I'm DW, Technical Evangelist at Bitwarden, here with support from the team behind the open-source password manager Bitwarden, ask me anything!

Is sorting on the roadmap soon? One basic feature that is missing.

Keep an eye on the user research forum category to participate in upcoming discussions with the product team.

Is there any movement toward allowing your "Emergency Access" feature to be expanded to non-Bitwarden-user options? I would happily pay $10/year for that one.

Sadly none of the people I care about having this sort of access are even a little "tech", so the current option is useless to me, and I can't imagine I'm alone

Fair point, I'll bring this up with the team!

I know the ama is over but I hope you see this. This request is actually solid. It would be amazing for estate planning purposes to be able to provide someone like a personal representative or executor of an estate or a trustee or just a trusted person who you want to be able to access your accounts to close them out with a separate one-time-use master password that would allow them to get into Bitwarden such that they could then get into other accounts and resolve them after the owner passes away. Just food for thought. I am a lawyer, if you'd like help with the idea, feel free to let me know, just don't read my post history cuz then you'll learn quickly I'm really quite an a****** with a really strong sarcastic streak

Thanks for the +1, we're sharing the feedback with the team 👍

Thanks! I'm a paying user even though I don't really need the extra features, just to support your great service!

I was hoping to get my workplace to start using Bitwarden, so I wanted to show my boss how good it is to be able to share passwords through Bitwarden. I just used my normal paid plan, not the business plan, just to show him. But it did not work out as expected, because it turned out that I did not really understand how to share passwords in a straight forward way that was easy for both of us to understand.

So my question is if you can tell us some more about your plans for making the sharing experience better.?

I'd also very much like to see the experience on bitwarden.com when logging in on mobile be improved, but I couldn't see that on your road map?

Thanks!

Sharing in Bitwarden is done through Organizations. If you don't have access to a teams or enterprise plan, you can create a 2-person organization for free, and invite one other user.

Organizations are very scalable across very large companies, and is the key that you were missing. Take a look at this help article to learn more!

We also think the best way to experience Bitwarden on a mobile device is using one of our native apps! You can download them in the App Store or Google Play store.

ETA: Thank you for bringing Bitwarden to work! It's a huge vote of confidence and it means a lot to us. Good luck gaining forward progress there!

Sharing in Bitwarden is done through Organizations. If you don't have access to a teams or enterprise plan, you can create a 2-person organization for free, and invite one other user.

This was a while back, but I'm pretty sure this is exactly what I tried and did not have a good experience with.

Sorry, I understand this is very vague feedback, but at least it's one vote for you to spend some more time looking at how to make this easier and better. Thanks!

We also think the best way to experience Bitwarden on a mobile device is using one of our native apps! You can download them in the App Store or Google Play store.

I'm sure you do, but some people have very little free space on their phone (think of cheaper phones in poorer countries or just people like me who keep their phone for quite a few years), and/or seldom log into a website on the phone. Then the website is a logical thing to use, and it would be great if you have the resources to make it a little better on mobile.

Thanks again!

Thanks for the feedback! Feel free to expand on what you felt wasn't working and I'll take it back to the team.

Making the web vault responsive is planned 📱

Premium user here I love the product and recommend it every time talk comes up about a password manager

You guys recently implemented Simplelogin and I was wondering if we would be getting more customization options for it

Simplelogin has a feature where you can generate aliases on the fly with the service name and digits/numbers if you want

So for reddit an alias would be

reddit.2t4sy3@ mydomain . com

Is there a plan for a feature like this where you generate the username?

Our email alias integrations were just released and we’re looking forward to user feedback and further enhancements down the road.

I’m looking forward to the SimpleLogin and AnonAddy enhancements, specifically the persistence of the API keys

Thanks for the +1!

You probably get this a lot but I’ll say it anyways. Bitwarden is one of the few software I strongly encourage friends and family to use - keep up the great work!

Your support means a lot! ♪ヽ( ⌒o⌒)人(⌒-⌒ )v ♪

I switched from Lastpass and am a happy Bitwarden user. A few days ago I wanted to try out the Linux CLI client by installing it with npm. It brought to my attention that the Bitwarden clients are all built upon the security-hostile NPM package ecosystem. The installation command itself outputs that there are 4 known important security vulnerabilities in the dependencies!

