_Why_ do you trust Bitwarden?
I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.
I picked Bitwarden because it’s widely trusted, it’s trusted because it’s open source and widely assumed to be casually audited by many _other_ people. There’s a weak point here in how many of us are relying on others to do the audit, in a bystander effect sense. I don’t think either of these are BW specific, which just shows there’s a large family of wise options.
https://bitwarden.com/blog/bitwarden-network-security-assess...
You could also say this about Microsoft, except they've been breaking such trust for a long time.
If my windows is compromised no amount of tech wizardry can protect my 1password credentials.
That, combined with a host of other lock-in factors (the strong emotional attachments that people have to being a "PC person" and not a "Mac person", the relative expensiveness of devices that run MacOS, the software that only runs on Windows, the UX difference between platforms) put Windows in an entirely different class than password managers.
Password managers are a commodity. Operating systems are not. Microsoft knows this, and they abuse it accordingly.
Plus I use the password manager baked into my browser, so I'm basically trusting it anyways.
Why trust BW over other providers? Because of third-party audits and signals of good-faith like open source.
Why trust BW over self-hosting? Well, I don't. Or rather I have more confidence in being able to recover from a failure on my part, nevermind that they're probably less likely to suffer from technical issues.
And the irony is that the one website I can't trust my password manager to protect me from phishing attacks on is the password manager's own web interface. So I always want to log in with one of the non-web clients, and only trust the web vault if I reached it via a known-good link (like the one in the settings panel of the browser addon and mobile apps).