Bitwarden is an open-source password manager that stores passwords, passkeys, and secure notes in an end-to-end encrypted vault and syncs across unlimited devices without charging for the features you touch every day. The free tier includes browser extensions, mobile apps, unlimited items, and a password generator. Paid tiers exist for family sharing and business administration, not because the free version is crippled.
Strip the marketing away and the pitch is this: secure your digital life and protect against data breaches by generating and saving unique passwords for every account. That part is accurate. Reused credentials turn one company's data breach into five of your accounts, and no amount of password strength on a single login fixes it.
For a small business, the value isn't the software. It's getting shared logins out of spreadsheets and group chats — the most preventable gap in most companies' password security.
What Is Bitwarden Password Manager?
Bitwarden is a cross-platform password vault: one encrypted store for logins, credit cards, identity records, and secure notes, reachable from a browser extension, a desktop computer app, a mobile device, or a browser. Every client is open source, which is the practical difference between trusting a vendor's security claims and checking them.
The Bitwarden web vault is a full web app — add, edit, organize, and share items without installing anything, which matters on a machine that isn't yours. The desktop and mobile clients are the same vault with local caching and biometric unlock. Bitwarden also runs on every mainstream operating system, so a mixed Windows, macOS, Linux, iOS, and Android team doesn't need a second tool for the holdouts.
Who Is Bitwarden Inc.?
Bitwarden Inc. has kept both client and server code open since launch. Bitwarden believes everyone should be able to run a password manager without paying for it — that's the stated position, and the free tier is the evidence for it rather than a trial that nags you toward checkout.
How Bitwarden Encrypts Your Password Vault
Your master password never leaves your device. Bitwarden runs it through PBKDF2-SHA256 — or Argon2id, if you change the setting — to derive a key, encrypts every vault item locally with AES-256, and sends only ciphertext to the server. The Advanced Encryption Standard work happens on your computer or phone.
A separate value derived from the same master password, run through a cryptographic hash function before transmission, is what authenticates you. That's why Bitwarden support genuinely cannot recover your account if you forget the master password, and why a breach of its infrastructure would hand an attacker encrypted data rather than usable credentials. End-to-end encryption is doing real work here, not marketing duty.
Core Bitwarden Features Worth Understanding
A handful of features are worth understanding on their own, because the names Bitwarden gives them don't explain much.
Bitwarden Browser Extension and Autofill
The browser extension is what most users touch daily. It fills a saved username and password combination into a login form, offers to save new credentials as you create them, generates a strong password at signup, and flags reused entries already in the vault. It ships for every major web browser — Google Chrome, Firefox, Safari, Edge, Brave — and behaves the same way in all of them.
Change two settings on day one. Turn off autofill on page load if you visit sites that embed third-party frames, because automatic autocomplete can hand a credential to a form you never inspected. And set the clipboard to clear on a timer, so a copied password isn't sitting there waiting for the next application software that reads it.
Passkeys, WebAuthn, and Two-Factor Authentication
Bitwarden stores and uses passkeys built on the WebAuthn standard from the FIDO Alliance, so you sign into supported sites with device biometrics or a security key instead of typing anything. Passkeys are phishing-resistant in a way passwords never can be: there's no secret string to paste into a convincing fake page.
For the vault itself, multi-factor authentication is available on the free tier. You can require login with a third-party authenticator app producing a one-time password, an emailed code, or — on paid plans — a hardware security token such as a YubiKey. Bitwarden also lets you open your vault without a password by approving the request from a device you're already signed in on.
Bitwarden offers a built-in TOTP authenticator on premium plans, so verification codes sit next to the login they belong to. That convenience is a genuine trade-off: two factors kept in one vault collapse into one if the vault is ever compromised.
Bitwarden Send and Team Sharing
Bitwarden Send hands someone a password, note, or file through a link instead of a chat message, with an expiration date, a view limit, and an optional password on the link itself. Sending text is free; sending files is a paid feature. It's the right tool for a one-time credential — a Wi-Fi password for a contractor, a temporary API key — that shouldn't live in a thread forever.