Most importantly, how do you protect against a malicious actor who could subvert one of the large number of dependencies to add code that leaks Bitwarden passwords?

I can't find mention of a policy for this in any of your audit documents. And even though package versions are pinned. There are commits that just seem to upgrade a package like "open" to the latest.

Thanks!

Hey there, Bitwarden undergoes regular third party security audits and we partner with security researchers at HackerOne as part of a bug bounty program, more on the compliance page. Let me know if that answers your question.

Thanks. Sadly it doesn't, it's concerning this is entirely unaddressed.

I've read the audits and they seem to be about business processes with no mention I've been able to find about this issue or development in general.

A bug bounty programme is only useful after a breach has been introduced, by then it would be too late no?

Happy to provide more detailed info, I'll circle back with a response from the engineering team 👍

That would be amazing thanks 🙏🏻. Hopefully I've just missed the relevant document.

We use code scanning tools such as Snyk and Github dependabot, along with independent security audits and both a public reporting and private bounty program through Hacker1 in order to ensure our product is secure.

Many npm warnings or other issues raised are often not applicable. In some instances these are false positives and in other cases there are no remediations known and we’re tracking them to ensure there is no impact to our product or pipelines. >

Our team uses peer code reviews for all changes, including dependencies, to ensure accountability before allowing changes in production and to our deployment pipeline.

On Android the Google keyboard doesn't always show Bitwarden in the suggestions. I have to open the app and unlock the vault, and then go back to the browser. At this point the keyboard shows Bitwarden options.

Is this a problem with Android, Gboard, or Bitwarden?

Let me know if you find this Troubleshooting Android Auto-fill Help Center article useful, if you're still not able to get Android auto-fill working, Contact Us.

Is there any plans to add sub-folders and tags to help find stuff quicker?

Great question! You can already create nested folders with a '/' in the front of the folder name. Vault item labels is also on the roadmap, so stay tuned!

Tags would be glorious!

Glad you think so! Vault item labels is on the 2022 roadmap 👍

Are there any plans to improve creating subfolder creation and modification? The current process, while it works, is a bit clunky to create new folders and after that they're set in place without being able to click and drag them around like 99% of other applications.

Thanks for the feedback! The team is working on changing creation of nested folders to a UI process rather than a '/' process, so stay tuned for that!

Regarding click + drag, Bitwarden is currently designed to be as secure and standardized/cross platform as possible, and I've passed your feedback along to the team for further consideration.

How far can you punt a regulation NFL football?

┏ヽ( ｀0´)ﾉ ┓　 ○⌒θ┐(｀ﾍ´；)

What new, awesome features/updates are coming soon that the Bitwarden team cannot wait for?

I'm pretty pumped for vault item labels myself, I love having more granular control over vault organization 🗄️

I know that you guys don’t have a physical office, if you were to buy one, would you have to make any changes to things like pricing so you can pay for the building, and if so, would you?

Also, it’s my birthday today! 🎂

That’s a great question, we’re a global + remote team and not planning to change any time soon!

Also, happy birthday! 🧁

While it's super convenient to generate 2FA codes with Bitwarden, it undermines the security purpose of having "two factors".

Is there any chance you can add a setting that hides the 2FA codes until you answer a Bitwarden-level 2FA?

For example, to enable copying 2FA tokens for 5 minutes, I might need to answer a popup on Duo Authenticator, or enter a YubiKey code.

Thanks for the feedback and stay tuned for upcoming improvements to the master password re-prompt feature, which requires additional authentication to access the full contents of a vault item. More info on the Bitwarden Authenticator here.

You guys should give us an option to set another password for the 2fa authenticator. So even if one gets access to vault somehow they won't be able to open the 2fa vault.

I'll pass the +1 along to the team, thanks! 👍

Awesome!

Love Bitwarden and recommended it to tons of people. I have also subscribed to premium just to help out. ❤️

Thanks for your support, it means a lot! 🙏

There was a feature in LastPass that I really appreciated. When setting up a new account, it whould suggest account names that I frequently used, IE email address. Is that something you all could add?

