cross-posted from: https://thelemmy.club/post/57178743
RyanL Bitwarden Employee
Hello everyone!
Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.
Bitwarden remains committed to open source security and transparency The GPLv3 OSS licensed version continues to be updated and published on GitHub All current features are available in both versions License details are on GitHub Bitwarden remains committed to a robust, free forever plan for everyoneIf you have any questions, please ask them in this thread. Thanks all!
EDIT:
Bitwarden is not going closed-source You can still fork Bitwarden No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden The free plan is here to stay permanently
Pretty much seen it coming when the new CEO came in and removed the words “Transparency” and “Always Free” from the official marketing.
Whether you believe it or not is another matter, but this very post still includes the words “transparency” and “always free”.
Bitwarden remains committed to open source security and transparency
Bitwarden remains committed to a robust, free forever plan for everyone
and a bonus:
The free plan is here to stay permanently
You can already see them positioning themselves to start removing features with the phrase “free plan.”
Nothing stopping them from limiting the number of passwords available in “the free plan” or something, pressuring users into “the pay plan.”
But I’m pretty cynical.
Aslong as it stays source available at a bare minimum for the paid offering/options I think I can live with that.
Lastpass limited the number of device types, phone OR desktop
I’d find it more likely they remove passkeys and TOTP from the free plan.
My fam will not like moving password managers again, but it might be time.
Need PC, Mac, Linux, Android, IOS, Passkeys, TOTP, Granular Permissions, keepass ain’t gonna cut it. Getting off my ass and making something isn’t impossible, but i’m not looking forward to figuring out passkeys, copy, paste and accessiblilty on IOS.
I’d find it more likely they remove passkeys and TOTP from the free plan.
Afaik totp aren’t supported on free plan already
Lastpass limited the number of device types, phone OR desktop
The thing that shit me about LastPass doing that is that they used to do that. And I actually paid for it back when they did. Then they made it free for several years. And then they brought back the restriction, only at like 5x the price.
And in the meantime, quality of life of the service remained flat. I regularly had to go into the LastPass app and manually copy/paste because the autofill functionality didn’t work properly on Android. There was just no way it was a service of a quality that’s worth paying for. Bitwarden’s UX is incredible by comparison.
yeah talk about going out in a blaze of
glorystupidity.Fuck over the free users (features)
Fuck over the pay users (cost)
Fuck over the corporate users (over report the actual level of encryption, several vulnerabilities that exposed easy exfiltration, third party trackers running in zero-trust code)
Fuck over everyone, their DevOps dude running Tatuli on Plex got RCE’d and exposed their entire vault
Anyone got some better alternatives for people to try out?
pass https://www.passwordstore.org/ keepass https://keepass.info/
Never made any sense to me why so many people ran away from these two open source options towards Bitwarden.
Bitwarden has much better enterprise options. KeePass is kind of dinky by comparison; even for a single user you immediately run into the problem “how do I sync my new password to my phone automatically?” Bitwarden was just an app that worked.
That being said ~ I see the writing on the wall, and will be going back to the dinky option. Again. This isn’t the first time I’ve been burnt, but I never seem to learn. Self-hosting seems to be the only sustainable long-term option after all. Hopefully the migration isn’t too painful.
I highly recommend anyone reading this get your export out while they still have a good export tool. First thing companies do in enshitification 101 is make it difficult to leave and trap you via inconvenience.
Because some people need non-technical people to share password solutions. Keepass is all or nothing for security and pass is ad administration headache for a family.
I never understood the 9000iq move to give all your credentials to someone else…
That’s why I use “pass” as
password-store.
Goddamnit, enshittification comes for ALL paid services eventually. Looks like I have another service to start self hosting…
That was written in the sky…
Open-Source is literally used as marketing tool for the under dogs until they reach a critical mass of users.
People were fighting on social media, defending the product, suggesting it, “it’s open source”, people were doing the marketing for them.
