Bitwarden is a

freemium Freemium, a portmanteau of the words "free" and "premium," is a pricing strategy by which a basic product or service is provided free of charge, but money (a premium) is charged for additional features, services, or virtual (online) or physical (o ...

open-source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized sof ...

password management service that stores sensitive information such as website credentials in an

encrypted In cryptography, encryption is the process of encoding information. This process converts the original representation of the information, known as plaintext, into an alternative form known as ciphertext. Ideally, only authorized parties can decip ...

vault. The platform offers a variety of client applications including a web interface,

desktop application A desktop traditionally refers to: * The surface of a desk (often to distinguish office appliances that fit on a desk, such as photocopiers and printers, from larger equipment covering its own area on the floor) Desktop may refer to various compu ...

browser extension A browser extension is a small software module for customizing a web browser. Browsers typically allow a variety of extensions, including user interface modifications, cookie management, ad blocking, and the custom scripting and styling of web p ...

mobile app A mobile application or app is a computer program or software application designed to run on a mobile device such as a phone, tablet, or watch. Mobile applications often stand in contrast to desktop applications which are designed to run on d ...

s, and a

command-line interface A command-line interpreter or command-line processor uses a command-line interface (CLI) to receive commands from a user in the form of lines of text. This provides a means of setting parameters for the environment, invoking executables and pro ...

. Bitwarden offers a free cloud-hosted service as well as the ability to self-host. Desktop applications are available for

Windows Windows is a group of several proprietary graphical operating system families developed and marketed by Microsoft. Each family caters to a certain sector of the computing industry. For example, Windows NT for consumers, Windows Server for serv ...

MacOS macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac computers. Within the market of desktop and lapt ...

, and

Linux Linux ( or ) is a family of open-source Unix-like operating systems based on the Linux kernel, an operating system kernel first released on September 17, 1991, by Linus Torvalds. Linux is typically packaged as a Linux distribution, which ...

. Browser extensions include those for Chrome,

Firefox Mozilla Firefox, or simply Firefox, is a free and open-source web browser developed by the Mozilla Foundation and its subsidiary, the Mozilla Corporation. It uses the Gecko rendering engine to display web pages, which implements current and ...

Safari A safari (; ) is an overland journey to observe wild animals, especially in eastern or southern Africa. The so-called "Big Five" game animals of Africa – lion, leopard, rhinoceros, elephant, and Cape buffalo – particularly form an importa ...

Edge Edge or EDGE may refer to: Technology Computing * Edge computing, a network load-balancing system * Edge device, an entry point to a computer network * Adobe Edge, a graphical development application * Microsoft Edge, a web browser developed by ...

Opera Opera is a form of theatre in which music is a fundamental component and dramatic roles are taken by singers. Such a "work" (the literal translation of the Italian word "opera") is typically a collaboration between a composer and a librett ...

Vivaldi Antonio Lucio Vivaldi (4 March 1678 – 28 July 1741) was an Italian composer, virtuoso violinist and impresario of Baroque music. Regarded as one of the greatest Baroque composers, Vivaldi's influence during his lifetime was widespread a ...

, Brave and

Tor Tor, TOR or ToR may refer to: Places * Tor, Pallars, a village in Spain * Tor, former name of Sloviansk, Ukraine, a city * Mount Tor, Tasmania, Australia, an extinct volcano * Tor Bay, Devon, England * Tor River, Western New Guinea, Indonesia Sc ...

. Mobile apps for

Android Android may refer to: Science and technology * Android (robot), a humanoid robot or synthetic organism designed to imitate a human * Android (operating system), Google's mobile operating system ** Bugdroid, a Google mascot sometimes referred to ...

, iPhone, and

iPad The iPad is a brand of iOS and iPadOS-based tablet computers that are developed by Apple Inc. The iPad was conceived before the related iPhone but the iPhone was developed and released first. Speculation about the development, operating s ...

are available. Client functionalities include

2FA Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...

login In computer security, logging in (or logging on, signing in, or signing on) is the process by which an individual gains access to a computer system by identifying and authenticating themselves. The user credentials are typically some form ...