[removed]

This is my #1 gripe with BitWarden. I believe there’s even a community PR for it; but we still do t have the functionality.

It’s got me close to leaving the BW ecosystem multiple times. I have a sadly very long email address and typin lg it in its seriously frustrating

Thanks for the feedback! There is an open feature request for this on the forums for discussion and voting and I'll send your +1 to the team!

What in your opinion is the best way to back up a bitwarden vault offline? In case BW suddenly disappears in a poof of smoke.

Great question! Check out the 7 Tips to Protect your Bitwarden Account Blog post from the team. There are also lots of great suggestions from the community in the Bitwarden Community Forums and on the Bitwarden subreddit.

Is the ability to generate random usernames coming to the mobile app?

Yes, coming in a future release!

I started paying for the premium about 3 years ago after using your service for about 24 hours. I cannot thank you enough for making the best PM out there. I have recommended it to alot of my friends and family. This isn't a question just more appreciation.

I do have one small questions tho, will you ever look into being able to add our own logos to items? I have some for the work things internally so don't have logos for. My OCD is going crazy hahaha.

Your support means a lot! 🙏

There is an ongoing feature request here for discussion and voting and I'll share your +1 with the team!

90% of websites use email as username. Can you add a button to the create login page to auto-populate the username with my email address?

Thanks for the suggestion, there is an open feature request for this functionality for discussion and voting and I'll share your +1 with the team.

Wen draft/auto save option?

Thanks for asking! If you’re using Firefox or Opera, you can use the sidebar functionality to create a persistent experience. On other browser extensions you can pop out the extension.

I’ll pass the +1 for draft/auto-save to the product team 👍

Are there any plans for fixing the default search function in the browser extension? It handles spaces as OR, instead of the expected AND.

For example, let's say my vault has the following entries:

• microsoft email
• microsoft active directory
• microsoft vpn
• google vpn
• google email
• azure vpn
• azure cloud

I would think that if I search for:

microsoft vpn

I would only find the first entry. However, in practice, the results are like this:

• microsoft email
• microsoft active directory
• microsoft vpn
• google vpn
• azure vpn

I've heard I need to search a different way, using this command:

> +microsoft +vpn

But who does that? Wouldn't every search look like that?

Great question! Searching for alpha charlie returns both alpha and charlie, but the entry alpha charlie will be first. This is what you’d expect to see in a search engine too. Let me know if you have any questions!

When can we finally see a UI/UX refresh? It’s long overdue!

The team is currently working on a major web vault refresh that will modernize the user interface and streamline navigation so keep your eyes out!

Okay, that’s great, but I was mainly talking about your mobile apps. iOS and Android apps are outdated, and are often overlooked.

We recently launched account switching in mobile as well as some improvements to auto-fill. That said, we are always looking at ways to freshen up the visual interface!

Nice. Will the nag bar be getting an update for the extensions? I really hate it sry.

Don't be sorry! I'm all ears, what would you like to see done differently?

Question for you all; how are you going about managing the PRs from the community that seem to be 'stuck'?

Looking at the client github repo, there are 55 PRs, mostly from the community, the oldest of which is 2.5 years old.

This doesn't seem like a good way to interact with your community. After 2.5 years, you know if it is or isn't going to be merged, so you should say so. The silence is poor community behaviour and will ultimately lead to forks and a lack of interest.

Great question! We've recently hired a Product Manager for Platform and Community to help with just that, and introduced improvements into our pipeline to better facilitate engagement with community PRs, stay tuned!

Keep in mind there are lots of reasons that PR's don't move forward, including loss of interest, compatibility etc..

Definitely agree with your points and looking forward to seeing improvements here 👍

Agree that PRs don't always move forward, but the worst possible outcome is 'limbo'.

After 2.5 years you *know* if you are going to merge it or not, you should put the submitter out of their misery.

A good example:

https://github.com/bitwarden/clients/pull/2047

Nearly a year ago, it was approved in principle!

I'm not trying to get on your back over this; but if you run githubs and PRs then it's a key responsibility to at least respond to requests from the community. In a business context we'd set an SLA to at least respond.

