Bitwarden is a password manager for Windows, macOS, Linux, Android, and iOS, with browser extensions and a web vault. It keeps account credentials, passkeys, payment details, and private notes in an encrypted vault that synchronizes across devices. The free account supports unlimited passwords and devices; paid plans add functions such as verification-code generation, file attachments, and vault health reports.
Vault contents use end-to-end encryption: reading the stored information requires the keys that decrypt it. Bitwarden’s service does not hold those keys in a form that lets it read your vault.
Vault items
A login item holds a username, password, and website address under a recognizable name. The address connects the saved account to the website where it belongs, while copy controls let you retrieve individual fields for other applications. Separate card and identity items hold payment information and personal details such as mailing addresses. Secure notes store freeform text that does not fit those fields.
Bitwarden can import existing records from supported browsers and password managers. Folders and favorites organize the resulting vault, and filters distinguish personal items from shared organization records. The desktop app can keep up to five accounts logged in, allowing someone with separate work and personal vaults to switch between them.
Credential generation
The generator creates passwords using a chosen length and combination of uppercase letters, lowercase letters, numbers, and symbols. Controls for minimum numbers or symbols accommodate website rules, while an option excludes ambiguous characters. For a word-based passphrase, you choose the number of words, separator, capitalization, and whether to include a number.
Generated credentials can be placed directly into a login item while editing it. Changing the saved password does not change the password at the corresponding service; the new value must also be submitted there. Bitwarden also generates usernames, including random words, plus-addressed email names, and addresses for an existing catch-all domain. Forwarded email aliases use integrations with external alias services.
Login autofill
The browser extension uses saved website addresses to offer matching accounts on a login page. Selecting an account fills its credentials, so sites with several saved logins can offer a choice rather than forcing one account. Keyboard shortcuts and browser context menus can also invoke autofill. Card and identity items can also fill relevant browser forms.
When credentials are entered into a login or registration form, Bitwarden can offer to save a new login or update an existing one. The prompt allows editing before saving, including choosing a folder for a new item. These browser functions work with the same vault used by the desktop and mobile apps.
Passkeys
Bitwarden stores passkeys for websites and apps that support them. During passkey creation, the browser extension or mobile app offers to save the credential to a login item. On a later sign-in, selecting that stored passkey authenticates the account without entering its password.
Only one passkey fits in each login item. A second passkey for the same service needs another item rather than a second passkey field. Stored passkeys synchronize through the vault, and their details can be viewed in the other Bitwarden apps, although saving and using them happens through the browser extension or mobile apps.
Shared collections
Persistent sharing uses organizations and collections. An item assigned to an organization’s collection becomes organization-owned, and members with access see it alongside their personal vault entries. Collections group shared logins, notes, cards, and identities; an item can belong to more than one collection.
A free organization supports two users and two collections. Families expands this to six users with unlimited collections and includes Premium features for each member. Buying individual Premium does not expand the free organization’s sharing capacity. Business organizations add administration such as event logs, with Enterprise adding policies and single sign-on.
Bitwarden Send
Send shares text or a file through a temporary encrypted link. The recipient opens the link to retrieve its contents, without needing to join an organization. The sender can set an expiration, deletion time, maximum access count, and an additional password, or disable the Send before its scheduled end.
Text Sends are available to free accounts. Sending files requires Premium features, either through an individual subscription or membership in a paid organization.
Verification codes
The integrated authenticator stores a service’s verification secret with its login item. A secret can be entered manually, or captured from a QR code using the mobile app or browser extension. With Premium or a paid organization, Bitwarden uses it to generate rotating verification codes that can be copied or filled into supported login forms. Free accounts can store the secret but cannot generate these codes inside Password Manager.
Vault reports
Vault health reports identify entries with weak, reused, or exposed passwords and other issues such as unsecured website addresses. Most reports require Premium features and run from the web app. The weak and reused password checks run locally, allowing the program to flag relevant entries without sending their unencrypted passwords to Bitwarden. The separate Data Breach report is available to free users as well.
Emergency access
Premium users can appoint a trusted Bitwarden contact to request access to their personal vault. The owner chooses read access or account takeover and sets a waiting period. A request can be approved or rejected; otherwise, access becomes available after the waiting period expires. Read access exposes vault contents, while takeover lets the contact replace the master password and obtain permanent read and write access.
SSH keys
The Bitwarden desktop app can also act as an SSH agent, using vault-held keys to authenticate to servers, sign Git commits, or work with other SSH services. The SSH client must be configured to use this agent, and authorization settings control when Bitwarden asks permission to use a key. When a signing request needs a locked vault, Bitwarden prompts for an unlock before proceeding.
