Bitwarden

Whether you're an individual, part of a team, or managing a business, Bitwarden helps you store, share, and sync your data safely across all your devices. With secure cloud syncing, you can access your vault anytime, anywhere – on mobile, desktop, or web.

Password theft is a growing threat. Every day, websites and apps face attacks that can expose your credentials. Reusing passwords puts all your accounts at risk – from email to banking. Bitwarden helps you generate and manage strong, unique passwords to keep your information safe.

How secure is Bitwarden's encryption?

Bitwarden uses zero-knowledge encryption, meaning your data is encrypted locally on your device before it is ever sent to their servers. It employs AES-256 encryption (AES-CBC) alongside PBKDF2 SHA-256 or Argon2id key derivation. The encryption key is generated from your master password locally and never leaves your device. Only an irreversible hash of your password is sent to authenticate you, not the key itself.

What is the difference between Bitwarden's free and paid tiers?

Bitwarden offers a free account that includes core features like unlimited passwords, cross-device syncing, and TOTP seed storage. Premium (~$10/year) adds extras such as 1 GB encrypted file attachments, integrated TOTP code generation, YubiKey/FIDO2 support, and the ability to set up trusted emergency contacts.

How can I recover if I'd forgotten my master password?

Bitwarden is a zero-knowledge system and doesn't store or recover your master password. Without it – and without a backup – you can't decrypt your vault. However, premium users can designate emergency contacts who can request access in emergencies.

Is Bitwarden trustworthy?

Yes, Bitwarden is trustworthy. It uses end-to-end encryption, is open source, regularly audited by third parties, and offers strong security features like two-factor authentication and hardware key support.

Should I use generated passwords and enable 2FA for Bitwarden and other sites?

Absolutely. It's best to use Bitwarden's built-in password generator (15 – 25 characters with symbols, numbers, etc.). For your vault, enable two-factor authentication: using options like an authenticator app, FIDO2 key (YubiKey), or email recovery. You can also store TOTP seeds in your vault for use with other services.

Features

Bitwarden is a solid free password manager for several reasons:

• It is open-source and regularly audited for security
• Its core features are free, with no device or entry limits
• Uses 256-bit AES end-to-end encryption
• Allows unlimited device usage with secure syncing
• Stores passwords, secure notes, credit cards, and identities
• Supports free sharing between 2 users (via a free organization)
• Integrates with email alias services like SimpleLogin and Firefox Relay

End-to-End Encryption

Lock your passwords and private information with end-to-end AES-256 bit encryption, salted hashing, and PBKDF2 SHA-256.

Cross-Platform Applications

Secure and share sensitive data within your Bitwarden Vault from any browser, mobile device, or desktop application.

Global Community

Align to the highest security standards with a global community of password security experts and Bitwarden users.

How do you stay safe?

Security experts recommend that you use a different, randomly generated password for every online account that you create. But how are you supposed to remember and keep up with that many passwords? Bitwarden helps you create and manage secure passwords so that you can get back to enjoying your life online.

Sync all of Your Devices

A password manager is useless if you can't easily access it. Our secure cloud syncing features allow you to access your data from anywhere, on any device! Your vault is conveniently optimized for use on desktop, laptop, tablet, and phone devices.

Since all of your data is fully encrypted before it ever leaves your device, only you have access to it. Not even the team at Bitwarden can read your data, even if we wanted to. Your data is sealed with end-to-end AES-256 bit encryption, salted hashing, and PBKDF2 SHA-256.