We're already working on improvements in this area and agree with your point, thanks again for the feedback!

If a nation state tried to coerce you into building a backdoor like Apple, would it even be possible?

Only you have the keys required to decrypt your vault, so we couldn’t access your information if we wanted to! Our open source codebase means that we can’t hide anything from the community 👍

Can a change be made on the android app so loading the logins isn't on the main thread? It makes the system think the app is crashing ask prompts the user to either force close/terminate the app or to keep waiting. Should instead show a loading icon and move the processing/decrypting off to another thread.

Thanks for the info! Can you create an issue on Github for this one and include your device information for the team to investigate?

I posted this elsewhere on the thread, but figured it would make sense to put it top level too.

I have a stupidly long email address, and when adding a new login, it is hugely annoying to have to type that in every single time into Bitwarden.

I can’t tell you how frustrating this is! can you not just have a list of predefined account names to pick from? I think there was an iOS PR for this on the repository, but it still doesn’t work.

This is 100% the biggest challenge to get my family to switch over; they hate the workflow on adding a new account.

Thanks for the feedback! There is an open feature request for this on the forums for discussion and voting and I'll send your +1 to the team!

Not to be funny, but this has been a feature request for over two years! It doesn’t inspire confidence that it’s still not done!

There are lots of great feature requests out there! To find out more about what goes into creating the Bitwarden roadmap, check out the replay from the 2022 Bitwarden Community Forum.

Can we expect the autofill to be improved on Android? Bitwarden autofill works like a charm on my iPad but a lot of the times on my Android phone, the prompt to autofill password simply refuses to come up.

Also it would be nice to get a little pop-up window instead of switching the entire screen to Bitwarden when autofilling on Android (like it does on iPad).

Thanks for the feedback!

Have you already checked out the Auto-fill Logins on Android or Troubleshooting Android Auto-fill Help Center articles? Are you using the Bitwarden mobile app or the browser extension on Android?

If you’re still not able to get Android auto-fill working after checking out the resources above, contact our support team.

/u/dwbitw Since you're a Tech EV, what's your take on "passwordless future" from MS and similars?

I would say that we're so much more than just a password manager, Bitwarden is here to make the internet a safer place, and the types of sensitive information and how to access it will always be changing.

Passwordless can mean a lot of things like biometrics (which we currently support, as well as other capabilities, such as device to device authentication which Bitwarden is introducing this year.

Hi, sorry for being late.

Do you guys have any plans to make moving multiple entries easier between folders/collections? Just something like drag+drop. That's the only feature I've been missing for the past years.

Thanks for the development and all the best.

Thanks for checking in! Bulk select + move is on the roadmap 👍

When will you support Vivaldi on the Android platform?

Bitwarden supports auto-fill from the mobile app to Vivaldi on Android, if this isn't your experience, contact our official support team for additional support 👍

What was it like growing up with Arthur as your big brother?

Feeling like a background character is never easy, but look at me now! (◍•ᴗ•◍)♡ ✧*。

Are there any plans to increase family size limit or along those lines for families who have more than 6 people? (10 in ours)

Totally fair point! I'll chat with the team about this one 👍

We use LastPass and it has become near unusable due to the size of the vault. Does Bitwarden have the same scaling issues where it gets slower as the vault gets bigger?

You can test it out for free in the Bitwarden app using the importer, how many vault items do you currently have? The team is also making additional optimizations around large vaults throughout the next 1-2 releases.

I'm currently using Bitwarden for work and LastPass privately. When I last checked, this wasn't possible, but is there any plan to support multiple accounts/vaults?

I'm incredibly sick of LastPass and how they treat their customers and would love to switchover fully.

Glad you asked! Account switching is currently available for desktop + mobile, and soon to be available for the browser extension. If your place of work has an enterprise organization, you should have access to a Free Families Plan.

Love the product. Use it in cloud and have self-hosted instances for business to replace competing solutions.

Any idea why (specifically) the Bitwarden addon causes Firefox to lock up under KDE Wayland?

It's pretty annoying.

On a more serious note, aside from working with them on the name change, what are your thoughts on vaultwarden?