, passwordless login,

biometric Biometrics are body measurements and calculations related to human characteristics. Biometric authentication (or realistic authentication) is used in computer science as a form of identification and access control. It is also used to identify in ...

unlock,

random password generator A random password generator is Computer software, software program or Computer hardware, hardware device that takes input from a random or pseudo-random number generator and automatically generates a password. Random passwords can be generated man ...

password strength Password strength is a measure of the effectiveness of a password against guessing or brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to gues ...

testing tool, login/form/app

autofill Autofill is a function found in some computer applications or programs, typically those containing forms, which prefills a field automatically and can save a user time. A web browser's autofill feature is used to fill out forms with previously en ...

, syncing across unlimited platforms and devices, storing unlimited number of items, sharing credentials, and storing variety of information including credit cards.

Features

;Overall security *

Open-source Open source is source code that is made freely available for possible modification and redistribution. Products include permission to use the source code, design documents, or content of the product. The open-source model is a decentralized sof ...

codebase * Zero-knowledge encryption, i.e, the company can't see the vault contents *

End-to-end encryption End-to-end encryption (E2EE) is a system of communication where only the communicating users can read the messages. In principle, it prevents potential eavesdroppers – including telecom providers, Internet providers, malicious actors, and even ...

of the stored vault data * Uses

AES-CBC In cryptography, a block cipher mode of operation is an algorithm that uses a block cipher to provide information security such as confidentiality or authenticity. A block cipher by itself is only suitable for the secure cryptographic transforma ...

256-bit to encrypt vault data, and

PBKDF2 In cryptography, PBKDF1 and PBKDF2 (Password-Based Key Derivation Function 1 and 2) are key derivation functions with a sliding computational cost, used to reduce vulnerabilities of brute-force attacks. PBKDF2 is part of RSA Laboratories' Publ ...

SHA-256 SHA-2 (Secure Hash Algorithm 2) is a set of cryptographic hash functions designed by the United States National Security Agency (NSA) and first published in 2001. They are built using the Merkle–Damgård construction, from a one-way compression ...

to derive user's

encryption key A key in cryptography is a piece of information, usually a string of numbers or letters that are stored in a file, which, when processed through a cryptographic algorithm, can encode or decode cryptographic data. Based on the used method, the key c ...

from the entered password. * Third-party independent application/code-library/network-infrastructure audits and

bug bounty program A bug bounty program is a deal offered by many websites, organizations and software developers by which individuals can receive recognition and compensation for reporting bugs, especially those pertaining to security exploits and vulnerabiliti ...

; Vault storage * Cloud synchronization (

Microsoft Azure Microsoft Azure, often referred to as Azure ( , ), is a cloud computing platform operated by Microsoft for application management via around the world-distributed data centers. Microsoft Azure has multiple capabilities such as software as a ...

)with free version being able to sync across unlimited platforms and devices * Can self-host the Bitwarden server

on-premises On-premises software (abbreviated to on-prem, and incorrectly referred to as on-premise) is installed and runs on computers on the premises of the person or organization using the software, rather than at a remote facility such as a server farm ...

, or with services such as

DigitalOcean DigitalOcean Holdings, Inc. () is an American multinational technology company and cloud service provider. The company is headquartered in New York City, New York, USA, with 15 globally distributed data centers worldwide. DigitalOcean provides ...

;Availability * Variety of client applications including a

web interface In the industrial design field of human–computer interaction, a user interface (UI) is the space where interactions between humans and machines occur. The goal of this interaction is to allow effective operation and control of the machine fr ...

s, and a

. * Desktop applications are available for

, and

* Browser extensions are available for Chrome,

, Brave and

. * Mobile apps are available for

, iPhone, and

* 50+ languages and dialects supported, although not all available for all client apps * Free, premium, 6-user account family plans, and business plans are available ; Items * Items types such as logins, secure notes, credit cards, and identitieswhich free version can store in an unlimited number. * Items can be organized into folders * Customizable fields for login/auto-fill * 1GB encrypted file attachments and sharing for paid versions ;TOTP / Authenticator function * TOTP key storage for free version, plus code generator and automatic fill-in for paid customers ;Imports/Exports * Imports from over 50 password managers including

Dashlane Dashlane is a subscription-based password manager and digital wallet application available on macOS, Windows, iOS and Android. Dashlane uses a freemium pricing model with subscription plan option. Overview Dashlane was founded on July 6, 20 ...

, Keeper and RoboForm * Exports into

JSON JSON (JavaScript Object Notation, pronounced ; also ) is an open standard file format and data interchange format that uses human-readable text to store and transmit data objects consisting of attribute–value pairs and arrays (or other ser ...

