grows.
1Password vs Vaultwarden operated by Pilae
| What is being compared | 1Password | Pilae |
|---|---|---|
| Encryption | End-to-end encrypted with the account password and a Secret Key; 1Password cannot read vault contents. | End-to-end encrypted in the Bitwarden clients with the master password; the server holds only ciphertext. |
| Where vaults are held | In 1Password cloud infrastructure, with US, Canadian and EU regions. | On your premises or on dedicated machines in any of 12 Pilae Cloud regions, six of them in Switzerland and the EU. Air-gapped on request. |
| Network exposure | Reachable over the internet from any device, protected by the encryption model. | Reachable only on your private mesh, from enrolled devices. |
| Apps for staff | 1Password apps for desktop, mobile and browsers, with a polished experience. | The official Bitwarden apps and browser extensions, pointed at your own server. |
| Sharing and administration | Shared vaults, groups, admin policies and activity reports. | Organisations, collections, groups and an admin panel, with access by group. |
| Pricing model | Per user per month. | On request, for the operated platform. No charge per user. |
| Operation | Fully run by 1Password as a SaaS product. | Planned upgrades by the Pilae Agent, daily encrypted backups with a monthly restore test, 60-second probes and alerts that reach Pilae engineers around the clock. |
Self-hosted password manager for teams
1Password is a well-designed password manager with a serious encryption model. The question for most organisations is not whether it is secure. It is whether the vault holding every credential they own should sit in a vendor region on the public internet, billed per seat.
Vaultwarden gives your teams shared vaults, collections and groups, and your staff use the official Bitwarden apps and browser extensions. Pilae runs it on your premises or on dedicated machines in any of 12 Pilae Cloud regions, six of them in Switzerland and the EU, and it answers only on your private network, from devices you have enrolled. Where each piece is held is set out on our data residency page.
Passbolt is the other answer, built for teams whose passwords are mostly shared. Each secret is encrypted with OpenPGP for every person who may open it, and sharing is set per item, per folder and per group. Directory sync and single sign-on belong to its paid Pro edition, which is licensed in your name when you need it.
Vaultwarden, operated for you
A self-hosted vault cannot be allowed to lose data. We back it up daily, encrypted and offsite in your chosen country, and test a restore every month, recorded in the console. The Pilae Agent plans each upgrade, waits for your approval and applies it in your window, and our backups page sets out what the contract commits to.
Pricing is on request and has no per-user component. Tell us how many people and vaults you have, and we plan the move with you.
Moving from 1Password to Vaultwarden
Stand up the vault and the network
Vaultwarden on your machines or in Pilae Cloud, behind the private network. Staff devices are enrolled before anyone is asked to move.
Export and import, vault by vault
Each 1Password vault is exported in the 1PUX format and imported into a matching collection. Counts are checked on both sides before the export file is destroyed.
Move attachments and check passkeys
The Bitwarden importer leaves file attachments out, so they are uploaded again by hand. Passkeys that do not come across are registered again with the site.
Switch the browser extensions, then end the contract
Staff install the Bitwarden extension and sign in to your server. When nobody opens 1Password any more, the subscription ends.
The apps that replace 1Password
Vaultwarden
A password manager for the whole organisation, compatible with the Bitwarden apps, on a server you choose and with vaults only your people can decrypt.
Replaces 1Password, LastPass
Passbolt
A team password manager built on OpenPGP, where every shared credential is encrypted for each person who may read it, run in Switzerland, the EU or your own datacentre.
Replaces 1Password Business, LastPass, Keeper