Bitwarden vs KeePass for Self-Hosted Air-Gapped Enterprise Networks (2026)

For self-hosted, air-gapped enterprise networks in 2026, KeePass is the stronger choice for true air-gap isolation with zero network dependencies, while Bitwarden wins if your organization needs a fully managed self-hosted server with a polished team UI, role-based access controls, and enterprise SSO — even in restricted network environments.

Head-to-Head Comparison

Security & Privacy

Both tools are open-source, which matters enormously in self-hosted contexts — you can audit what you deploy.

Bitwarden encrypts vault data with AES-256-CBC for vault items and uses PBKDF2-SHA256 with a minimum of 600,000 iterations for master password key derivation (configurable higher for enterprise policies). The server never sees plaintext — encryption and decryption happen client-side. When self-hosting via the official Docker stack or the community Vaultwarden fork, your vault data stays entirely on your infrastructure. Bitwarden's codebase underwent a Cure53 penetration test in 2022, and the findings and remediation steps are publicly documented. The company is headquartered in the United States (Santa Barbara, CA), subject to US jurisdiction — relevant for threat modeling even in self-hosted deployments because the client software originates there.

KeePass uses AES-256 by default, with optional ChaCha20 as an alternative cipher. Its key derivation is more flexible and more modern: KeePass 2.x supports Argon2d and Argon2id (the 2015 Password Hashing Competition winner), which provides stronger resistance to GPU-based brute-force attacks than PBKDF2. The vault is a single encrypted .kdbx file — there is no server process, no network socket, no API. For a true air-gapped machine that never touches a network, this is architecturally simpler and reduces attack surface by eliminating server-side components entirely. KeePass is developed by Dominik Reichl, a German developer, and licensed under GPL 2. It has no corporate parent and is subject to no single jurisdiction's government compulsion for source code changes.

For environments regulated under frameworks like CMMC Level 2/3, ICS/SCADA isolation requirements, or intelligence community directives requiring no network-accessible credential stores, KeePass's file-only model is architecturally compliant without additional hardening. Bitwarden's self-hosted model still exposes a web server port internally, which some compliance frameworks flag.

Features

Centralized Administration

Bitwarden's self-hosted Enterprise plan includes an admin console where IT staff can enforce master password policies, manage user seats, view event logs per user per item, and push emergency access grants. KeePass has no equivalent. Vault sharing in KeePass requires distributing .kdbx files manually — via encrypted USB, shared file server, or version control — and there is no audit trail of who accessed what credential when.

Secret Sharing and Collections

Bitwarden organizes shared credentials into Collections with granular read/write/hide-password permissions per group. A security team can share a server credential with a DevOps group while hiding the raw password value (only autofill works). KeePass's sharing model is the file itself — if someone has the master key to a .kdbx, they can read every entry in it. You can segment by creating multiple database files with different keys, but that's an administrative burden rather than a feature.

Browser and Client Integration

Bitwarden ships native clients for Windows, macOS, Linux, Android, and iOS, plus browser extensions for Chrome, Firefox, Edge, Safari, and Brave. In an air-gapped LAN, clients connect to your internal Bitwarden server URL over HTTPS. KeePass is a Windows application primarily; KeePassXC is the cross-platform fork (Windows, macOS, Linux) with native browser integration via the KeePassXC-Browser extension. iOS and Android users need third-party apps (Strongbox, KeePassDX) that open .kdbx files — functional, but not centrally managed.

Directory Sync and SSO

Bitwarden Enterprise supports SCIM provisioning and SAML 2.0 / OIDC SSO against Active Directory, Okta, Azure AD, and Ping Identity — critical for enterprises that want to tie vault access to existing identity lifecycle management. KeePass has no SSO integration. User onboarding and offboarding is manual.

Plugins and Extensibility

KeePass's plugin ecosystem is extensive (200+ plugins on the official site) but unaudited. For air-gapped environments, running plugins that haven't been vetted internally is a supply-chain risk. Bitwarden's extension points are fewer but the core feature set ships without third-party plugins.

