Original author(s) | Kyle Spearrin | ||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Developer(s) | Bitwarden Inc. | ||||||||||||
Initial release | August 10, 2016 | ||||||||||||
Stable release(s) [±] | |||||||||||||
| |||||||||||||
Repository | github | ||||||||||||
Written in | TypeScript, C#, and Rust | ||||||||||||
Operating system | Linux, macOS, Windows, Android, iOS, iPadOS, WatchOS | ||||||||||||
Available in | Multilingual | ||||||||||||
Type | Password manager | ||||||||||||
License | Server: AGPL-3.0-only [7] Clients: GPL-3.0-only [7] Some modules: Proprietary [7] [8] | ||||||||||||
Website | bitwarden |
Bitwarden is a freemium open-source password management service that is used to store sensitive information, such as website credentials, in an encrypted vault. The platform hosts multiple client applications, including a web interface, desktop applications, browser extensions, mobile apps, and a command-line interface. [9] The platform offers a free US or European cloud-hosted service as well as the ability to self-host. [10] [11] [12]
Desktop applications are available for Windows, MacOS, and Linux. [13] Browser extensions include Chrome, Firefox, Safari, Edge, Opera, Vivaldi, Arc, Brave and Tor. [13] Mobile apps for Android, iPhone, and iPad are available. [13]
Client functionalities include 2FA login, passwordless login, biometric unlock, passkey management, a random password generator, a password strength testing tool, login/form/app autofill, the ability to sync across unlimited platforms and devices, storage of an unlimited number of items, and storing a variety of information including credit card.
Bitwarden uses zero-knowledge encryption, meaning the company can't see its users' data. This is achieved by end-to-end encrypting vault data with AES-CBC 256-bit and by using PBKDF2 SHA-256/Argon2id to derive the encryption key. [14] [15] The codebases of the PC clients, the mobile apps, and the server are open-source. [16] Third-party security audits are conducted annually and a vulnerability disclosure program is also established. [17] [18] Bitwarden is compliant with HIPAA, GDPR, CCPA, SOC 2, SOC 3, and the EU-US and Swiss–US Privacy Shield frameworks. [18]
Bitwarden offers cloud synchronization with servers situated in the USA and EU. [12] Additionally, users also have the possibility to self-host their own server. [19]
The clients are offered as web interface, desktop application (Windows, macOS and Linux), browser extensions (Chrome, Firefox, Safari, Edge, Opera, Vivaldi, Arc, Brave and Tor), mobile apps (Android, iOS, iPadOS and watchOS). [13] 50 languages and dialects are supported, although not all of them are available on all clients. [20]
Inside the vault, a user can save logins (username and password combination, passkeys and TOTP seeds), cards (debit and credit), identities (billing data and other information concerning an individual) and secure notes (free-form text). Furthermore each item type can be extended by custom fields and file attachments, which are restricted by file size depending on the subscription plan. [13] [21]
Bitwarden supports the import of data from more than 50 password managers, including LastPass, 1Password and Keeper. For the export of data, JSON, encrypted JSON and CSV are available. [22]
To login a user can, in addition to an email-address and password combination, also use biometric authentication, two-factor authentication, single sign-on and passwordless login via notification approval on a mobile/desktop device. [13] [23] [24]
Besides the managing of passwords, Bitwarden also provides other tools, e.g. a password strength tester, a password/username generator, integrations with email alias/forwarding services (SimpleLogin, AnonAddy, Firefox Relay, Fastmail, Forward Email and DuckDuckGo) and a feature called "Send". [25] [26] [27] "Send" allows users to share end-to-end encrypted texts (free version) and files (paid versions) with others. For each item, an expiration date, a maximum access limit and a password can optionally be specified. [28]
In January 2021, in its first password-protection program comparison, U.S. News & World Report selected Bitwarden as "Best Password Manager". [29] In February, with competitor LastPass about to remove a feature from its free version, CNET recommended Bitwarden as the best free app for password synchronization across multiple devices, [30] while Lifehacker recommended it as "the best password manager for most people." [31]
Critics have praised the features offered in the software's free version, and the low price of the premium tier compared to other managers. [30] [32] [33] [34] The product was named the best "budget pick" in a Wirecutter password manager comparison. [35] Bitwarden's secure open-source implementation was also praised by reviewers. [32] [36]
Tom's guide found some features to be less intuitive than they could be, [32] while PC Magazine criticized the high price of the business tier. [37] Mobilesyrup was disappointed by the simplistic graphics of the user interface, and felt that it was missing a few features found in competitors' offerings. [33]
Bitwarden debuted in August 2016 with an initial release of mobile applications for iOS and Android, browser extensions for Chrome and Opera, and a web vault. The browser extension for Firefox was later launched in February 2017. [38] In February 2017, the Brave web browser began including the Bitwarden extension as an optional replacement password manager. [39]
In September 2017, Bitwarden launched a bug bounty program at HackerOne. [17] [18]
In January 2018, the Bitwarden browser extension was adapted to and released for Apple's Safari browser through the Safari Extensions Gallery. [40]