What's New

Community Highlight

• [PM-42038] Add desktop biometric unlock support to the CLI by @nurfed1 in #22448
• [PM-43951] Add rotation icons (calendar, pause-circle, resume) by @reneelund08 in #23346
• [PM-42997] Clear policiesNew state when the sync response contains no policies by @tom27052006 in #22929
• [PM-42977] Added a length to the passphrase generated by @Jbziscool in #22906
• [PM-44145] [PM-24830] Add regression test for Chrome CSV note import by @MrSerWin in #23506
• [PM-44109] Fix: LastPass direct import corrupts non-ASCII characters (bullets, smart quotes) by @jaykaplon in #23481
• [PM-44235] Group 1Password import sources and add the direct import dialogs by @detunized in #23559
• Feature Development
• [PM-42846] Wire up the invite link callout dialog by @BTreston in #23217
• [PM-43141] Introduce new import source component by @harr1424 in #23031
• Updated extension icon size by @trmartin4 in #23342
• [PM-38885] feat: Show sales rep contact message on sales-assisted trial banner by @cyprain-okeke in #23036
• [PM-40417] feat: Source the Premium to organization upgrade cart from the invoice preview by @cyprain-okeke in #23048
• [PM-44001] Add pm-43231-access-intelligence-performance-at-scale feature flag by @Banrion in #23366
• [PM-43143] Admin Console owned importer changes by @harr1424 in #23198
• feat(dev-ex): Add a debug launch script for the CLI by @quexten in #23273
• Autotype GA: port MVP type input and add execute_autotype by @neuronull in #23335
• [PM-43679] Adjust min-width so that long vendor names are truncated by @harr1424 in #23352
• [PM-43142] Vault owned importer changes by @harr1424 in #23197
• Updated icons with sized versions. by @trmartin4 in #23425
• [PM-42836] feat: Update the sponsored Families redemption page for VFO1 by @cyprain-okeke in #23304
• [PM-39106] Remove pm-34423-staged-status feature flag by @sven-bitwarden in #23422
• [PM-43756] Terminology/description change quickly for autofill policy by @JaredScar in #23363
• [PM-40421] feat: Preview-driven premium subscription page with applied-balance cart by @amorask-bitwarden in #23390
• [PM-43684] Show Decryption failures and dialog in VFO1 UX on Web by @shane-melton in #23298
• [PAM-242] Mount the PAM nav slot in the individual user layout by @Hinton in #23483
• [PM-39411] feat: Wire flight recorder into clients behind flag by @dani-garcia in #23448
• feat: Toast automation biometric requests and results by @quexten in #23482
• [CL-1316] feat: Make the vfo1 side nav logo header sticky on scroll by @BryanCunningham in #23339
• [PM-44120] Isolate Beta desktop keychain entries from stable by @trmartin4 in #23485
• [PM-41920] Add WiFi network and unknown item type handling to Proton Pass by @mcamirault in #23156
• [CL-1327] Remove rounded desktop corner from non-Mac OS by @vleague2 in #23498
• [PM-40550][PM-40553] Remove batch bar feature flags by @nick-livefront in #23456
• [PM-42229] Update accordion height to auto in shared folder card grid by @jengstrom-bw in #23561
• [PM-31298][PM-31299] Remove webauthn related origins feature flag by @djsmith85 in #23229
• [PM-43938] Call new organization collections endpoint behind performance flag by @Banrion in #23417
• [PM-44425] Add SDK-backed organization login cipher fetch to CipherService by @shane-melton in #23610
• [PM-43785] Login only organization cipher fetch for Access Intelligence by @Banrion in #23567

Breaking Changes

• [PM-42019] SDK breaking change fix: pass collection type arg to SDK importer by @harr1424 in #23306
• PM-41073: Consume breaking changes from SDK making all children of CipherView decrypted by @nikwithak in #22245