, encrypted JSON, or CSV ;Access * Biometric unlock via

Touch ID Touch ID is an electronic fingerprint recognition feature designed and released by Apple Inc. that allows users to unlock devices, make purchases in the various Apple digital media stores (iTunes Store, App Store, and Apple Books Store), and aut ...

Face ID Face ID is a facial recognition system designed and developed by Apple Inc. for the iPhone and iPad Pro. The system allows biometric authentication for unlocking a device, making payments, accessing sensitive data, providing detailed facial expr ...

Windows Hello Windows 10 is a major release of Microsoft's Windows NT operating system. It is the direct successor to Windows 8.1, which was released nearly two years earlier. It was released to manufacturing on July 15, 2015, and later to retail on Ju ...

, or Android Login with Biometrics * Vault login by

Two-factor authentication Multi-factor authentication (MFA; encompassing two-factor authentication, or 2FA, along with similar terms) is an electronic authentication method in which a user is granted access to a website or application only after successfully presenting ...

via

authenticator An authenticator is a means used to confirm a user's identity, that is, to perform digital authentication. A person authenticates to a computer system or application by demonstrating that he or she has possession and control of an authenticator. I ...

apps and

email Electronic mail (email or e-mail) is a method of exchanging messages ("mail") between people using electronic devices. Email was thus conceived as the electronic ( digital) version of, or counterpart to, mail, at a time when "mail" meant ...

in free version, with the addition of Duo,

YubiKey The YubiKey is a hardware authentication device manufactured by Yubico to protect access to computers, networks, and online services that supports one-time passwords (OTP), public-key cryptography, and authentication, and the Universal 2nd Fact ...

, and FIDO U2F for paid customers, with recovery code to bypass the step if a 2FA device is unavailable. * Login with

single sign-on Single sign-on (SSO) is an authentication scheme that allows a user to log in with a single ID to any of several related, yet independent, software systems. True single sign-on allows the user to log in once and access services without re-enterin ...

* Web vault passwordless login via notification approval on a device ; Sharing * Secure sharing of any texts (free version) including credentials, and files (paid versions) with others via "Send", i.e. sending a

URL A Uniform Resource Locator (URL), colloquially termed as a web address, is a reference to a web resource that specifies its location on a computer network and a mechanism for retrieving it. A URL is a specific type of Uniform Resource Identifie ...

, via any means, that retrieves the sent information that can have expiration/deletion time, maximum access limit, and password * Use an organization (such as family) and permission-based collections to securely share vault entries: 2 users + 2 collections for free and premium versions, and 6 users + unlimited collections for family plan. * Designation of Bitwarden users as emergency contacts (for paid versions) that can request for account access in an emergency ;Tools *

Password strength Password strength is a measure of the effectiveness of a password against guessing or brute-force attacks. In its usual form, it estimates how many trials an attacker who does not have direct access to the password would need, on average, to gues ...

testing tool * Through

Have I Been Pwned? Have I Been Pwned? (HIBP; with "Pwned" pronounced like "poned", and stylized in all lowercase as "';--have i been pwned?" on the website) is a website that allows Internet users to check whether their personal data has been compromised by ...

, data breach (available in the free version) and Exposed passwords reports * Exposed, Reused, Weak passwords reports for paid customers ;Others * Password history, to see the previous passwords for a login *

Autofill Autofill is a function found in some computer applications or programs, typically those containing forms, which prefills a field automatically and can save a user time. A web browser's autofill feature is used to fill out forms with previously en ...

credentials/customizable fields into websites and other applications * Configurable username generator * Configurable password generator * Switch between Bitwarden accounts on a website * Integration with email alias/forwarding services including SimpleLogin, AnonAddy, Firefox Relay, Fastmail, and

DuckDuckGo DuckDuckGo (DDG) is an internet search engine that emphasizes protecting searchers' privacy and avoiding the filter bubble of personalized search results. DuckDuckGo does not show search results from content farms. It uses various APIs of o ...