In February 2018, Bitwarden debuted as a stand-alone desktop application for macOS, Linux, and Windows. It was built as a web app variant of the browser extension and delivered on top of Electron. [41] The Windows app was released alongside the Bitwarden extension for Microsoft Edge in the Microsoft Store a month later. [42] [43]
In March 2018, Bitwarden's web vault was criticized for embedding unconstrained third-party JavaScript from BootstrapCDN, Braintree, Google, and Stripe. These embedded scripts could pose as an attack vector to gain unauthorized access to Bitwarden users' passwords. [44] These third-party scripts were removed as part of the Bitwarden 2.0 Web Vault update, released in July 2018. [45]
In May 2018, Bitwarden released a command-line application enabling users to write scripted applications using data from their Bitwarden vaults. [9] [46] [47]
In June 2018, Cliqz performed a privacy and security review of the Bitwarden for Firefox browser extension and concluded that it would not negatively impact their users. Following the review, Bitwarden was made available as an optional password manager in the Cliqz web browser. [48]
In October 2018, Bitwarden completed a security assessment, code audit, and cryptographic analysis from third-party security auditing firm Cure53. [49] [50] [51] [52]
In July 2020, Bitwarden completed another security audit from security firm Insight Risk Consulting to evaluate the security of the Bitwarden network perimeter as well as penetration testing and vulnerability assessments against Bitwarden web services and applications.
In August 2020, Bitwarden achieved SOC 2 Type 2 and SOC 3 certification. [53] [54]
In December 2020, Bitwarden announced that it was HIPAA compliant [55] in addition to already being GDPR, CCPA, and Privacy Shield [56] compliant. [57]
In August 2021, Bitwarden announced that network assessment (security assessment and penetration testing) for 2021 had been completed by the firm Insight Risk Consulting. [22] [58]
In September 2022, the company announced $100M series B financing; the lead investor was PSG, with the existing investor, Battery Ventures, participating. [59] [60] The investment would be used to accelerate product development and company growth to support its users and customers worldwide. [59] [60]
In January, Bitwarden announced the acquisition of Swedish startup Passwordless.dev for an undisclosed amount. [61] Passwordless.dev provided an open source solution allowing developers to easily implement passwordless authentication based on the standards WebAuthn and FIDO2. [61] [62] Bitwarden also launched a beta software service allowing third-party developers the use of biometric sign-in technologies including Touch ID, Face ID and Windows Hello in their apps. [61]
In February, Bitwarden published network security assessment and security assessment reports that were conducted by Cure53 in May and October 2022 respectively. [63] The first related to penetration testing and security assessment across Bitwarden IPs, servers, and web applications. [64] The second related to penetration testing and source code audit against all Bitwarden password manager software components, including the core application, browser extension, desktop application, web application, and TypeScript library. [65] Ghacks reported that "No critical issues were discovered during the two audits. Two security issues that Cure53 rated high were discovered during the source code audit and penetration testing. These were fixed quickly by Bitwarden and the third-party HubSpot. All other issues were either rated low or informational only." [66]
On May 1, Bitwarden launched its own multi-factor authentication app, Bitwarden Authenticator. [67]
In October, Bitwarden introduced changes to the dependencies of its desktop application to include a restricted-use SDK that may prevent public from building the application from scratch, invoking concerns that Bitwarden is moving away from open-source principles. Kyle Spearrin stated in response that it is an issue they plan to resolve, and is "merely a bug". [68]
A password manager is a computer program that allows users to store and manage their passwords for local applications or online services such as web applications, online shops or social media. A web browser generally has a built in version of a password manager. These have been criticized frequently as many have stored the passwords in plaintext, allowing hacking attempts.
LastPass is a password manager application. The standard version of LastPass comes with a web interface, but also includes plugins for various web browsers and apps for many smartphones. It also includes support for bookmarklets.
Google Authenticator is a software-based authenticator by Google. It implements multi-factor authentication services using the time-based one-time password and HMAC-based one-time password, for authenticating users of software applications.
Firefox was created by Dave Hyatt and Blake Ross as an experimental branch of the Mozilla browser, first released as Firefox 1.0 on November 9, 2004. Starting with version 5.0, a rapid release cycle was put into effect, resulting in a new major version release every six weeks. This was gradually accelerated further in late 2019, so that new major releases occur on four-week cycles starting in 2020.
1Password is a password manager developed by the Canadian software company AgileBits Inc. It supports multiple platforms such as iOS, Android, Windows, Linux, and macOS. It provides a place for users to store various passwords, software licenses, and other sensitive information in a virtual vault that is locked with a PBKDF2-guarded master password. By default, the user’s encrypted vault is hosted on AgileBits’ servers for a monthly fee.
