Bitwarden (bitwarden.com) is an open-source password manager available as a browser extension, mobile app, and desktop app. The vault is end-to-end encrypted, so Bitwarden cannot read what is stored in it, and the code is public rather than merely described. The free tier is a fully functional password manager, not a trial.
What the free tier includes
Unlimited passwords across unlimited devices, with syncing between them. It also stores notes, credit cards, and identities, and includes a username and password generator. Free accounts can share with one other user, use Bitwarden Send for text and files, and turn on two-step login.
Passkeys and passwordless access
Bitwarden stores and syncs passkeys in the vault, so they follow you across devices. Passkeys log into sites without a password and also work as phishing-resistant two-factor authentication — unlike a code, there is nothing to type into a fake page.
The vault itself can be opened without a password: with a WebAuthn PRF compatible passkey such as a hardware key, with biometrics like fingerprint or face recognition, or by logging in from a trusted device. On Windows 11, the desktop app can supply stored passkeys to other applications natively, currently in beta.
Why reuse is what it fixes
Reused passwords are how many account breaches begin. An attacker takes a password leaked from one site and tries it on others. The 23andMe breach that exposed the data of 6.9 million people worked exactly this way.
What Premium adds
Premium is $1.65 per month, billed annually at $19.80. It adds an integrated TOTP authenticator, file attachments from 5 GB, emergency access, vault health reports and password coaching, support for up to ten hardware security keys including Yubico OTP and Duo, email alias integration, and self-host options. Families is $3.99 per month for six users, billed annually at $47.88.
What it does not cover
Several features people assume are standard are Premium only: the integrated TOTP authenticator, hardware security key support as a login method, emergency access, file attachments, and vault health reports.
A password manager also does not protect a vault whose master password is weak or reused, and it does not protect a compromised device. It secures credentials, not the machine typing them.
Up next · Friday