Bitwarden is a password manager that keeps logins and other private records in an encrypted vault shared across its browser extensions, desktop programs, mobile apps, web vault, and command-line interface. A vault item can hold a website login, secure note, card, identity, passkey, or custom field. Bitwarden encrypts the contents before storage, then a signed-in app downloads the encrypted vault and decrypts it locally after the user opens it. The service account and the vault are therefore more than a browser list of saved passwords: they form one portable record that can follow the user across devices.
Vault and account
The account password opens access to the encrypted vault. Bitwarden describes its design as zero knowledge, which means the service does not retain the secret needed to read a user’s vault contents. That protection also changes recovery expectations. A forgotten account password cannot simply expose the encrypted data through a support request. Users should keep the recovery material required by their account setup and maintain an export when the stored records have no other copy.
Personal items and organization items have separate ownership. A login shared through an organization belongs to that organization rather than the member’s personal vault. This distinction becomes visible during exports and permission changes. An individual vault export omits organization-owned records, so downloading one backup file does not necessarily capture everything visible after sign-in.
How autofill matches
Bitwarden matches a saved login to a page through the URI stored with that vault item. The normal browser extension can show matching entries, fill after the user selects one, place suggestions beside a field, or respond to a shortcut. Its default matching rule uses the base domain, while stricter choices can match a host, exact address, or another pattern. This matters for services that place authentication on a different subdomain or for organizations that reuse similar host names.
A saved username and password without a URI will not appear as a normal page match until the user adds the site address. Bitwarden can also warn before filling a form inside an untrusted iframe or when a saved HTTPS address meets a page loaded over HTTP. Leaving the browser’s own password manager active may create overlapping menus or fill the wrong record, so the official setup guidance tells users to disable that competing autofill path.
Sync is two-way
Editing an item pushes the change to the configured Bitwarden server. Other apps pull changes during login, while open, or through a manual sync. Organization updates may arrive on a different schedule from personal edits. When a password was changed on one device but another device still shows the old value, a manual sync is the first check before editing the record again.
Bitwarden can connect to its hosted service or a self-hosted server. Self-hosting changes who operates the server, yet it also places updates, backups, TLS configuration, and availability on that operator. The browser extension and mobile app still need the correct server URL before they can reach that vault.
Exports need care
Bitwarden can export plain JSON, plain CSV, encrypted JSON, and a ZIP that carries attachments under supported conditions. Plain exports contain readable secrets after local decryption. They should not stay in Downloads, email, or an unencrypted backup folder. JSON retains more item types than CSV; cards, identities, stored passkeys, and SSH keys do not all survive a CSV transfer. Trash items and Bitwarden Send objects are absent from vault exports.
Importing is also additive. Bitwarden creates a new item for each imported record and does not merge a matching login automatically. Repeating the same import can fill the vault with duplicates. Cleaning or filtering the source file before import is safer than expecting a later deduplication step.