No wonder why people feel like they got raped, after all the hard work they have done for them…
But at least they didn’t contribute code, did you? Not me, because I am old enough to never use such products, it’s a classic rug pull, bait and switch.
Open source doesn’t mean it’s good, it must be hold by a bunch of strangers in T-shirt, not in full suite…
Corpo in disguise…
Bitwarden’s front-end (Apps, Extensions) must be hard forked before it is too late.
If you are on Lemmy, theres very high probability that you also have the technical abilities required to self host Vaultwarden and stop relying on a greedy company for your most critical aspect.
I could but I don’t want. Self hosting something this important? I can’t login to any website without this software, including my email. It’s super critical.
The vault gets synced to your devices. So even if your Backend goes down you dont lose access to your passwords in an instant
So you have basically a local copy on your phone, for example, that syncs when possible?
yes, exactly. This gives you at least some time that you have to figure out what went wrong with your vaultwarden server/connection
yeah, until the client logs you out randomly. it has an increased chance when the server behaves funky.
I’ve been self-hosting vaultwarden for a year and this has literally never happened to me.
it happens to me once or twice a year, and to people for whom I have installed bitwarden too. official clients, bitwarden.com server.
Maybe that’s a bitwarden issue, I guess. One more point for selfhosting. Also, even if that were to happen to you, you most likely have it installed in more than one device. The chances of all sessions logging out at the same time would be extremely low.
The chances of all sessions logging out at the same time would be extremely low.
not all devices, but multiple of them did log out roughly the same time. so, don’t rely on storing the 2FA authenticator app’s password in it.
3-2-1 backups guys
Yeah vaultwarden and photos are the 2 things i’m too nervous to selfhost. I do selfhost basically everything else but these 2 things are too important for me to mess up that I just don’t…
I have Vaultwarden, it works with the web app and browser extensions. But is there a vaultwarden specific android app? I know technically I can use the Bitwarden app. But sometimes they update the Bitwarden app too fast for all the changes to translate into Vaultwarden and then im kinda forced to use the web app.
The web app is just a minor inconvenience to me so I continue to use it. Just wondering if there is an easier Vaultwarden specific solution for android.
How often do you update vaultwarden? This has never been an issue for me.
Then we will shit … the enshitification exodus goes on
Yeah, keyguard is pretty good
Then again, if you can do that, why not just use pass
There seems to be only one Android client, and it’s been archived on Github. I kinda need an android client for a password manager to be usable.
Are the clients usable or is the user experience more like KeePass (i.e. bad)?
They only have text on the home page, so I’m not super hopeful about that, but then they do link like 10 different compatible clients
Yes because using a different then normies app also means technical skills. In fact, haven’t your PhD diploma came along when you signed up for your Lemmy account?
It just blows my mind how so many comments use the term ‘purchase’ as if this new enshitification step still allowed for the dictionary meaning of the word.
I used to suggest bitwarden to everyone, now it’s basically ‘start using KeePass, keep a copy of your db in a USB drive in your safe, have fun’.
The fact that bitwarden raised 100 millions from venture capitalists for “acceleration” and small changes towards a closed license for premium features is a steady step towards enshittification.
The writing is on the wall and every announcement like that is a step further into enshittification to provide value for shareholders at the expense of thrle consumer base.
I still haven’t switched yet because life is going fast and I didn’t come around to do my backup file server yet, but I would suggest anyone reading this to look for an alternative because it will get worst.
Yep, have been using KeyPass or KeyPassX for at least a decade now and just syncing across all machines (via syncthing). 100% reliable in my experience.
Does this mean I will, or won’t be able to install the FOSS version through GitHub? Trying to stop repackagers from selling your project is one thing, but killing the source available installs would be another.
According to their forum it is to prevent repackers
“bitwarden apps will be the commercially licensed builds.” I don’t understand how this is going to change anything.
I self-host vaultwarden. I use the official Bitwarden app, it works swimmingly. Going the self-hosted route you get enterprise features (I don’t use em).
Doesn’t the licensing stuff connect with the backend not the app?
