RyanL Bitwarden Employee
Hello everyone!
Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.
Bitwarden remains committed to open source security and transparency
The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone
If you have any questions, please ask them in this thread. Thanks all!
EDIT:
Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently
Well, we all know how this ends…
It’s a really sad day for me, I love Bitwarden, it’s easily the best password manager I’ve used, and I’m in IT, I’ve used a bunch.
Fuck private equity, fuck it to death. But until then, I’ll be moving my test setup for KeyPassXC into production over the coming weeks and months.
I was happily subscribed to Bitwarden for years for my personal account, I moved several people and a whole company onto it’s platform. We had a good run, time to move on.
I guess we’re gonna see more open-source apps soon, aimed at Vaultwarden first
@Mustachius_Grumpius “The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone”
deleted by creator
- Embrace
- Extend
- Extinguish
I swear most of Grafana’s new features are enterprise only now
Good take. I trust you on this, if you mind me asking: What is now the alternative? A system of setting up once, let it work until hardware dies etc.
yeah but its typical double speak
Why do you think so?
deleted by creator
all “current” features. further down its asked about the future and they arent always clear but the fo state there wont be feature parity moving forward
Yup. All CURRENT, these will start to diverge…
If there is no intention to put the screws to the user base, then why do it on the first place?
We all know how this game ends when venture capital gets involved.
@flop_leash_973 Where are the screws here?
I kinda thought the paid plan already had extra features no? Like silly ones but I swear it isn’t just donations right?
It had cloud storage, built in TOTP with autofill, and some had features like organizations and sharing
Still, this fucking sucks. Bitwarden was literally created as a ln answer to this shit happening to LastPass and Dashlane.
I get it because minio dying burned me hard but so long as it keeps operating as it does now do we need more features? I would be fine with a continuously secure version of exactly what it does now. I kinda hate feature bloat
If it’s not getting security updates and it’s not ona completely airgapped sysyem it’s a huge liability. Especially something that lives at the storage level.
Aren’t there forks being maintained? I was looking at implementing it right before it went enshitty, and I could have sworn there were alternatives…
I meant features on Bitwarden etc. meaning maintenance to me on an app like this is fine. Minio happened too quickly for good alternatives to exist but yes people jumped on getting some together pretty quickly.
It was, if anything, lesson in treating a single FOSS as a solved problem.
Sure, it’s no change for self hosters currently, but it’s one more step in moving towards a more closed platform overall. I do hope more FOSS client apps end up getting made sometime soon. I’ve been using Keyguard on Android for some time, which means the recent several breaking changes in the Bitwarden apps to the Vaultwarden backend haven’t hit me as hard, but I do still use the official apps for my laptop and desktop and Keyguard isnt fully FOSS, of course. I’d love to see some forks or brand new apps one of these days that are actually fully FOSS for both mobile and browsers. I’ve thought about doing some myself, but I have too many other projects and I also don’t have a MAC or want to pay the fees to make an iPhone version. And I abandoned my Android Developer account when they started the identity nonsense, so none of my apps are on the official store anymore and Fdroid and similar may not be viable soon, so it would only really be for myself and a few others who use alternate Android OS’s.
@irotsoma There’s no such thing as “Actually FOSS” - that’s why it stands for Free & Open Source Software.
All of the pain being experienced by this move from Bitwarden is because it is Open Source Software, which is the not-Free, shitty corporate owned version of Free Software.
What you want is software that is “actually Free.”
I mean, yeah, that’s what I was saying. I want a truly free and thus FOSS version of the apps. Vaultwarden is a FOSS version of Bitwarden back end, but there aren’t really any totally FOSS apps for it. That’s what I’d like to see more of.
Heh, I’m looking at you to those people that looked at me weird because I told them I was good with Keepass!
So, Vaultwarden it is?
This seems to be clients for the end devices, which I’m worried may actually be a move towards locking out VaultWarden which will uses the BW Clients
It is effectively going closed source
Are they still going to publish the Android client app via their own F-Droid repository?
deleted by creator
are u gonna maintain clients?
deleted by creator
As always, people overreacting in the comments (of the linked forum). So the current plan is that the core remains OSS, but upcoming features are partially not. To me that sounds similar to Chrome’s or VSCode’s approach.
Be cautious in such cases is not overreacting. We’ve seen enough open to closed rug pulls in the last years.
Fucking minIO
yeah sorry I dont want that
I’m not saying that’s great news, but it doesn’t sound like the self destruction move that some OSS companies have done recently. I wouldn’t migrate away just because of that change. In the end, they have to find a sustainable mode of operation.