Not sure on this one, but I'll share it with the team! Regarding your 2nd question, I'll quote our previous answer in this thread:

We're an open source technology and love the open source community. Bitwarden doesn't officially support vaultwarden, but understand there are community users who enjoy that project.

Are there any plans in the future for customers to be able to choose where their data resides? Mostly thinking from EU customers standpoint.

Great question! Currently you can choose to self-host and we're always looking at other options in the future.

Wouldn't it make more sense for someone to use a Keepass client where you have the option to create backups and manage all your data by yourself, while on bitwarden you have to trust bitwardens to do that? There even is a browser extension available for KeepassXC.

Why should I use bitwarden instead of a software like KeepassXC? What are Bitwardens advantages?

Great question! We get a lot of users migrating from Keepass who are looking for a simplified experience. We also offer the option to self-host. That said, if you have a password manager that you like and works for you, use it! 😉

Any plans to improve on biometric login for browsers? The current implement using the whole app is clunky, memory hogging and buggy.

Maybe just a small background agent written in something like rust that’s installed with the app? Anything to make that smoother.

Great question! We've recently added passwordless authentication to the roadmap which will provide additional means of account access.

Using a second device to login repeatedly is still really cumbersome compared to a biometric sensor on a keyboard like apple has on MacBooks.

Thanks for the feedback! The team is always keeping an eye on platform standards and will continue to look for ways to simplify the Bitwarden experience.

Great android app. Could we get the following implemented? Username generator Buttons for tweaking length of passwords. The scroll bar could be hard to control for a small change

Thanks, I'll pass the feedback along!

Hey! I’ve been a paying user of Bitwarden now for about 2 or so years, and I absolutely love your service. I’ve even gotten friends and family members to join up as well!

I have one question though, that I’ve always wondered about. I’ve read some of your other responses on here about the “no knowledge” encryption and security built into the system, which I love; however, I was wondering if you or others generally recommend putting your personal details into your vault?

For example, drivers license details, passport details, health card details, social security number etc. Whenever I have to interact with online government services, it’s always a huge pain to go and dig up some of my personal papers, and I thought saving them into my Bitwarden vault would be a huge convenience, however I wasn’t sure if it was safe or even recommended to put info as sensitive as your social security number in there.

Thanks for your time and help!

Great question! I can speak personally to this one that with regular third party audits, open source codebase and partnership with security researchers at HackerOne, I’m comfortable putting my sensitive information in to Bitwarden.

Don’t take my word for it, the Bitwarden Community Forums and Bitwarden Subreddit are a great source of community discussions 👍

I have another question, more importantly about security. How is your implementation of Argon2id key derivation function? Would it finally be added to Bitwarden?

You can read more about Bitwarden’s approach to cryptography here.

Will there be tags ins the future?

Vault item labels is on the roadmap! (๑˃ᴗ˂)ﻭ

Any plans to get it working with Opera on Android?

Let me know if this post helps.

Thanks for the response. I have tried the suggestions given there with the draw over permission before, but had no luck with it.

Thanks for clarification, you can reach out to our support team for additional troubleshooting support.

Very nice and affordable product. I use it across all my devices.

1. Using a password manager creates a single point of failure. What do you think of this?
2. Has the security of bitwarden been audited by independent auditors?

1. We always recommend a good backup routine. You are in control of your vault data, and can export and store it wherever you like. You can also read more about offline vault session cache here.
2. You can check out our full compliance page here. Bitwarden undergoes regular third party audits, has an public open source codebase, and partners with security researchers in a bug bounty program at HackerOne.

I self host my Bitwarden using vaultwarden on my own node. I have an issue on my iPhone saving anything new to the Bitwarden app. It says saving but then just spins until I have to quit the app. I thought it would save new passwords and then sync with my node when I get home?

Great question! Offline editing is on the roadmap, so stay tuned! The best way to self host your own Bitwarden server is to set up a vpn so that you can access it from an external source? By the way, feel free to try the official Bitwarden server.

For the new username generation feature could you support just having the domain without the .com or .co.uk? I know this would sometimes potentially cause a duplicate but it's a risk I'm willing to take.

