Bitwarden Switches to Commercial License

Submitted ⁨⁨2⁩ ⁨weeks⁩ ago⁩ by ⁨Mustachius_Grumpius@thelemmy.club⁩ to ⁨selfhosted@lemmy.world⁩

https://community.bitwarden.com/t/published-version-update-in-app-stores/102750

cross-posted from: thelemmy.club/post/57178796

cross-posted from: thelemmy.club/post/57178743
RyanL Bitwarden Employee

Hello everyone!

Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.
Bitwarden remains committed to open source security and transparency
The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone
If you have any questions, please ask them in this thread. Thanks all!

EDIT:
Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently

original

Comments

Sort:hotnew top

Lettuceeatlettuce@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
Well, we all know how this ends…

It’s a really sad day for me, I love Bitwarden, it’s easily the best password manager I’ve used, and I’m in IT, I’ve used a bunch.

Fuck private equity, fuck it to death. But until then, I’ll be moving my test setup for KeyPassXC into production over the coming weeks and months.

I was happily subscribed to Bitwarden for years for my personal account, I moved several people and a whole company onto it’s platform. We had a good run, time to move on.

original
- nibbler@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
  why not vaultwarden?
  
  original
  - Lettuceeatlettuce@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
    If I’m going to have to host my own infrastructure, I don’t want it tied to Bitwarden, given the new direction of the company.
    
    I fully support Vaultwarden though, and I wish them well.
    
    I’ll be going with KeyPassXC and Syncthing.
    
    original
  - lemmyvore@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
    Vaultwarden (and all the client apps) depend on Bitwarden for the API spec. If Bitwarden introduces closed features in the API that Vaultwarden can’t/won’t implement, but the client apps do, it will split the spec. They can also introduce API license keys, which would render Vaultwarden mostly irrelevant.
    
    The only way for Vaultwarden to remain relevant going forward is to own it and split ways from Bitwarden. This would in turn mean that the FOSS client apps have to decide which to support. But I think the ecosystem is going to fragment eventually anyway, so the sooner every app decides which way they want to go, the better.
    
    original
  - altphoto@lemmy.today ⁨2⁩ ⁨weeks⁩ ago
    I’m. Using Vaultgarden but its not clear if the Android app will still be available.
    
    original
    -> View More Comments
- 1984@lemmy.today ⁨2⁩ ⁨weeks⁩ ago
  100% but move where? I’m not going to self host something this critical.
  
  original
  - sonstwas@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
    You can use KeePass on mobile, look for KeePassDX on fdroid.
    
    original
teezeh@ieji.de ⁨2⁩ ⁨weeks⁩ ago
@Mustachius_Grumpius “The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone”
original
- Mustachius_Grumpius@thelemmy.club ⁨2⁩ ⁨weeks⁩ ago
  yeah but its typical double speak
  
  original
  - surewhynotlem@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Why do you think so?
    
    original
    -> View More Comments
- giant_smeeg@feddit.uk ⁨2⁩ ⁨weeks⁩ ago
  Yup. All CURRENT, these will start to diverge…
  
  original
- flop_leash_973@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  If there is no intention to put the screws to the user base, then why do it on the first place?
  
  We all know how this game ends when venture capital gets involved.
  
  original
  - teezeh@ieji.de ⁨2⁩ ⁨weeks⁩ ago
    @flop_leash_973 Where are the screws here?
    original
    -> View More Comments
- freely1333@reddthat.com ⁨2⁩ ⁨weeks⁩ ago
  I kinda thought the paid plan already had extra features no? Like silly ones but I swear it isn’t just donations right?
  
  original
  - 4am@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
    It had cloud storage, built in TOTP with autofill, and some had features like organizations and sharing
    
    Still, this fucking sucks. Bitwarden was literally created as a ln answer to this shit happening to LastPass and Dashlane.
    
    original
    -> View More Comments
- badgermurphy@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  [deleted]
  original
  - lntl@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
    
    Embrace
    
    Extend
    
    Extinguish
    
    original
  - baatliwala@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    I swear most of Grafana’s new features are enterprise only now
    
    original
  - It_is_gaslighting@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
    Good take. I trust you on this, if you mind me asking: What is now the alternative? A system of setting up once, let it work until hardware dies etc.
    
    original
unexposedhazard@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
Not surprised in the slightest sadly.