All current features are available in both versions
They will start making changes exclusively to the propriety app, and eventually the proprietary app will be completely incompatible with the FOSS app. They’re doing what Google did with AOSP.
The commercial licensing is on the clients. You must switch to the Github versions immediately or proprietary code will be installed.
Rest in Peace :(
Fantastic. I’m tired of having to change password managers. DashLane, Keepass, LastPass, etc., they all end up shooting their own foot somehow.
What happened to keepass?
It has become Keep Ass.
Cool quip, doesn’t answer the question
Keepass is open and has many implementations. It’s the only remaining cross-platform and fully local password manager, even supporting passkeys.
When Bitwarden got a meh “refresh” of the user interface and started vibe coding stuff (I’m not some super hard-line anti-AI person, but dammit, you absolutely should not vibe code security-critical apps), I switched to KeePassX. It was like coming back home! I used to use KeePass and KeePass 2, switched to Bitwarden for a long while, and while it was neat, KeePassX is just neater. (Doesn’t have cloud sync, but syncing the vault files with LocalSend is easy enough.)
I guess you mean KeepassXC, because the last release of KeepassX apparently was in 2016.
KeepassXC is also using AI, they even made a blog post about it a year ago.
https://keepassxc.org/blog/2025-11-09-about-keepassxcs-code-quality-control/
Yep, ChiPass is a good replacement: https://codeberg.org/ChiPass/ChiPass
No mobile client 😢
Honestly their description of use and why that use it is not concerning. I’m more concerned with their choice being copilot lol.
Yup, I was supposed to say KeepassXC. (…I mean I probably considered using KeepassX at some point, it’s XC’s predecessor after all. But as I recall Keepass 2 worked well enough on Mono, so I didn’t need to switch.)
Also, whoopsies on XC’s AI use. At least they don’t seem to embrace it as much as Bitwarden, but still makes me go hmm.
They never vibe code though:
This process is fully transparent and open for anyone to see, and it does not change with AI. We take no shortcuts. At KeePassXC, we use AI for two main purposes:
As an additional pair of “eyes” in code reviews.
In this function, AI summarises the changes (the least helpful part) and points out implementation errors a human reviewer may have missed. AI reviews don’t replace maintainer code review, nor do they relieve maintainers from their due diligence. AI code reviews complement our existing CI pipelines that perform unit tests, memory checks, and static code analysis (CodeQL). As such, they are a net benefit and make KeePassXC strictly safer. Some examples of AI reviews in action: example 1, example 2.For creating pull requests that solve simple and focused issues, add boilerplate code and test cases.
Unfortunately, some people got the impression that KeePassXC was now being vibe coded. This is wrong. We do not vibe code, and no unreviewed AI code makes it into the code base. Full stop. We have used Copilot agent to draft pull requests, which are then subsequently tweaked in follow-up commits, and reviewed by a maintainer, openly for anyone to see, with the same scrutiny as any other submission. Good pull requests are merged (example), bad pull requests are rejected (example).To be honest, I don’t really know where AI assistance stops and vibe coding starts. It was not my intention to say the KeepassXC team now only produces some half-assed unreviewed garbage.
I use KeepassXC myself, but OP has valid concerns about AI usage in security critical applications and I just wanted to point out that KeepassXC isn’t AI-free either.
I think all of us can just move to using Vaultwarden, it seems to fix problems even in the old free version of Bitwarden.
The issue is, the bitwarden app you still use is what is affected by this change.
Only if you are reselling bitwarden. The client apps are still free for personal use.
So these changes affect the client app too? If that’s the case can’t the client app be replaced?
At that point the only thing that would remain is the protocol itself
Yeah I’m thinking I’ll finally spin up Vaultwarden and move away from Bitwarden. I’m just hoping they develop their own apps for it
The protocol is the same, anyone can build an app.
Interesting thread I stumbled upon from a few years ago where everyone is praising Bitwarden as essential. Times sure do change.
No one’s taking away my favourite bash script: https://www.passwordstore.org/
It’s still open source