It’s 2026 and you have way too much optimism left after all the OSS rug pulls of the last six fucking years.
Even hardware rugpulled. Fucking Micron.
Forget it; BitWarden is cooked.
So the current plan is that the core remains OSS
… for now.
Embrace, Enhance, Extinguish.
*: got the E’s in the wrong order
So it’s open core now? As if this would be any better.
I pay for their product and its totally worth. It was $10 for the longest time and much like everything in the last few years has increased price to what it is actually worth. To be honest $20 a year is still stupid cheap and worth it to keep them developing the product. Bitwarden is also one of the few password managers that hasn’t had a user data breach.
What’s the benefit for them to change the license?
commercial providers can’t fork and sell it and give nothing back to the OSS community.
So basically they were getting undercut by people reselling the same a services under a different name.
What differences will exist between the two parallel versions?
Some future components will be published under the commercial license and will exist only in that build. Newly developed features will be evaluated on a case-by-case basis for which license applies to them.
source: the page linked by OP, https://community.bitwarden.com/t/published-version-update-in-app-stores/102750/4
Money
Does anyone have a handy guide to switching to selfhosted version? I was considering doing that but I let my plan renew out of laziness.
Here it explains some self host options with links to “Get Started” for each:
https://bitwarden.com/help/self-host-bitwarden/
For example, here’s the link to “Linux standard deployment”
https://bitwarden.com/help/install-on-premise-linux/
You may also want to consider not making your server available to the open internet, and instead access it only on your LAN via VPN.
That or jump to Vaultwarden https://github.com/dani-garcia/vaultwarden
Is there another client we can use with vaultwarden though? (In the scenario wgere that gets locked down)
The web interface is hosted directly by your vaultwarden interface so it’s not lockdown-able. The only things that are would be the browser extension and phone apps. Both of which are formally unnecessary because you can always just use the web interface. I’m sure if they ever locked down there’d be community versions in no time as they’re basically just web wrappers anyway.
The apps keep a synced local copy, so if the server is down or unreachable you can still get to your passwords. That can also be locked by biometrics etc.
There’s a lot of stuff that without be lost by going to just the web interface
The web app keeps a local synced copy too btw. Biometric is fair tho
Ah of course, perhaps i’ll give that a go and see how it goes.
great suggestion
Vaultwarden still depends on upstream bitwarden
Only if you’re using the Android app or the web browser plugin, the actual core system does not.
They could lock Bitwarden out tomorrow and Valtwarden would still work fine.
Then people would just have to write specific application and plugin if they wanted to continue to use it with no change.
The web interface would be fine.
The web interface is from bitwarden. Technically they could fork it but that would be much more work.
No it is not, the web interface is the page you get when you browse to the swrver directly, it is very different from the Bitwarden one.
The web interface is based on bitwarden. You are thinking of the client api.
Can I simply migrate content from Bitwarden to Vaultwarden?
I couldn’t tell from looking at the faq or wiki.
deleted by creator
It’s been a long while, but I believe you just export from Bitwarden and import into Vaultwarden.
My knowledge of network security is very limited, right now I only self-host things like movies, music, ROMs, etc. I would love to do the same with my passwords, but I don’t think I would feel comfortable doing it with such sensitive data.
A viable concern if you wanted to put it public-facing. If you only care about syncing when you’re home, though, you should be able to host it perfectly fine just not giving any pathways in from the outside world.
If you wanted to use the Android application, you would have to learn about TLS certificates anyway, because it doesn’t work without HTTPS.
Works fine with acme certs though
I’m personally using Let’s Encrypt and duckdns.org for a completely free solution.
Currently only hosting everything on my local network though with VPN to access when not at home.
wow, setting up vaultwarden quadlet to work with my selfhosted OIDC sso was stupid easy. Migrating my bitwarden setup to it took no time at all. The extra step was setting up some extra pocketid passkeys to be stored on non-vaultwarden hosted systems (ie. google) to prevent myself from being locked out in case vaultwarden crashes (which probably was a good idea to do regardless). Just need to add the data volume to my regular backup.
Side note: I just tried switching to KeePassXC and it seems pretty fine, except for one caveat. If you installed your browser (probs FF or Librewolf) through flatpak or snap on Linux, the browser extension will not work.
I had to change to the non-Flatpak ver of Librewolf on my Fedora PC, which sucked a little lol 😅
Have you tried fixing it using flatseal and manually changing the config folder location for the browser in keepassxc? Librewolf too, even as native package, requires that location edit