Bug fixes

• [PM-42038] Gate CLI desktop biometric unlock behind a flag by @quexten in #23333
• [PM-42474] fix: validate initiator in auto-submit redirect handler by @bensbits91 in #23078
• [PM-43844] Remove extra space between Import and Add buttons in table header by @jengstrom-bw in #23341
• [PM-43945] Adds trimming/sanitization to frontend of sending invites to emails v… by @JaredScar in #23300
• [PM-43846] Prepopulate import dialog by @nick-livefront in #23345
• fix: track vault items table rows by cipher id to prevent icon flicker by @nick-livefront in #23256
• [PM-43777] Password Manager product switcher focus highlight gets stuck on by @jengstrom-bw in #23347
• [PM-43971] Hide callout if link is already configured by @BTreston in #23367
• [PM-43844] Move tw-hidden to coachmark component by @jengstrom-bw in #23391
• [PM-43728] VFO1 Item Id query param handling by @shane-melton in #23302
• [PM-43970] Work around for saving domains via the tour by @BTreston in #23388
• [PM-43841] Update URL terminology by @BTreston in #23364
• [PM-44114] Revert change detection by @BTreston in #23484
• [PM-44084] Utilizes the vfo name for success toast when the vfo1 foundation flag on by @JaredScar in #23460
• [PM-44040] fix: Remove period and em dash in My folders empty state by @gbubemismith in #23470
• [PM-44038] Move Add plan next to Subscription in settings nav by @jaasen-livefront in #23471
• [PM-44072] Drop the startup sync from desktop init by @quexten in #23447
• [PM-44071] Dedupe key state emissions by @quexten in #23446
• [PM-43947] Allow share when org settings allow owners/admins to manag… by @mcamirault in #23349
• [PM-44070] Emit feature flags only when their value changes by @quexten in #23445
• PM-39391 resolved flickering when toggling send rows by @bmbitwarden in #23328
• Auth/PM-40943 - Extension - Duo 2FA - Improve DuoResult Validation by @JaredSnider-Bitwarden in #23224
• PM-43842 changed folder label on import by @bmbitwarden in #23435
• [CL-1342] Independent Browser Filters by @nick-livefront in #23494
• [PM-42019] Fix import folder/collection count logic by @harr1424 in #23266
• PM-44046: bugfix: Decryption error is returned when the user leaves org by @nikwithak in #23496
• [PM-43358] fix: Fix account switcher badge icon spacing by @nick-livefront in #23578
• [PM-44197] Decrypt refreshed ciphers via CipherService by @quexten in #23542
• [PM-44222] Keep item URL params while the reprompt is open by @shane-melton in #23586
• [PM-44269] use native messaging for Safari biometrics when SDK IPC is on by @mzieniukbw in #23566
• [PM-44101] fix: Add truncate option to bitLink and truncate shared folder names by @nick-livefront in #23577
• [PM-41263][PM-41035] Add userId on auto-confirm method chain by @trmartin4 in #23428
• [PM-43786] perf(dirt): speed up exposed-password check at scale by @Banrion in #22853
• [PM-44516] Temporarily hide item history on item Sends (#23730) by @mcamirault in #23762
• [PM-44168] Render the popup loading spinner only while loading (#23528) by @willmartian in #23862

