# Bitwarden

Bitwarden, Inc. develops the Bitwarden password manager — a freemium open-source product, with both a hosted SaaS and a self-hostable server. Founded in 2016. Took a $100M growth investment from PSG (with Battery Ventures) in 2022, the inflection point that several long-time users (including [[marius-blog|Marius]]) cite as the start of a drift toward investor-aligned product decisions.

## Product surface

- **Bitwarden server.** Heavyweight C# / .NET stack shipping with MSSQL Express, no first-class PostgreSQL or MariaDB support.
- **Bitwarden lite.** A "lighter" .NET-based deployment positioned as the answer to [[vaultwarden]]'s popularity. Still requires roughly 3× the memory of Vaultwarden.
- **Clients.** Cross-platform: web vault, browser extensions, desktop (Electron), mobile. Android client was rewritten from .NET MAUI to native Kotlin in 2024 with persistent regressions.
- **CLI.** `bw`, distributed as an npm package — a TypeScript / Node.js program. This distribution channel is what made the [[supply-chain-security|2026 Shai-Hulud / Checkmarx supply-chain attack]] possible.

## Open-source posture

Officially open source, but the relationship with the FOSS community has frayed:

- **`@bitwarden/sdk-internal` (late 2024).** A new client dependency shipped with a clause restricting use to Bitwarden software. After community backlash and Phoronix coverage, Bitwarden called it a "packaging bug" and relicensed under GPLv3.
- **NIH on Vaultwarden.** [[vaultwarden]] has roughly 3× the GitHub stars of Bitwarden's official server. Bitwarden hired Vaultwarden's main developer but built a separate "Bitwarden lite" stack rather than adopting Vaultwarden upstream.
- **Issue triage.** Bug reports tend to get redirected to a community-discussion forum, where threads accumulate without producing fixes. MSP resellers have publicly called this "glacial feature development."

## Security incident timeline

- **2023.** KDF flaw (Wladimir Palant) — server-side iterations applied only to login hash, not encryption key; default client-side iterations below OWASP guidance.
- **2023.** Windows Hello bypass (CVE-2023-27706) — DPAPI-stored vault key extractable without master password / Hello prompt.
- **2023.** Cross-origin iframe autofill (CVE-2023-27974) — same base domain treated as same trust boundary.
- **2025.** DOM-based clickjacking (Marek Tóth) — patched in 2025.8.2 on the embargo expiration date, four months after disclosure.
- **2026.** Shai-Hulud / Checkmarx supply-chain compromise — `@bitwarden/cli` 2026.4.0 published with malicious `bw1.js` via compromised CI/CD GitHub Action; ~19 hours live, 334 developers affected.

## See also

- [[vaultwarden]] — the Rust community-built alternative server
- [[marius-bitwarden-not-recommended]] — Marius's full case against the product
- [[supply-chain-security]] — the 2026 Shai-Hulud incident in context
- [[credential-compartmentalization]] — divide-and-conquer alternative to a single vault