Bitwarden FAQ — install, security, pricing & migration

Yes. The free tier is unlimited passwords, unlimited logins, sync across two devices, and free for personal use forever — not a 30-day trial. Bitwarden Premium ($10/year) adds vault health reports, encrypted file attachments, hardware-key 2FA support, and a built-in TOTP authenticator. Family ($40/year, six accounts) adds shared collections.

Yes — every official client (Windows, Mac, Linux, iOS, Android, browser extensions, CLI) and the server code is published on GitHub at github.com/bitwarden under GPLv3. You can read it, audit it, build it from source yourself, and run a fork (Vaultwarden is a popular Rust rewrite of the server). Closed competitors like 1Password, Dashlane and NordPass do not publish source.

Bitwarden, Inc. — a US company headquartered in Santa Barbara, California, founded by Kyle Spearrin in 2016. PSG Equity took a majority growth investment in 2022. The product itself remains open-source under GPLv3, independent of any acquisition outcomes.

Browsers (Chrome, Edge, Safari) keep passwords either in plain text on disk or encrypted with your OS account password — not a separate, high-entropy master key. They sync only within their own browser ecosystem. Bitwarden encrypts everything end-to-end with a key derived from a master password you choose, syncs across every browser and OS, and supports sharing. If your OS account is compromised, browser passwords are exposed; Bitwarden vaults are not.

Bitwarden uses AES-256 encryption with PBKDF2 (default 600,000 iterations as of 2026) or Argon2id key derivation. Encryption happens on your device — Bitwarden servers only ever see ciphertext. Source code is public and has been independently audited by Cure53 (2018, 2020) and Insight Risk Consulting. There is no public record of a server-side breach in nearly a decade of operation. See our security overview for details.

The official Bitwarden installer for Windows is signed by Bitwarden, Inc. and works on Windows 10 and 11. Download it from our Windows download page, run the installer, then sign in or create a free account. The installer auto-updates by default. Latest version: v2026.10.0 (October 15, 2026).

Yes — there is a native universal-binary build that runs on both Apple Silicon (M-series) and Intel Macs. Get it from our Mac download page, or from the Mac App Store. Native macOS Touch ID unlock and Hide Menu Bar Icon are supported.

Yes. Three install options: .deb for Debian/Ubuntu, .rpm for Fedora/RHEL, AppImage for everything else, plus Flatpak and Snap from Flathub and Snap Store. The browser extensions (Firefox, Chrome) work on every Linux distribution. See our Linux page.

Visit the Chrome extension page, click "Add to Chrome," accept permissions, then click the Bitwarden icon in your toolbar to sign in. The extension autofills logins, generates passwords, and syncs to your vault automatically. The same extension works on Brave, Edge, Opera, Vivaldi and any other Chromium-based browser.

Yes. Get it from the iOS App Store (free). After install, enable Bitwarden in Settings → Passwords → AutoFill Passwords so iOS suggests Bitwarden credentials in any app or Safari login. Face ID / Touch ID unlock is supported.

Yes — get it from Google Play or directly as APK on GitHub. Enable autofill in Settings → Languages and input → Autofill service → Bitwarden. Works on stock Android, GrapheneOS, and Android-based custom ROMs.

The official CLI (bw) is a single binary published for Windows, Mac and Linux. Use it for scripted vault access, server-side credential injection, automated rotations, or backup/export jobs. See our CLI download page.

The master password is the one secret you must remember. It encrypts your vault on your device — Bitwarden servers never see it. If you forget it, no one (not Bitwarden, not us, not law enforcement) can recover the vault, because the encryption key is derived from the master password itself. That is the core security property; it is also why a strong master password matters.

Bitwarden cannot reset it without destroying your vault. Three options: (1) if you set up an emergency contact in Premium, that contact can request access; (2) if you exported an encrypted backup with a separate file password, you can decrypt it with the file password; (3) otherwise the vault is unrecoverable and you must start fresh. Always set up an emergency contact and write the master password somewhere physical (a sealed envelope, a safe).

Minimum 14 characters; 16+ recommended. Use a passphrase: four to six unrelated dictionary words separated by spaces or dashes (correct horse battery staple) is easier to remember and harder to crack than a short string of mixed symbols. Bitwarden generates passphrases for you — open the Generator and choose "Passphrase."

Yes — for vault login and as a built-in TOTP authenticator for your saved sites. For protecting your Bitwarden account itself, supported second factors are: TOTP authenticator apps (free), email codes (free), Duo (paid), YubiKey / FIDO2 hardware keys (Premium). Premium users can also store TOTP codes inside their vault for individual logins. See our 2FA setup guide.

No. Encryption and decryption happen exclusively on your device. The server stores only ciphertext blobs and metadata (vault size, last-sync timestamp). Bitwarden's zero-knowledge architecture is verifiable in the open-source code.