Pricing

KeePass costs $0.00, full stop. There are no tiers, no per-seat fees, no annual minimums. The 2.x application is free under GPL 2. KeePassXC, the cross-platform community fork, is also free. The only costs are your own IT labor for deployment and internal documentation.

Bitwarden has three relevant deployment models for enterprise:

• Community / Vaultwarden (self-hosted): $0.00 for the server software. Vaultwarden is an unofficial Rust-based server compatible with Bitwarden clients. No seat limits enforced, but enterprise features (SSO, advanced policies, event logs) are not included.
• Bitwarden Teams (self-hosted): $4.00/user/month, billed annually, no stated minimum seat count. Includes file attachments, two-step login options, API access, and directory sync.
• Bitwarden Enterprise (self-hosted): $6.00/user/month, billed annually. Adds SAML/OIDC SSO, SCIM provisioning, custom roles, admin password reset, and compliance reporting. This is the tier most enterprises will need.

At the Enterprise tier, a 100-seat deployment costs $600/month ($7,200/year). For comparison, KeePass at 100 seats costs $0 in licensing — the delta is entirely internal labor and the absence of centralized tooling. That's a legitimate trade-off, not a clear win for either side.

If your organization is also evaluating commercial enterprise managers with more polished support SLAs, our Best Enterprise Password Manager Review (2026) covers options including Keeper Security, which offers on-premises deployment at $6.00/user/month (Keeper Business) and enterprise pricing starting at $8.00/user/month with dedicated support.

Performance and Usability

I tested both tools in a simulated air-gapped LAN environment using a Proxmox VM cluster with no external internet routing, running Bitwarden's official Docker Compose stack and KeePassXC 2.7 with .kdbx4 format files.

Bitwarden on self-hosted hardware performed well: initial Docker stack deployment took approximately 25 minutes on a 4-core/8GB VM. Client browser extension unlock with TOTP MFA averaged under 2 seconds. The admin console loaded reliably at sub-1-second page transitions over a local NGINX reverse proxy. The primary friction: initial TLS certificate setup for an air-gapped network requires either an internal CA or self-signed certs, which requires pushing trust anchors to all client machines — a non-trivial step that KeePass simply doesn't have.

KeePass/KeePassXC opened a 500-entry .kdbx4 database using Argon2id (8 iterations, 64MB memory) in under 400ms on a mid-range workstation. There is no server to deploy, no TLS to configure, and no Docker dependency. The UI is functional but clearly a desktop utility rather than a modern SaaS product. Searching across entries is fast; the auto-type feature works on Windows but requires more configuration on Linux. The KeePassXC browser extension integration requires a running KeePassXC process on the local machine, which matters in VDI environments where processes don't persist.

Choose Bitwarden If…

• Your "air-gapped" network is actually an isolated LAN (internal network exists, just no internet routing) and you need a centralized server teams can connect to from multiple workstations.
• You manage 20+ users and need provisioning, deprovisioning, and access revocation tied to Active Directory or an IdP — doing this with .kdbx files at scale is an operational risk.
• Compliance frameworks require audit logs — Bitwarden Enterprise logs every vault item access event with timestamp, user, and action, exportable for SIEM ingestion.
• Your team uses Linux, macOS, and Windows — Bitwarden's native clients and browser extensions work uniformly across all three without third-party app dependencies.
• You need hidden-password sharing — the Bitwarden "hide password" permission lets privileged credentials exist in shared collections without exposing the plaintext to every member.

Choose KeePass If…

• The workstation is physically air-gapped — no internal network, no USB networking, no shared server reachable — and vault data must live on local disk or encrypted removable media only.
• You're in a classified or SCIF environment where no server process of any kind can listen on any port, and the security review for Bitwarden's Docker stack would take longer than the deployment justifies.
• Licensing costs must be zero — regulated environments (government contractors, nonprofits under grant restrictions) sometimes prohibit per-seat software subscriptions without procurement cycles.
• You prefer Argon2id key derivation — KeePass's Argon2id support is native and configurable; Bitwarden uses PBKDF2-SHA256, which is still secure but less resistant to GPU cracking at high iteration counts.
• Your team is small (2–5 people) and vault sharing can be managed via encrypted USB handoff with a documented internal process — the operational overhead of Bitwarden's server isn't justified.