Inside an organization you can share sensitive data within your Bitwarden vault using collections, so a credential is granted to a group by role and revoked in one place rather than pasted into a welcome email.
Secrets Manager and Passwordless.dev
Two products sit outside the password vault. Secrets Manager stores infrastructure secrets — API keys, database credentials, SSH keys — with machine accounts and CI/CD access, so deploy pipelines stop reading them out of environment files that end up committed. It's built for engineering teams, not for someone organizing personal logins.
What Bitwarden's Feature Names Actually Mean
Bitwarden's own feature list uses short labels that don't explain much. Translated:
Bitwarden Send — transmit data directly to one recipient with end-to-end encrypted security and an expiry you choose.
Advanced 2FA — secure your login with a hardware security key or a passkey rather than a texted code.
Username generator — create an email alias through a forwarding service, so a site never learns your real address and your inbox stays private.
Passwordless.dev — a developer service for adding passkey sign-in to your own web applications, separate from the password manager itself.
3rd-party audits — Bitwarden regularly commissions comprehensive third-party security reviews, including penetration tests, and publishes the results.
Self-hosting — run a Bitwarden server on your own hardware for additional privacy or data-residency requirements.
Global translations — Bitwarden translations exist in dozens of languages, contributed through Crowdin by the Bitwarden community rather than an in-house team.
Bitwarden Mobile App on iPhone and Android
Bitwarden has native iOS and Android apps, and the Bitwarden mobile app carries the same feature set as the desktop client: full vault access, the password generator, Send, and passkeys. On iPhone it registers as an autofill provider and fills logins in Safari and inside other apps once you enable it in Settings. On Android it hooks into the system autofill service the same way.
Both support biometric unlock — Face ID or Touch ID on iPhone, fingerprint or face unlock on Android — so you aren't typing a long passphrase on a phone keyboard a dozen times a day. Most people approve logins from a mobile device more often than from a laptop, which makes this the surface where the Bitwarden app either earns its place or quietly gets abandoned.
How to Set Up Bitwarden
Setup takes about ten minutes, and you can use Bitwarden Password Manager end to end on the free tier. The parts people get wrong are the master password, the import, and the second factor.
Create Your Vault and Master Password
Sign up with an email address and a master password. Make it a long passphrase rather than a short word with digit substitutions — its password strength is the ceiling on everything else in the vault. Write it down somewhere physical until it's memorized, because the failure mode people actually hit is locking themselves out, not an attacker. Then turn on two-factor authentication before you import anything.
Install the Browser Extension and Apps
Install the extension in the web browser you use daily and sign in. Bitwarden then offers to save each login as you enter it, which is the low-effort way to build a vault: it fills itself over a few weeks of ordinary browsing. Add the mobile app next, and the desktop app only if you want biometric unlock outside the browser.
Importing From Another Password Manager
Don't retype anything. Bitwarden imports from 1Password, LastPass, Dashlane, KeePass, and your browser's built-in password manager, among others, through the import tool in the web vault using a CSV or JSON export from the old tool. Do two things afterward: delete the export file, because it's plaintext sitting on disk, and switch off the browser's built-in password manager so it stops competing with the extension over the same forms.
Entering Your Verification Code
With two-factor authentication enabled, Bitwarden asks for a verification code immediately after the master password, on the same screen rather than somewhere in settings. The code comes from whichever method you configured: an authenticator app, an emailed code, or a hardware key. Store the two-factor recovery code somewhere outside the vault, since it's the only way back in if you lose the second factor.
What to Do When Bitwarden Won't Open
The fix is usually mundane: update to the current version, restart the browser, or check whether a browser update disabled the extension. A vault stuck on syncing normally clears after logging out and back in, which forces a fresh pull from the server. For a completely unresponsive desktop or mobile app, reinstalling is faster than debugging and costs you nothing, since the vault lives server-side in encrypted form.
Self-Hosting Bitwarden on Your Own Server
Because the server only ever handles encrypted blobs, you can run it yourself. Bitwarden publishes a container-based self-hosted deployment you point at your own domain, and the normal clients connect to it by changing the server URL on the login screen.