There is no public record of an authenticated breach of the Bitwarden vault servers. By contrast, LastPass disclosed a major breach in August/December 2022 that exfiltrated encrypted vaults; Norton Lifelock disclosed a credential-stuffing incident in January 2023. Bitwarden's history, combined with the open-source codebase and independent audits, is the strongest reason to pick it.

Vault data is encrypted with AES-256 in CBC mode, authenticated with HMAC-SHA-256. The master key is derived using PBKDF2-SHA-256 with 600,000 iterations (default since 2023) or optionally Argon2id. Every byte that leaves your device is already encrypted; the server never has access to plaintext or the master password.

Yes. Bitwarden Business is SOC 2 Type II certified and offers HIPAA compliance under a Business Associate Agreement (BAA). Free and Premium personal tiers are not formally compliance-scoped, but the underlying cryptography is identical.

Free tier: $0, unlimited passwords on two devices. Premium: $10/year, adds vault health reports, hardware-key 2FA, encrypted attachments, TOTP authenticator. Family: $40/year for six Premium accounts. Teams Starter: $20/month for ten users. Enterprise: $6/user/month with SSO. Full pricing breakdown.

For most people: yes. Free covers unlimited passwords, unlimited logins, identities, secure notes, cards, and sync across two devices (typical setup: phone + laptop browser). You give up vault health reports, hardware-key 2FA, encrypted file attachments, and the built-in TOTP authenticator. If you only have a phone and one laptop and don't need TOTP storage, the free tier is enough.

Family is six Premium accounts plus shared collections, billed at $40/year flat. Business is per-user from $4/user/month, adds groups, role-based collections, event logs, SSO, directory sync, policies, and SCIM provisioning. Family is for households; Business for organisations. Detailed comparison.

Yes — Bitwarden offers a 30-day money-back guarantee on Premium and Family. Email [email protected] within 30 days of purchase for a full refund. Business and Enterprise refunds are handled per-contract.

Bitwarden offers free Teams accounts for qualifying non-profits and educational institutions through their non-profit program. Apply via bitwarden.com/contact/. Individuals don't need a discount — Premium at $10/year is already cheaper than most competitor student discounts.

1Password has nicer polish and Travel Mode, costs 3× more, and is closed-source. Bitwarden is open-source, has a real free tier, costs $10/year for Premium, and self-hostable. For most users Bitwarden wins on price and transparency; 1Password wins if you genuinely care about UX polish and don't mind paying. Full comparison.

Yes — after the 2022 LastPass breach (which exposed encrypted vaults of 30+ million users), there is no compelling reason to stay. Bitwarden imports LastPass exports natively, is open-source, has no breach record, and costs less. Step-by-step migration guide.

KeePass and KeePassXC are local-first — your vault is a single .kdbx file you sync yourself (Dropbox, Syncthing, USB drive). That's great for power users who want zero cloud dependence. Bitwarden adds managed sync, native sharing, mobile autofill that just works, and browser extensions that don't require a separate companion app. Pick KeePass if you want pure local control; pick Bitwarden if you want it to "just work" across devices. Comparison.

Dashlane has a polished UI, a built-in VPN, and dark-web scanning — but it's closed-source, costs $60/year, and the free tier limits you to 25 logins on one device, which makes it functionally a trial. Bitwarden has a real free tier, costs $10/year for Premium, and is open-source. For 99% of users, Bitwarden is the better pick. Detailed comparison.

Export from your existing manager as CSV or JSON, then in Bitwarden Web Vault go to Tools → Import data, select the source manager (LastPass, 1Password, Chrome, KeePass, Dashlane, NordPass, etc.), upload the file. Bitwarden imports usernames, passwords, URLs, notes, and folders. After import, securely delete the export file — it's plain text. Full tutorial.

Premium users can store TOTP secrets inside vault items, but Google Authenticator does not export secrets in a re-importable format directly into Bitwarden. The path is: in Authenticator, tap Export accounts → take a screenshot of the QR codes → use a QR-decoding tool to extract the otpauth:// URIs → manually paste each secret into the corresponding Bitwarden vault item's Authenticator Key field. Tedious but one-time.

Yes — Bitwarden never locks you in. Export from Tools → Export vault as CSV, JSON, or encrypted JSON. Most managers accept CSV. The encrypted-JSON format is for Bitwarden-to-Bitwarden migration with end-to-end encryption preserved.

Yes — two paths. Official self-host uses Docker compose; runs the same code as cloud Bitwarden. Vaultwarden is a community Rust rewrite of the server with much smaller resource requirements (runs comfortably on a Raspberry Pi). Both are compatible with all official clients. Full self-hosting guide.

Official Bitwarden self-host: 2 CPU cores, 2 GB RAM, 12 GB disk, Docker installed. Vaultwarden: 1 CPU core, 256 MB RAM, 200 MB disk — runs on a Raspberry Pi 3 or any cheap VPS.

Yes. With official self-host, generate a Premium license from your hosted instance for free (no $10 fee on self-hosted). Vaultwarden enables all Premium features by default since it's a community fork.