Mozilla is a free software community founded in 1998 by members of Netscape. The Mozilla community uses, develops, publishes and supports Mozilla products, thereby promoting exclusively free software and open standards, with only minor exceptions. The community is supported institutionally by the non-profit Mozilla Foundation and its tax-paying subsidiary, the Mozilla Corporation.
SQRL or Secure, Quick, Reliable Login is a draft open standard for secure website login and authentication. The software typically uses a link of the scheme sqrl:// or optionally a QR code, where a user identifies via a pseudonymous zero-knowledge proof rather than providing a user ID and password. This method is thought to be impervious to a brute-force password attack or data breach. It shifts the burden of security away from the party requesting the authentication and closer to the operating-system implementation of what is possible on the hardware, as well as to the user. SQRL was proposed by Steve Gibson of Gibson Research Corporation in October 2013 as a way to simplify the process of authentication without the risk of revelation of information about the transaction to a third party.
Universal 2nd Factor (U2F) is an open standard that strengthens and simplifies two-factor authentication (2FA) using specialized Universal Serial Bus (USB) or near-field communication (NFC) devices based on similar security technology found in smart cards. It is succeeded by the FIDO2 Project, which includes the W3C Web Authentication (WebAuthn) standard and the FIDO Alliance's Client to Authenticator Protocol 2 (CTAP2).
uBlock Origin is a free and open-source browser extension for content filtering, including ad blocking. The extension is available for Chrome, Chromium, Edge, Firefox, Brave, Opera, Pale Moon, as well as versions of Safari before 13. uBlock Origin has received praise from technology websites and is reported to be much less memory-intensive than other extensions with similar functionality. uBlock Origin's stated purpose is to give users the means to enforce their own (content-filtering) choices.
Peerio was a cross-platform end-to-end encrypted application that provided secure messaging, file sharing, and cloud file storage. Peerio was available as an application for iOS, Android, macOS, Windows, and Linux. Peerio (Legacy) was originally released on 14 January 2015, and was replaced by Peerio 2 on 15 June 2017. The app is discontinued.
Enpass is a freemium password manager and passkey manager available for MacOS, Windows, iOS, Android and Linux, with browser extensions for all major browsers, and pricing plans for both personal use and business.
Credential stuffing is a type of cyberattack in which the attacker collects stolen account credentials, typically consisting of lists of usernames or email addresses and the corresponding passwords, and then uses the credentials to gain unauthorized access to user accounts on other systems through large-scale automated login requests directed against a web application. Unlike credential cracking, credential stuffing attacks do not attempt to use brute force or guess any passwords – the attacker simply automates the logins for a large number of previously discovered credential pairs using standard web automation tools such as Selenium, cURL, PhantomJS or tools designed specifically for these types of attacks, such as Sentry MBA, SNIPR, STORM, Blackbullet and Openbullet.
KeePassXC is a free and open-source password manager. It started as a community fork of KeePassX.
Myki was a password manager and authenticator developed by Myki Security. Myki was available on iOS and Android, as browser extensions on Chrome, Firefox, Safari, Opera and Microsoft Edge, and as a standalone desktop app for Windows, macOS, Linux, Arch Linux, and Debian. It was available in English, Arabic, French, German, Italian, Portuguese and Spanish. On 24 March 2022, MYKI announced Jump Cloud's acquisition of Myki and on 10 April 2022, Myki ceased to operate.
Web Authentication (WebAuthn) is a web standard published by the World Wide Web Consortium (W3C). WebAuthn is a core component of the FIDO2 Project under the guidance of the FIDO Alliance. The goal of the project is to standardize an interface for authenticating users to web-based applications and services using public-key cryptography. WebAuthn credentials are sometimes referred to as passkeys.
Firefox Lockwise is a deprecated password manager for the Firefox web browser, as well as the mobile operating systems iOS and Android. On desktop, Lockwise was simply part of Firefox, whereas on iOS and Android it was available as a standalone app.
Mozilla VPN is an open-source virtual private network developed by Mozilla. It launched in beta as Firefox Private Network on September 10, 2019, and officially launched on July 15, 2020, as Mozilla VPN.
NordPass is a proprietary password manager launched in 2019. It allows its users to organize their passwords and secure notes by keeping them in a single encrypted vault. NordPass, which operates on a freemium business model, was developed by the VPN service NordVPN.
The following is a general comparison of OTP applications that are used to generate one-time passwords for two-factor authentication (2FA) systems using the time-based one-time password (TOTP) or the HMAC-based one-time password (HOTP) algorithms.
Proton Pass is a password manager developed by the Swiss software company Proton AG. It stores login credentials, email aliases, credit card data, passkeys, 2FA secret keys, and notes in virtual vaults that are encrypted using 256-bit AES-GCM.
{{cite web}}
: CS1 maint: numeric names: authors list (link)