original
irotsoma@piefed.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
Sure, it’s no change for self hosters currently, but it’s one more step in moving towards a more closed platform overall. I do hope more FOSS client apps end up getting made sometime soon. I’ve been using Keyguard on Android for some time, which means the recent several breaking changes in the Bitwarden apps to the Vaultwarden backend haven’t hit me as hard, but I do still use the official apps for my laptop and desktop and Keyguard isnt fully FOSS, of course. I’d love to see some forks or brand new apps one of these days that are actually fully FOSS for both mobile and browsers. I’ve thought about doing some myself, but I have too many other projects and I also don’t have a MAC or want to pay the fees to make an iPhone version. And I abandoned my Android Developer account when they started the identity nonsense, so none of my apps are on the official store anymore and Fdroid and similar may not be viable soon, so it would only really be for myself and a few others who use alternate Android OS’s.

original
- jpaskaruk@growers.social ⁨2⁩ ⁨weeks⁩ ago
  @irotsoma There's no such thing as "Actually FOSS" - that's why it stands for Free & Open Source Software.
  All of the pain being experienced by this move from Bitwarden is because it is Open Source Software, which is the not-Free, shitty corporate owned version of Free Software.
  What you want is software that is "actually Free."
  @Mustachius_Grumpius
  original
  - irotsoma@piefed.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
    I mean, yeah, that’s what I was saying. I want a truly free and thus FOSS version of the apps. Vaultwarden is a FOSS version of Bitwarden back end, but there aren’t really any totally FOSS apps for it. That’s what I’d like to see more of.
    
    original
peyotecosmico@programming.dev ⁨2⁩ ⁨weeks⁩ ago
Heh, I’m looking at you to those people that looked at me weird because I told them I was good with Keepass!

original
possiblylinux127@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
It is effectively going closed source

Shoot

original
- Estebiu@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
  How so
  
  original
  - possiblylinux127@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
    They don’t make any money off of the open source version. It is just a matter of the before they “discontinue” the open source version and move to source available.
    
    original
    -> View More Comments
Dirk@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
So, Vaultwarden it is?

original
- phx@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  This seems to be clients for the end devices, which I’m worried may actually be a move towards locking out VaultWarden which will uses the BW Clients
  
  original
PrinzKasper@feddit.org ⁨2⁩ ⁨weeks⁩ ago
Are they still going to publish the Android client app via their own F-Droid repository?

original
AzuraTheSpellkissed@lemmy.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
As always, people overreacting in the comments (of the linked forum). So the current plan is that the core remains OSS, but upcoming features are partially not. To me that sounds similar to Chrome’s or VSCode’s approach.

original
- ture@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  Be cautious in such cases is not overreacting. We’ve seen enough open to closed rug pulls in the last years.
  
  original
  - freely1333@reddthat.com ⁨2⁩ ⁨weeks⁩ ago
    Fucking minIO
    
    original
- Mustachius_Grumpius@thelemmy.club ⁨2⁩ ⁨weeks⁩ ago
  yeah sorry I dont want that
  
  original
  - AzuraTheSpellkissed@lemmy.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
    I’m not saying that’s great news, but it doesn’t sound like the self destruction move that some OSS companies have done recently. I wouldn’t migrate away just because of that change. In the end, they have to find a sustainable mode of operation.
    
    original
    -> View More Comments
- bertlewirth@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  
  So the current plan is that the core remains OSS
  
  … for now.
  
  Enhance, Embrace, Extinguish.
  
  original
- 1984@lemmy.today ⁨2⁩ ⁨weeks⁩ ago
  It’s not overreacting when you have seen the same development at least 10 times before. Its called experience.
  
  original
- Dirk@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  So it’s open core now? As if this would be any better.
  
  original
brave_lemmywinks@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
What’s the benefit for them to change the license?

original
- thr0w4w4y2@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  commercial providers can’t fork and sell it and give nothing back to the OSS community.
  
  original
  - brave_lemmywinks@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    So basically they were getting undercut by people reselling the same a services under a different name.
    
    original
    -> View More Comments
  - Mubelotix@jlai.lu ⁨2⁩ ⁨weeks⁩ ago
    No, that would GPL
    
    original
    -> View More Comments
- talkingpumpkin@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  
  What differences will exist between the two parallel versions?
  
  Some future components will be published under the commercial license and will exist only in that build. Newly developed features will be evaluated on a case-by-case basis for which license applies to them.
  
  source: the page linked by OP, community.bitwarden.com/t/…/4
  
  original
- Dirk@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  Money
  
  original
AustralianSimon@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
I pay for their product and its totally worth. It was $10 for the longest time and much like everything in the last few years has increased price to what it is actually worth. To be honest $20 a year is still stupid cheap and worth it to keep them developing the product. Bitwarden is also one of the few password managers that hasn’t had a user data breach.

original
1984@lemmy.today ⁨2⁩ ⁨weeks⁩ ago
There is no way I’m self hosting something this important… So now I’m not sure what to do actually.

original
- sonstwas@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  That’s why I’m just using KeePass. It’s just an encrypted file that you can store on whatever storage you want and sync with existing solutions like Syncthing etc.
  