That's a real answer for organizations with data-residency requirements and a bad idea for most individuals. You inherit backups, TLS certificates, upgrades, and uptime — and a vault you can't reach because your server fell over at 2am is worse than one hosted by a company whose entire business is keeping it up. There's no privacy gain against Bitwarden itself either, since it never held your plaintext.
Bitwarden Plans for Teams and Enterprise
Bitwarden's business page is written in the register you'd expect: credential management solutions from Bitwarden empower organizations to secure every login, empower your teams with Bitwarden plans for teams and enterprise, and so on. What you're actually buying is narrower and more useful than that sounds.
Plans for teams and enterprise come with professional business features individuals genuinely don't need: an admin console, collections and groups that grant access by role, directory sync from an identity provider, single sign-on through SAML or OIDC, and event logging that records who opened which item. Enterprise adds the policy controls — required two-factor authentication, master password rules, disabling personal vault export — that let you set standards instead of asking people nicely.
If you run a small company, use Bitwarden to secure your workforce's shared credentials first: the Wi-Fi password, the social accounts, the vendor portals nobody owns. Bitwarden easily secures one person's vault. The harder problem is getting fifteen people onto the same system, which is why the admin controls matter more than the feature list.
Free vs Paid: What Premium Plans Offer
The free tier is genuinely free with no ads, no item limits, and no device caps. Bitwarden's own framing is unusually blunt about it: stay safe online, utilize Bitwarden for free across unlimited devices without paying extra for sync or autofill. Those are exactly the things most competitors put behind a paywall.
Premium plans offer access to encrypted file attachments, emergency access contacts, the built-in TOTP authenticator, vault health reports that flag weak, reused, and breach-exposed entries, and file sending through Send. The Families plan adds shared collections for a household. Most individual users never need any of it — run on free until you hit a limit that actually bothers you.
Is Bitwarden Secure? Could Bitwarden Be Hacked?
No password manager is unhackable, and Bitwarden doesn't claim to be. The claim it does make, and that its open code supports, is that a breach of its servers yields encrypted vault data an attacker can't read without your master password — which never left your device. That's a materially different risk profile from a service holding credentials it could decrypt on its own.
Bitwarden commissions independent security audits and penetration tests, publishes the reports, and runs a public bug bounty so outside researchers have a reason to report flaws instead of selling them. The realistic weak points aren't the infrastructure anyway: a guessable master password, a device already running malware, or a user approving a login request they didn't start.
Bitwarden FAQ
The questions that come up most often once people start using it.
Can Bitwarden Be Used Offline?
Yes. The apps and extensions keep an encrypted copy of the vault on the device, so you can unlock it and read items with no network connection, and edits sync when you're back online. The web vault is the exception, since the browser downloads the application each time you open it.
How Does Bitwarden Compare to 1Password?
1Password has the more polished interface and smoother onboarding. Bitwarden has an open codebase, a self-hosting option, and a free tier that isn't a trial. If you're paying either way and want the nicer product, 1Password is defensible. If you want to verify what the software does, or get a whole team onto a password manager without a purchase order, Bitwarden wins.
What Happens if I Forget My Master Password?
You lose the vault. There's no reset, because Bitwarden never had the key. Emergency access on paid plans lets a trusted contact request entry after a waiting period you set, and a periodic encrypted export stored offline is the other insurance policy worth having.
Where Do I Get Help With Bitwarden?
The documentation is thorough and searchable, and the Bitwarden community forum plus the project's public issue tracker cover most of what the docs miss. Paid plans include direct support with faster response times.
Bitwarden Review: Is It Worth It?
For anyone currently reusing passwords or keeping them in a notes app, Bitwarden is the straightforward upgrade: free for what most people need, open enough to verify instead of trust, and present on every browser, operating system, and mobile device you log in from. The paid tiers exist for families and organizations, not to unlock basic password management, which is why it keeps landing near the top of best-password-manager lists rather than just the cheapest ones.
When we build automation systems for clients, credential hygiene is part of the setup rather than an afterthought — tools like Bitwarden are a normal part of how we get teams to stop passing logins around in Slack messages and shared docs.