Bitwarden Secrets Manager is Bitwarden’s product for storing infrastructure secrets and delivering them to applications, pipelines and developers. It is “tailored for infrastructure secrets and is supported only by the web app and CLI clients”.[2] It is licensed as a separate subscription inside a Bitwarden organization. Bitwarden offers it “for Free, Teams, and Enterprise organizations”. A Families organization that wants Secrets Manager must create a new Free organization for it.[1] The two licensing units are the Secrets Manager user seat and the machine account.
Editions
| Plan | Users | Projects | Machine accounts included | Price (FAQ, USD) | Catalog row |
|---|---|---|---|---|---|
| Free | Up to 2 | Up to 3 | Up to 3 | Free | Secrets Manager Free |
| Teams | Unlimited | Unlimited | Up to 20, extras billed per account | From $6 per user per month | Secrets Manager Teams |
| Enterprise | Unlimited | Unlimited | Up to 50, extras billed per account | From $12 per user per month | Secrets Manager Enterprise |
Sources: Secrets Manager Plans and Secrets Manager FAQs.[1][2] The product page shows the same $6 and $12 per user per month figures.[7]
Teams adds event logs and API access. Enterprise adds SSO integration, SCIM, admin password reset, custom roles and enterprise policies.[1] The Password Manager plan comparison marks Free, Teams and Enterprise organizations as “Eligible for Secrets Manager add-on”.[6]
Relationship to Password Manager
Secrets Manager and Password Manager are separate products that share an organization and its billing. Bitwarden positions Secrets Manager “for developer teams to centrally store, manage, and deploy privileged secrets”. For employees managing personal credentials it points to Password Manager.[2] Both subscriptions appear on the organization’s Billing and Subscription page. An existing Teams or Enterprise organization adds Secrets Manager there with the “Subscribe to Secrets Manager” checkbox.[3] A Secrets Manager Teams subscription therefore sits on a Password Manager Teams organization, and the two are counted separately.
Metrics
Secrets Manager user seat. When Secrets Manager is added, the “User seats” field sets the seats to purchase. That number “must be lower than or equal to the number of seats specified for your Password Manager subscription”.[3] Every Secrets Manager user is therefore also a Password Manager seat holder, and the Secrets Manager seats are a subset. Catalog proof: Secrets Manager seats cannot exceed Password Manager seats.
Machine account. “Machine accounts represent non-human machine users, like applications or deployment pipelines, that require programmatic access to a discrete set of secrets.”[4] They were called service accounts until release 2024.4.1. The number available is assigned on the Admin Console Billing and Subscription page.[4] Deleting a machine account removes it fully but does not delete its secrets.[4] Catalog proof: Machine accounts represent non-human users with programmatic access.
Counting / floors
Included allowances. Teams includes “Up to 20 machine accounts included, with extra accounts billed per account”. Enterprise includes up to 50 on the same basis.[1] Extra accounts are entered in the “Additional machine accounts” field. Bitwarden describes Teams and Enterprise as “pre-packaged with 20 and 50 machine accounts, respectively”.[3] Catalog row: Additional machine accounts. Catalog proof: Secrets Manager machine accounts included by plan; extras billed per account.
Automatic scaling. “Adding additional User seats and machine accounts will be automatically scaled and added to your subscription.” Admins who do not want this select “Limit subscription” and/or “Limit machine accounts”.[3] Without a limit, a pipeline team creating machine accounts adds billable units directly. Catalog proof: Secrets Manager seats and machine accounts scale automatically unless limited.
Older allowances. The Enterprise trial guide still says Teams and Enterprise “come pre-packaged with 50 and 200 service accounts, respectively”.[5] Organizations that signed up under earlier terms should check the allowance shown on their own subscription page, not rely on either help page.
Access model
Licensing follows the access model. Secrets are grouped in projects. A machine account is granted a project with one of two permission levels: “Can read” or “Can read, write”.[4] Organization members can be added to a machine account. Those people can then generate access tokens for it and work with every secret it can reach.[4] Event logs record each machine account’s actions, such as accessed secrets and users added or removed.[4]
Two counts therefore matter. The first is the number of people who need the Secrets Manager web app or CLI as users, which consumes Secrets Manager seats. The second is the number of distinct non-human identities that need tokens, which consumes machine accounts. One machine account per pipeline or per application is the pattern the product page describes (“Machine accounts scoped per pipeline and revoked instantly”).[7] Deleted machine accounts do not go to the trash, so the count falls as soon as one is deleted.[4]
Worked example
A Teams organization has 40 Password Manager seats. Twelve engineers use Secrets Manager, and 26 deployment pipelines each get their own machine account. Under the rules above, the organization buys 12 Secrets Manager seats, which must be no more than the 40 Password Manager seats. It also buys 6 additional machine accounts beyond the 20 included with Teams.[1][3] Without “Limit machine accounts”, a twenty-seventh pipeline adds a seventh additional account automatically.[3]
Virtualization & partitioning
Not applicable. Machine accounts count identities, not hosts. A single machine account can serve many workloads that share its access token scope, and the documents set no per-host rule.[4]
Cloud / BYOL
Secrets Manager is primarily a cloud service. “Enterprise organizations can self-host Bitwarden Secrets Manager alongside their existing self-hosted installations.” Self-hosters need server version 2023.10.0 or later and a new licence file from the cloud organization.[2] The Secrets Manager Plans comparison still lists the self-host option as “Coming Soon”.[1] Catalog proof: Secrets Manager self-hosting limited to Enterprise organizations. Licence files are covered in Bitwarden self-hosted organization licensing.
SDK
The Secrets Manager SDK repository (sdk-sm) is distributed under the Bitwarden Software Development Kit License Agreement, Version 1, dated 17 March 2023.[8] The newer internal SDK is covered in Bitwarden open source and Bitwarden License.
Programs
- Free plan. The Free plan covers up to 2 users, 3 projects and 3 machine accounts with unlimited secret storage.[1]
- Enterprise trial. Secrets Manager can be added during the 14-day Enterprise trial set-up.[5]
Out of scope
- Prices of additional machine accounts, which were not captured.
- Bitwarden Password Manager seats, covered in Bitwarden Terms of Service and seat billing.
- Integrations (GitHub Actions, Kubernetes Operator, Terraform provider), which do not change licensing.