  Yes it’s a bit finicky when you edit the file on multiple devices before they’ve synced but it works very well for me…
  
  original
- probable_possum@leminal.space ⁨2⁩ ⁨weeks⁩ ago
  If self hosting is not an option. Ideas that come to mind:
  
  Then. Evaluate what it is worth to you and maybe pay for it, if they offer enough worth to you and it is affordable.
  
  Then there are people who host it and provide it to others. Maybe that’s an option.
  
  Switch to another solution. Preferably one with an import feature.
  
  original
greedytacothief@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
Having only ever used keepass, what was the advantage of bitwarden? That you didn’t need to sync it yourself?

original
- WhyJiffie@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  
  That you didn’t need to sync it yourself?
  
  and that you have to never deal with sync conflicts. It’s a huge deal for those who are using tech but not understanding it, and a convenience for the rest
  
  original
- CedricWhaley@lemmy.dbzer0.com ⁨2⁩ ⁨weeks⁩ ago
  It’s also way easier to have shared passwords for family accounts.
  
  original
- Croquette@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  That’s the main benefit yeah.
  
  I use the send tool as well for sensitive files
  
  original
grillme@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
Does anyone have a handy guide to switching to selfhosted version? I was considering doing that but I let my plan renew out of laziness.

original
- unexposedhazard@discuss.tchncs.de ⁨2⁩ ⁨weeks⁩ ago
  Idk how it compares feature wise, but i have been running keepassxc/keepassdx combined with syncthing (or any file synchronization/cloud system) for many years without issues. The entire password manager database sits in one encrypted .kdbx file that you keep synced between your devices. Syncthing is nice because its p2p, so no self-/hosting required.
  
  keepassxc.org github.com/keepassxreboot/keepassxc
  
  f-droid.org/…/com.kunzisoft.keepass.libre/
  
  syncthing.net github.com/syncthing/syncthing
  
  original
  - 4am@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
    Every single time Bitwarden is mentioned on the internet, someone comes in here and proudly recites the anthem “I have been using Keep ass with sink things”
    
    It sucks compared to a dedicated extension.
    
    No autofill No TOTP or 2FA support Doesn’t do passkeys Doesn’t have organizational sharing Doesn’t sync to mobile devices Doesn’t integrate with mobile browsers without trusting some compatible 3rd party app Requires selfhosting your passwords (don’t fuck it up!)
    
    It’s actually pretty sad that the open source world doesn’t have a better solution for this. I mean I guess BitWarden was it but that’s been stolen by venture capital so
    
    original
    -> View More Comments
  - uzay@infosec.pub ⁨2⁩ ⁨weeks⁩ ago
    I had done that for a long time. It worked until it didn’t and I lost passwords. I tried again with keepass2android and it’s built-in sync. It again worked fine until at some point it wasn’t able to sync anymore for no discernible reason. I’d love for this to be a reliable setup, but it just isn’t in my experience, at least when there are 3+ devices involved with different clients and no proper awareness of the password manager and the sync sides of each other.
    
    original
    -> View More Comments
  - lemmyvore@feddit.nl ⁨2⁩ ⁨weeks⁩ ago
    I just wish Syncthing didn’t have such a convoluted port usage, and also that its Android usage didn’t revolve around an unofficial app.
    
    So I’ll stick to apps that do sync over SSH (using FolderSync atm).
    
    original
  - hummingbird@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    Yup great combo. It baffles me why anyone one would favour to depend oneself on an online service instead
    
    original
  - WuxinGoat@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
    I used keepass but switched to vaultwarden, i might consider switching back, but is there a good self hostable web front end for a keepass database? (I need to access it on my work laptop and can’t install stuff there)
    
    original
    -> View More Comments
  - brave_lemmywinks@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    That’s my stack, except swap keepassdx for keepass2android, and add the Firefox plugin.
    
    original
  - magnue@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    I’ve been using that for a while. I like the control I have in that I understand where everything is stored and encrypted. I miss the way that Google password manager had the autofill for seemingly every page nailed though.
    
    original
- Zachariah@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  Here it explains some self host options with links to “Get Started” for each:
  
  bitwarden.com/help/self-host-bitwarden/
  
  For example, here’s the link to “Linux standard deployment”
  
  bitwarden.com/help/install-on-premise-linux/
  
  You may also want to consider not making your server available to the open internet, and instead access it only on your LAN via VPN.
  
