# Does Bitwarden use Secure Remote Password (SRP) protocol **URL:** \ **Category:** Password Manager\ **Tags:** server:default-cloud, app:all\ **Created:** [January 13, 2023, 3:47pm UTC](https://community.bitwarden.com/t/does-bitwarden-use-secure-remote-password-srp-protocol/48859 "2023-01-13T15:47:13Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![Sizzle6397](https://avatars.discourse-cdn.com/v4/letter/s/cc9497/32.png) [@Sizzle6397](https://community.bitwarden.com/u/Sizzle6397)\ **Post date:** [January 13, 2023, 3:47pm UTC](https://community.bitwarden.com/t/does-bitwarden-use-secure-remote-password-srp-protocol/48859/1 "2023-01-13T15:47:13Z")
The [1Password website](https://1password.com/switch/) claims that Bitwarden does **not** use the Secure Remote Password (SRP) protocol. If this is true, then it’s a potential security vulnerability in Bitwarden. Can anyone confirm if this is true? ![1password](https://us1.discourse-cdn.com/flex001/uploads/bitwarden1/original/3X/7/8/78c520d2c86f3ea8d5560dbd387a5a55bed4de83.png) ---
**Author:** ![cksapp](https://sea1.discourse-cdn.com/flex001/user_avatar/community.bitwarden.com/cksapp/32/10869_2.png) [@cksapp](https://community.bitwarden.com/u/cksapp)\ **Post date:** [January 13, 2023, 5:46pm UTC](https://community.bitwarden.com/t/does-bitwarden-use-secure-remote-password-srp-protocol/48859/2 "2023-01-13T17:46:06Z")
For relevance the related [1Password blog](https://blog.1password.com/developers-how-we-use-srp-and-you-can-too/) on the topic, as well as their [public GitHub repo](https://github.com/1Password/srp) for the implementation of SRP. Working my way through this one now. ---
**Author:** ![grb](https://sea1.discourse-cdn.com/flex001/user_avatar/community.bitwarden.com/grb/32/22038_2.png) [@grb](https://community.bitwarden.com/u/grb)\ **Post date:** [January 13, 2023, 6:55pm UTC](https://community.bitwarden.com/t/does-bitwarden-use-secure-remote-password-srp-protocol/48859/3 "2023-01-13T18:55:36Z")
@cksapp See also Appendix B in the [1Password Security Whitepaper](https://1passwordstatic.com/files/security/1password-white-paper.pdf). The blog (nor the screenshot above) doesn’t make a case for why this extra “layer” is needed (i.e., what would be a hypothetical attack scenario in which the SRP protocol would make a difference?). In addition, [this article](https://www.cryptologie.net/article/503/user-authentication-with-passwords-whats-srp/) (which also contains some history of SRP and a detailed explanation of the protocol) concludes with a section titled _Should I use SRP today?_ which does not exactly endorse SRP (e.g., it quotes the following excerpt from an [article by Matthew Green](https://blog.cryptographyengineering.com/should-you-use-srp/): **“In summary, SRP is just weird. It was created in 1998 and bears all the marks of a protocol invented in the prehistoric days of crypto. It’s been repeatedly broken in various ways, though the most recent [v6] revision doesn’t seem obviously busted — as long as you implement it carefully and use the right parameters. It has no security proof worth a damn…”**). _Edit:_ On further research, SRP is a type of Password-Authenticated Key Exchange (PAKE), and as explained in [this article on OPAQUE](https://blog.cloudflare.com/opaque-oblivious-passwords/) (a PAKE protocol that is superior to SRP), PAKEs are designed for the use-case in which servers handle passwords in cleartext. Thus, this approach does not seem to be applicable to a zero-knowledge login process such as that used by Bitwarden. For 1Password to tout SRP as a differentiator over other password managers has the hallmarks of a marketing strategy rather than a real security benefit. ---
**Author:** ![Nail1684](https://sea1.discourse-cdn.com/flex001/user_avatar/community.bitwarden.com/nail1684/32/47626_2.png) [@Nail1684](https://community.bitwarden.com/u/Nail1684)\ **Post date:** [January 23, 2026, 3:58am UTC](https://community.bitwarden.com/t/does-bitwarden-use-secure-remote-password-srp-protocol/48859/4 "2026-01-23T03:58:59Z")
Closed on January 23, 2026, 3:58am UTC