Map

Bitwarden

Wiki entitypassword-managersecurityopen-sourcesaas ↳ show in map Markdown
title
Bitwarden
type
entity
summary
Freemium open-source password manager, $100M PSG-backed since 2022, dual-track architecture (heavyweight .NET server, third-party Rust Vaultwarden), accumulating security incidents
tags
password-manager, security, open-source, saas
sources
marius-bitwarden-not-recommended
created
2026-05-02
updated
2026-05-02

Bitwarden, Inc. develops the Bitwarden password manager β€” a freemium open-source product, with both a hosted SaaS and a self-hostable server. Founded in 2016. Took a $100M growth investment from PSG (with Battery Ventures) in 2022, the inflection point that several long-time users (including Marius) cite as the start of a drift toward investor-aligned product decisions.

Product surface

  • Bitwarden server. Heavyweight C# / .NET stack shipping with MSSQL Express, no first-class PostgreSQL or MariaDB support.
  • Bitwarden lite. A "lighter" .NET-based deployment positioned as the answer to vaultwarden's popularity. Still requires roughly 3Γ— the memory of Vaultwarden.
  • Clients. Cross-platform: web vault, browser extensions, desktop (Electron), mobile. Android client was rewritten from .NET MAUI to native Kotlin in 2024 with persistent regressions.
  • CLI. bw, distributed as an npm package β€” a TypeScript / Node.js program. This distribution channel is what made the 2026 Shai-Hulud / Checkmarx supply-chain attack possible.

Open-source posture

Officially open source, but the relationship with the FOSS community has frayed:

  • @bitwarden/sdk-internal (late 2024). A new client dependency shipped with a clause restricting use to Bitwarden software. After community backlash and Phoronix coverage, Bitwarden called it a "packaging bug" and relicensed under GPLv3.
  • NIH on Vaultwarden. vaultwarden has roughly 3Γ— the GitHub stars of Bitwarden's official server. Bitwarden hired Vaultwarden's main developer but built a separate "Bitwarden lite" stack rather than adopting Vaultwarden upstream.
  • Issue triage. Bug reports tend to get redirected to a community-discussion forum, where threads accumulate without producing fixes. MSP resellers have publicly called this "glacial feature development."

Security incident timeline

  • 2023. KDF flaw (Wladimir Palant) β€” server-side iterations applied only to login hash, not encryption key; default client-side iterations below OWASP guidance.
  • 2023. Windows Hello bypass (CVE-2023-27706) β€” DPAPI-stored vault key extractable without master password / Hello prompt.
  • 2023. Cross-origin iframe autofill (CVE-2023-27974) β€” same base domain treated as same trust boundary.
  • 2025. DOM-based clickjacking (Marek TΓ³th) β€” patched in 2025.8.2 on the embargo expiration date, four months after disclosure.
  • 2026. Shai-Hulud / Checkmarx supply-chain compromise β€” @bitwarden/cli 2026.4.0 published with malicious bw1.js via compromised CI/CD GitHub Action; ~19 hours live, 334 developers affected.

See also

Linked from