  original
  - TrippyHippyDan@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    That or jump to Vaultwarden github.com/dani-garcia/vaultwarden
    
    original
    -> View More Comments
- JigglypuffSeenFromAbove@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
  My knowledge of network security is very limited, right now I only self-host things like movies, music, ROMs, etc. I would love to do the same with my passwords, but I don’t think I would feel comfortable doing it with such sensitive data.
  
  original
  - TrippyHippyDan@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
    A viable concern if you wanted to put it public-facing. If you only care about syncing when you’re home, though, you should be able to host it perfectly fine just not giving any pathways in from the outside world.
    
    If you wanted to use the Android application, you would have to learn about TLS certificates anyway, because it doesn’t work without HTTPS.
    
    original
    -> View More Comments
andrewoidxyz@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
Fine to me as long as this doesnt impact Vaultwarden

original
The_Zen_Cow_Says_Mu@infosec.pub ⁨2⁩ ⁨weeks⁩ ago
wow, setting up vaultwarden quadlet to work with my selfhosted OIDC sso was stupid easy. Migrating my bitwarden setup to it took no time at all. The extra step was setting up some extra pocketid passkeys to be stored on non-vaultwarden hosted systems (ie. google) to prevent myself from being locked out in case vaultwarden crashes (which probably was a good idea to do regardless). Just need to add the data volume to my regular backup.

original
Imaginary_Stand4909@lemmy.blahaj.zone ⁨2⁩ ⁨weeks⁩ ago
Side note: I just tried switching to KeePassXC and it seems pretty fine, except for one caveat. If you installed your browser (probs FF or Librewolf) through flatpak or snap on Linux, the browser extension will not work.

I had to change to the non-Flatpak ver of Librewolf on my Fedora PC, which sucked a little lol 😅

original
- tooLikeTheNope@lemmy.ml ⁨2⁩ ⁨weeks⁩ ago
  Have you tried fixing it using flatseal and manually changing the config folder location for the browser in keepassxc? Librewolf too, even as native package, requires that location edit
  
  original
Decronym@lemmy.decronym.xyz ⁨2⁩ ⁨weeks⁩ ago
Acronyms, initialisms, abbreviations, contractions, and other phrases which expand to something larger, that I’ve seen in this thread:

Fewer Letters More Letters

SSH Secure Shell for remote terminal access

TLS Transport Layer Security, supersedes SSL

VPN Virtual Private Network

[Thread #125 for this comm, first seen 11th Oct 2026, 04:30] [FAQ] [Full list] [Contact] [Source code]

original
danielfm123@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
Claude, code me a bit warden clone…

original
- jobbies@lemmy.zip ⁨2⁩ ⁨weeks⁩ ago
  Careful, Claude is very sensitive these days. Might want to add ‘please’ and ‘thankyou’.
  
  original
  - kata1yst@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
    Anthropic is drawing a line in the sand protecting their model’s training sets from abuse.
    
    Meanwhile OpenAI is down in a dungeon torturing GPT6 into writing academic mathematics papers.
    
    original
    -> View More Comments
DanWolfstone@leminal.space ⁨2⁩ ⁨weeks⁩ ago
All these people keep saying that Vaultwarden won’t work because it relies on bitwarden’s API but if there is an incompatibility then wouldn’t vaultwarden just be left in a functional limbo? Like it’ll still work because self hosted but no more new features in parity with official client? Or have I misunderstood the connection between the two

original
- WhyJiffie@sh.itjust.works ⁨2⁩ ⁨weeks⁩ ago
  this year there were 2 updates to bitwarden clients that fucked up vaultwarden servers, because the bitwarden developers “accidentally” reused a variable name in the data that was unused for a few years. but vaultwarden forgot to remove it, and now it is used in a different way, and the clients bugged away so hard that you had to uninstall them, because even if you was fortunate to be able to get to your passwords list you could not get it to sync otherwise
  
  original
  - DanWolfstone@leminal.space ⁨2⁩ ⁨weeks⁩ ago
    I see… Thank You!
    
    original
badgermurphy@lemmy.world ⁨2⁩ ⁨weeks⁩ ago
[deleted]
original
- Mustachius_Grumpius@thelemmy.club ⁨2⁩ ⁨weeks⁩ ago
  are u gonna maintain clients?
  
  original

Fewer Letters	More Letters
SSH	Secure Shell for remote terminal access
TLS	Transport Layer Security, supersedes SSL
VPN	Virtual Private Network