Thanks for the suggestion! Can you provide a little more context around the use case?

Are there any plans to update Bitwarden app design for iOS? It works great but in 2022 it looks kinda out of date.

Thanks for the feedback! The team is currently working on refreshing the web vault, with other Bitwarden clients designed for straightforward secure and cross-platform reliability.

Regarding a mobile refresh, I've passed your feedback along to the team 👍

Why doesn't Bitwarden make a separate 2FA app, rather than integrating it inside the Bitwarden app itself? Having all eggs in one basket is not beneficial.

Great question and there is always lots of discussion around this one, you can read more about this here.

This can be especially helpful for accounts with shared 2FA. Here is an excerpt from the article:

Your Bitwarden Vault hopefully already has two-step login using some other method. (ie. do not use the Bitwarden Authenticator to protect your Bitwarden account.) Therefore it is currently protected with a high level of security and, in fact, two-step login.

Having two-step login enabled for websites and applications is always better than not having it enabled. A tighter bundling of two-step login makes it easier to use more frequently, which promotes better security hygiene as a practice.

If you need to share an item, you can share it with two-step login enabled, which, again, is better security practice. This is a collaboration and two-step login power move.

You do not need to remember which authentication app you used, since it is built in.

You can always choose, on an individual basis, which login you want to authenticate internally within the Bitwarden app, or externally using a separate Authenticator app.

Mmmm, bitwarden doesn't prompt for nearly all my logins like LastPass does in Chrome.

Any tips for reaching parity?

Hmm, I use Chrome + Firefox regularily and haven't bumped into that issue. Here are a few things you can check:

• Did you disable Chrome's ability to manage passwords?
• Do you have a URI set for each vault item?
• If your browser extension is having issues auto-filling usernames and passwords for a particular site, using Linked custom fields can force an auto-fill.
• Additionally, basic authentication prompts work a little differently than regular auto-fills. For more information, see Basic Auth Prompts.
• And in terms of convenience, I personally use the keyboard shortcut on desktop
  • Ctrl/CMD + Shift + L → Autofill, press again to cycle through matching logins

Why do so many password managers including bitwarden not just support keeping a vault as an encrypted file on Dropbox/iCloud? I really don’t want to have my passwords, encrypted or not, stored on the servers of the software maker - plus to properly sync passwords, a simple file vault would be more than enough, there is really no need for a full blown server.
1Password used to do this really neat before they fell to the dark side. minimalist uses the same model but with iCloud.

Great question! We try to reduce as much friction for users as possible and for those who prefer, we also offer the ability to self host.

iOS and iPadOS has had an issue with saving into wrong folders when creating new entries through through Safari for over a year now. (https://github.com/bitwarden/mobile/issues/1353) Has there been any progress for a fix?

I'll have the team take a closer look at this one, thanks for flagging!

- When will be browser overlay ready like majority of the other password managers?

- Is there a plan to integrate biometrics between Windows Hello and browser extensions? I mean if I unlock desktop app, it should automatically unlock browser extension.

- When will be new standard items coming?

- Is there a plan to improve desktop UI? What I need is to stop BW desktop app to refresh itself whenever I edit something. Imagine you have hundreds of items, and you edit something in letter G like Google. After editing is done, it goes to the top.

- Second UI improvement question, is there a plan to integrate web vault reports into desktop app?

- Is there a plan to fix syncing? It should be instant like 1Password but instead sync delay is several days between browser, desktop app and mobile devices.

- Is there a plan to improve password generator? I want something like Keepass's

• Hey there, a sync delay is not expected behaviour, you should definitely reach out to our official support team here.
  
• I've also passed along the feedback regarding editing items in the desktop app 👍
• Regarding browser extension biometric authentication, the team is always keeping an eye on existing and upcoming cross-platform standards to see where we can improve process. Same goes for the overlay popup, the team is actively researching current standards in this area.
• Additional item types is on the roadmap so stay tuned!
• Regarding improving the generator, what changes would you like to see the most?

You call yourself a technical "evangelist?" Lmao that's utterly absurd.

That's my job title 🤷 a.k.a. Technical Marketing