Reception

In January 2021, in its first password-protection program comparison, '' U.S. News & World Report'' selected Bitwarden as "Best Password Manager". In February, with competitor

LastPass LastPass is a password manager distributed in subscription form as well as a freemium model with limited functionality. The standard version of LastPass comes with a web interface, but also includes plugins for various web browsers and apps fo ...

about to drop a feature in its free version,

CNET ''CNET'' (short for "Computer Network") is an American media website that publishes reviews, news, articles, blogs, podcasts, and videos on technology and consumer electronics globally. ''CNET'' originally produced content for radio and televi ...

recommended Bitwarden as best free app for password synchronization across multiple devices, while

Lifehacker ''Lifehacker'' is a weblog about life hacks and software that launched on January 31, 2005. The site was originally launched by Gawker Media and is currently owned by G/O Media. The blog posts cover a wide range of topics including: Microsoft W ...

recommended it as "the best password manager for most people." Critics have praised the features offered in the software's free version, and the low price of the premium tier compared to other managers. The product was named the best "budget pick" in a ''

Wirecutter Diagonal pliers (also known as wire cutters, diagonal cutting pliers, diagonal cutters, side cutters, dikes or Nippy cutters) are pliers intended for the cutting of wire (they are generally not used to grab or turn anything). The plane define ...

'' password manager comparison. Bitwarden's secure open source implementation was also praised by reviewers. However, the software was criticized for its lack of additional features, and some reviewers noted its basic and less intuitive interface compared to other password managers.

History

;2016-2017 Bitwarden debuted in August 2016 with an initial release of mobile applications for

iOS iOS (formerly iPhone OS) is a mobile operating system created and developed by Apple Inc. exclusively for its hardware. It is the operating system that powers many of the company's mobile devices, including the iPhone; the term also includes ...

and

, browser extensions for Chrome and

, and a web vault. The browser extension for

was later launched in February 2017. In February 2017, the Brave web browser began including the Bitwarden extension as an optional replacement password manager. In September 2017, Bitwarden launched a

HackerOne HackerOne is a vulnerability coordination and bug bounty platform that connects businesses with penetration testers and cybersecurity researchers. It was one of the first companies, along with Synack and Bugcrowd, to embrace and utilize crowd-sou ...

. ;2018 In January 2018, the Bitwarden browser extension was adapted to and released for Apple's

browser through the Safari Extensions Gallery. In February 2018, Bitwarden debuted as a stand-alone desktop application for

macOS macOS (; previously OS X and originally Mac OS X) is a Unix operating system developed and marketed by Apple Inc. since 2001. It is the primary operating system for Apple's Mac computers. Within the market of desktop and lapt ...

, and

. It was built as a web app variant of the browser extension and delivered on top of

Electron The electron ( or ) is a subatomic particle with a negative one elementary electric charge. Electrons belong to the first generation of the lepton particle family, and are generally thought to be elementary particles because they have no kn ...

. The Windows app was released alongside the Bitwarden extension for

Microsoft Edge Microsoft Edge is a proprietary, cross-platform web browser created by Microsoft. It was first released in 2015 as part of Windows 10 and Xbox One and later ported to other platforms as a fork of Google's Chromium open-source project: Android ...

in the

Microsoft Store Microsoft Store (formerly known as Windows Store) is a digital distribution platform operated by Microsoft. It started as an app store for Windows 8 and Windows Server 2012 as the primary means of distributing Universal Windows Platform apps ...

a month later. In March 2018, Bitwarden's web vault was criticized for embedding unconstrained third-party JavaScript from

BootstrapCDN BootstrapCDN is a public content delivery network. It enables users to load CSS, JavaScript and images remotely from its servers. Used by more than 7.9 million websites worldwide (including 30% of the top-10k websites), BootstrapCDN serves more t ...

, Braintree,

Google Google LLC () is an American multinational technology company focusing on search engine technology, online advertising, cloud computing, computer software, quantum computing, e-commerce, artificial intelligence, and consumer electronics. ...

, and Stripe. These embedded scripts could pose as an attack vector to gain unauthorized access to Bitwarden users' passwords. These third-party scripts were removed as part of the Bitwarden 2.0 Web Vault update, released in July 2018. In May 2018, Bitwarden released a

command-line A command-line interpreter or command-line processor uses a command-line interface (CLI) to receive commands from a user in the form of lines of text. This provides a means of setting parameters for the environment, invoking executables and pro ...

application enabling users to write scripted applications using data from their Bitwarden vaults. In June 2018,

Cliqz Cliqz was a privacy-oriented web browser and search engine developed by Cliqz GmbH and majority-owned by Hubert Burda Media. It was available as a desktop and mobile web browser as well as an extension for Firefox itself. Composition It is ...

performed a privacy and security review of the Bitwarden for Firefox browser extension and concluded that it would not negatively impact their users. Following the review, Bitwarden was made available as an optional password manager in the Cliqz web browser. In October 2018, Bitwarden completed a security assessment,

code audit A software code audit is a comprehensive analysis of source code in a programming project with the intent of discovering bugs, security breaches or violations of programming conventions. It is an integral part of the defensive programming paradigm ...