Maintenance

• feat(desktop): Connect debug browser and desktop over native messaging by @quexten in #22914
• [PM-42469] communicate sender only through trusted channels by @audreyality in #23249
• [PM-43877] Changes UserStatusPipe to standalone component by @JaredScar in #23301
• [PM-43872] Remove ElectronCachedStorage flag by @dani-garcia in #23299
• [PM-43878] Fixes tech debt and moves away from modules into standalone usage by @JaredScar in #23303
• [CL-1354] Add contributing docs to libs/components by @willmartian in #23365
• chore(crypto): drop TS key connector; the master key and master-key-wrapped-user-key state by @quexten in #23207
• [PM-43919] Remove unused KeyApiService by @trmartin4 in #23376
• [PM-43879] Migrate GroupNameBadgeComponent to standalone and move off of module by @JaredScar in #23305
• refactor: Remove unused KeyConnectorUserKeyResponse by @quexten in #23329
• fillAssistRules url swap by @alex8bitw in #23209
• [PM-43929] Exclude core-js polyfills from Chrome extension build by @coroiu in #23433
• [PM-42900] Ts-strict refactor by @BTreston in #23219
• [PM-34691] Remove copy and quick launch actions feature flag by @jaasen-livefront in #23416
• Bump client version(s) by @github-actions[bot] in #23461
• Bump client version(s) by @github-actions[bot] in #23465
• [PM-25909] Commercial desktop builds by @dereknance in #18094
• [PM-43895] migrate domain verification components to standalone by @BTreston in #23457
• [PM-43894] Migrate providers list componet to standalone by @BTreston in #23459
• [PM-43884] Standalone migrations for ReportsHomeComponent by @JaredScar in #23493
• QA-2489/add-data-testid-bit-select-value by @ddanielyan in #23530
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23474
• docs: Deprecate format-internal fields on Cipher by @quexten in #23549
• [PM-42124] Move sass and sass-loader to be owned by UIF by @djsmith85 in #22488
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23473
• [PM-43880] VaultFilterComponent to standalone migration by @JaredScar in #23487
• [PM-43883] Make bulk components standalone by @JaredScar in #23492
• [PM-44130] Access Intelligence: Remove Add-Padding header for HIBP requests by @lastbestdev in #23500
• [BRE-2283] Use the supplied release notes verbatim for the Mac App Store by @pixman20 in #23537
• [BRE-2283] Remove the Mac App Store Fastfile now that deploy owns it by @pixman20 in #23557
• [PM-43942] Access Intelligence: Use stored icon URIs for loading application icons by @lastbestdev in #23421
• [PM-44196] Remove dead encryptObjProperty from CipherService by @quexten in #23541
• [PM-38193] Remove pm-29968-fill-after-save feature flag by @shane-melton in #23427
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23472
• Platform/PM-44117 - SDK client settings - Set device identifier by @JaredSnider-Bitwarden in #23539
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23574
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23576
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23575
• [PM-37683] Remove pm-32016-remove-at-risk-callout feature flag by @shane-melton in #23426
• [PM-31967] Remove pm-31039-item-action-in-extension feature flag by @shane-melton in #23429
• [PM-28191] - remove pm-28191-cipher-admin-ops-to-sdk feature flag by @jaasen-livefront in #23564
• Mute flaky filter menu story for now by @vleague2 in #23595
• [PM-28190] - remove pm-28190-cipher-sharing-ops-to-sdk from clients feature flag by @jaasen-livefront in #23563
• Tools/PM-44409 - CLI - Send Receive command - Add Device Identifier Header to send access token request by @JaredSnider-Bitwarden in #23607
• Autosync Crowdin Translations for desktop by @bw-ghapp[bot] in #23614
• Autosync Crowdin Translations for browser by @bw-ghapp[bot] in #23615
• Autosync Crowdin Translations for web by @bw-ghapp[bot] in #23616
• ci: Sign Windows Stable Appx by @iinuwa in #23600
• Sign Electron Framework files in parallel on macOS by @iinuwa in #23580
• [PM-41279] refactor: Remove pm-40435-quick-copy-icon-setting feature flag by @jaasen-livefront in #23613
• [PM-39412] refactor: Delegate renderer log write to super.write by @dani-garcia in #23495
• Bump client version(s) by @github-actions[bot] in #23647
• [BRE-2323] Use correct Safari build for each macOS build by @vgrassia in #23697
• [BRE-2234] Cherry-pick macOS provisioning profile and Safari artifact fixes to rc by @pixman20 in #23768
• [PM-44917] Cherry pick browser health OSS move by @ttalty in #23845

Dependency Updates

• [PM-40862][PM-40850] deps: Update Angular build toolchain and Storybook to clear advisories by @BryanCunningham in #23294
• [deps] Update rustls to 0.23.45 (RUSTSEC-2026-0285) by @coroiu in #23375
• Update sdk-internal to 0.2.0-main.1046 by @bw-ghapp[bot] in #23370
• [deps] Platform: Update browserslist to v4.28.7 [SECURITY] by @renovate[bot] in #23449
• [deps]: Update actions/setup-node action to v7 by @renovate[bot] in #23453
• [deps] Vault: Update multer to v2.3.0 [SECURITY] by @renovate[bot] in #23451
• [deps] Platform: Roll back browserslist transitives to unblock npm ci by @mandreko-bitwarden in #23468
• [deps] Platform: Update Rust crate dirs to v7 by @renovate[bot] in #23516
• [deps]: Update dtolnay/rust-toolchain digest to 6bed076 by @renovate[bot] in #23509
• [deps] Platform: Update electron to v43.5.0 [SECURITY] by @renovate[bot] in #23560
• [deps] Platform: Pin electron's nested @types/node to 24.13.6 by @mandreko-bitwarden in #23570
• Update sdk-internal to 0.2.0-main.1066 by @bw-ghapp[bot] in #23430
• Update sdk-internal to 0.2.0-main.1068 by @bw-ghapp[bot] in #23590
• Update sdk-internal to 0.2.0-main.1073 by @bw-ghapp[bot] in #23599
• Update sdk-internal to 0.2.0-main.1074 by @bw-ghapp[bot] in #23612
• Update sdk-internal to 0.2.0-main.1075 by @bw-ghapp[bot] in #23621