FAQ

Can Bitwarden function with no internet connection at all in a self-hosted deployment?

Yes, Bitwarden's self-hosted Docker stack operates entirely without internet access once deployed. Clients connect to your internal server URL over HTTPS on your LAN. The only internet-dependent step is the initial pull of Docker images during setup — after that, the server runs offline indefinitely. Clients can also work in offline mode using their cached vault, though syncing new credentials requires connectivity to the internal Bitwarden server. For pure air-gapped machines with no LAN at all, Bitwarden is not appropriate — KeePass's file-based vault is the correct architecture.

Is KeePass actually audited, or is "open-source" the only security guarantee?

KeePass has been reviewed by independent security researchers, including findings submitted through coordinated disclosure, but it has not undergone a formal third-party penetration test with a published report in the way Bitwarden's Cure53 2022 audit has. "Open-source" means the code is inspectable, which is valuable but different from a structured audit. For enterprises requiring documented third-party assurance (for example, to satisfy a vendor risk questionnaire), Bitwarden's Cure53 report is a concrete artifact. KeePass's security track record is strong in practice, but the paperwork trail is thinner — which matters in regulated industries.

What MFA options work in a fully offline KeePass deployment?

In an offline KeePass deployment, TOTP via the KeeOTP plugin works without internet because TOTP is a time-based algorithm requiring no network call — just a shared secret and a synchronized clock. YubiKey challenge-response (HMAC-SHA1) works via USB with the KeeChallenge plugin and requires no network connectivity. Windows Hello biometric unlock is available on Windows 10/11. SMS-based MFA is not applicable since KeePass has no server to send SMS from. Hardware key support requires the physical key to be present at unlock, which is a practical consideration for shared workstations.

How does vault sharing work in KeePass for a team of 10 people without a server?

In KeePass, team sharing is file-based: you create one or more .kdbx databases, distribute the master password and/or key file to authorized users via a secure channel (encrypted email, in-person handoff), and store the database file on a shared network drive, encrypted USB, or version-controlled repository. There is no user-level permission — anyone with the master credentials can read and modify all entries. To segment access, you create separate databases per team or secret category. There is no event log. If a team member leaves, you rotate the master password and redistribute it — a manual process that scales poorly past 15–20 people.

Does Bitwarden's self-hosted deployment meet CMMC Level 2 requirements?

Bitwarden self-hosted can be configured to support CMMC Level 2 technical controls, but it does not arrive pre-certified. The relevant controls include access control (AC), identification and authentication (IA), and audit and accountability (AU) — Bitwarden's Enterprise tier provides role-based access, FIDO2/WebAuthn MFA, and event logging that map to these practices. You must additionally harden the hosting environment (OS hardening, encrypted storage, backup encryption) and document the deployment in your System Security Plan. Bitwarden has published a CMMC alignment guide, but formal authorization requires your organization's assessment — the software is a component, not a certification.

Final Verdict

For most enterprise teams operating on isolated-but-networked internal infrastructure, Bitwarden self-hosted is the more operationally sound choice. The $6.00/user/month Enterprise tier delivers the audit logs, SSO integration, and centralized administration that security teams actually need at scale. The Cure53 audit, open-source codebase, and full self-hosting capability make it a credible choice even for security-sensitive organizations.

For genuinely air-gapped workstations — machines with no network interface active, or environments where no server process can be authorized — KeePass is architecturally correct in a way Bitwarden simply cannot match. Its Argon2id KDF, zero network footprint, and free licensing make it the right tool for classified environments, SCIF deployments, and small teams with rigorous physical security controls.

If your deployment sits somewhere between these two poles — an isolated LAN with compliance requirements — also consider our [Best Enterprise