, and cryptographic analysis from third-party security auditing firm

Cure53 Cure53 is a German cybersecurity firm. The company was founded by Dr. Mario Heidrich, a client side security researcher. After a report from Cure53 on the South Korean security app Smart Sheriff Smart Sheriff ( ko, 스마트보안관) is a Sout ...

. ;2020 In July 2020, Bitwarden completed another security audit from security firm Insight Risk Consulting to evaluate the security of the Bitwarden network perimeter as well as penetration testing and vulnerability assessments against Bitwarden web services and applications. In August 2020, Bitwarden achieved SOC 2 Type 2 and SOC 3 certification. In December 2020, Bitwarden announced that it was

HIPAA The Health Insurance Portability and Accountability Act of 1996 (HIPAA or the Kennedy– Kassebaum Act) is a United States Act of Congress enacted by the 104th United States Congress and signed into law by President Bill Clinton on August 21, 1 ...

compliant in addition to already being

GDPR The General Data Protection Regulation (GDPR) is a European Union regulation on data protection and privacy in the EU and the European Economic Area (EEA). The GDPR is an important component of EU privacy law and of human rights law, in partic ...

CCPA Catabolite Control Protein A (CcpA) is a master regulator of carbon metabolism in gram-positive bacteria. It is a member of the LacI/ GalR transcription regulator family. In contrast to most LacI/GalR proteins, CcpA is allosterically regulated ...

, and Privacy Shield compliant. ;2021 In August 2021, Bitwarden announced that network assessment (security assessment and penetration testing) for 2021 had been completed by the firm Insight Risk Consulting. ;2022 In September 2022, the company announced $100M

series B financing Venture capital financing is a type of funding by venture capital. It is private equity capital that can be provided at various stages or funding rounds. Common funding rounds include early-stage seed funding in high-potential, growth companies ( ...

; the lead investor was PSG, with the existing investor,

Battery Ventures Battery Ventures is an American technology-focused investment firm. Founded in 1983, the firm makes venture-capital and private-equity investments in markets across the globe from offices in Boston, Silicon Valley, San Francisco, Israel and Lon ...

, participating. The investment would be used to accelerate

product development In business and engineering, new product development (NPD) covers the complete process of bringing a new product to market, renewing an existing product or introducing a product in a new market. A central aspect of NPD is product design, along wi ...

and company growth to support its users and customers worldwide. ;2023 In January, Bitwarden announced the acquisition of Swedish startup Passwordless.dev for an undisclosed amount. Passwordless.dev provided an open source solution allowing developers to easily implement

passwordless authentication Passwordless authentication is an authentication method in which a user can log in to a computer system without the entering (and having to remember) a password or any other knowledge-based secret. In most common implementations users are asked ...

based on the standards

WebAuthn Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). WebAuthn is a core component of the FIDO2 Project under the guidance of the FIDO Alliance. The goal of the project is to standardize an interface fo ...

and

FIDO2 The FIDO2 Project is a joint effort between the FIDO Alliance and the World Wide Web Consortium (W3C) whose goal is to create strong authentication for the web. At its core, FIDO2 consists of the W3C Web Authentication (WebAuthn) standard and th ...

. Bitwarden also launched a

beta Beta (, ; uppercase , lowercase , or cursive ; grc, βῆτα, bē̂ta or ell, βήτα, víta) is the second letter of the Greek alphabet. In the system of Greek numerals, it has a value of 2. In Modern Greek, it represents the voiced labiod ...

software service allowing third-party developers the use of biometric sign-in technologies including Touch ID, Face ID and Windows Hello in their apps.

References

External links

*
Bitwarden Password Manager Add-ons for Firefox

Bitwarden - Chrome Web Store

Bitwarden - Microsoft Edge Addons

Bitwarden extension - Opera add-ons

Installing Bitwarden on Raspberry Pi using Docker
{{Password managers Password managers Cryptographic software Nonfree Firefox WebExtensions Internet Explorer add-ons Google Chrome extensions Microsoft Edge extensions Windows software MacOS software Linux software IOS software Android (operating system) software 2016 software

Features

Reception

History

See also

References

External links