5 ms·
Get your passwords out of Bitwarden while you still can
- eleventen 6mo agoI think this is a little hyperbolic. The product may drop features, increase prices, and squeeze its free tier users. Everything enshittifies. But the idea that password export might disappear or be degraded? Nah. You'll be able to jump ship any time you want.
- tremarley 6mo agoNever underestimate the lengths companies will go to, to enshittify their product to squeeze customers for money.
- eleventen 6mo agoName one major password manager that blocks or paywalls export.
- kpozin 6mo ago- Authy - Google Authenticator
- Someone1234 6mo agoNotably not password managers.
- MostlyStable 6mo agoGoogle Authenticator has an export-as-QR-code function that several other authenticator apps can parse. Is it the best/most convenient implementation? Obviously not, but you can absolutely export the codes.
- eleventen 6mo agoNot password managers of course, but thanks for reminding me that I should figure out how to ditch Authy. https://github.com/BrenoFariasdaSilva/Authy-iOS-MiTM https://github.com/BrenoFariasdaSilva/Authy-iOS-MiTM is going to be my project for the afternoon.
- Ringz 6mo agoEnte Auth is a good alter. Works perfect for me.
- pablopr3 6mo ago[dead]
- MrDisposable 6mo agoI had to migrate from Authy because it doesn't work on Graphene OS. Migrated to Ente Auth and couldn't be happier.
- Itoldmyselfso 6mo agoComment you're replying to should've specified afterwards. Feature that were never there is very different than pay walling a such essential feature.
- gruez 6mo agoThe iOS "passwords" app didn't support exporting for a while, though they eventually added it.
- ptrl600 6mo agoUsually when this type of thing happens, all the major players decide to do it at the same time.
- vallassy 6mo ago>You'll be able to jump ship any time you want. Famous last words...
- AdmiralAsshat 6mo agoI mean, LastPass was a train wreck after their breach, but they didn't go as far as trying to stop me from exporting my vault when I switched to BW. The idea of BW doing a rug pull and suddenly removing the ability to export your vault I think would trigger a class-action lawsuit.
- e40 6mo agoI don't know why this is framed as "jumping ship" ... of course you can stop using it any time (and use your periodic export to go elsewhere). The real issue is potential data loss. Remember LastPass? Bought by someone and downhill it went, with multiple security incidents.
- Someone1234 6mo agoI think the caution around Bitwarden is justified; and I think it is good that the message is getting out there. I will say "while you still can" is hyperbole, and will do more to distract from the larger (correct) point about Private Equity.
- avgDev 6mo agoA tale as old as time, enshitification.
- PaulHoule 6mo agoSometimes I think when a startup announces that they are being acquired their competitors have a meeting that morning and announce that they're going to start dialing for dollars. Since acquisitions almost always hurt customers I wonder if we can start creating "poison pills" that deter them.
- oliculipolicula 6mo agoA successful sequel or reboot is its own poison pill https://automaton-media.com/en/news/kadokawa-reports-sharp-decline-in-publishing-anime-business-falls-into-deficit-due-to-a-lack-of-popular-sequels/ https://automaton-media.com/en/news/kadokawa-reports-sharp-d...
- MostlyStable 6mo agoWhile I'm not _happy_ about the messaging changes, those alone are not enough to do more than start paying closer attention. I highly, highly doubt that vault export would be the first meaningful feature change, and so I think there will be stronger signals of actual issues before then. As I understand it, so far the only actual change is an announced increase in prices. Obviously, from the consumer perspective, cheaper is better, but this is a product where I think that a subscription plan makes sense (and the free tier, for now, still exists), and so I'm not going to get mad about price changes. Competitors exist and one doesn't think the new price is worth it, then switch to one of them (using the very-much-still-available vault export). I don't think the warning is crazy or anything, but in my personal opinion it's a little stronger/earlier than is warranted and the current appropriate response is careful watching.
- ktm5j 6mo agoI hear you, but I feel like it's a better safe than sorry situation. Exporting your passwords takes two seconds. I think you can export to an encrypted file, but I just did a plain-text json file and gpg'd it. Can't hurt to play it safe.
- throawayonthe 6mo agoif you have to do the 'encrypt single plaintext file' dance at least use age[0] in 2026 [0] https://age-encryption.org/ https://age-encryption.org/
- poisonborz 6mo agoClients are OSS, I wonder why nobody did a Vaultwarden-style fork of them yet that would watch over upstream changes.
- subhobroto 6mo agoVaultwarden is a very lean implementation of Bitwarden but if you want to look into an alternative to the Bitwarden ecosystem, I recommend - AliasVault https://github.com/aliasvault/aliasvault https://github.com/aliasvault/aliasvault - check it out!
- jerf 6mo agoUntil Bitwarden screws up it's going to be difficult for any fork to get much attention. If they do, that will the moment to launch a fork. It's Bitwarden's game to lose. Forking is easy enough that there's no great need to pre-emptively fork.
- cortesoft 6mo agoProbably because there is no need to fork until you have to. Why do it prematurely and have to keep it up to date when you can just do it when it is needed?
- pattilupone 6mo agoWOW. Quietly editing the 4-year-old blog post is super slimy, holy crap. Also seems like since this story was published, they edited the 4-year-old blog post again. The story points out >But the explanatory paragraph at the bottom of the same post still says the old ones: Inclusion and Transparency. Crandell’s name is still on it. The post now contradicts itself, and nobody wrote a new one. Looking at the post right now, they've corrected it to Innovation and Trust.
- chuckadams 6mo agoNothing says Trust like quietly and retroactively editing old blog posts. We have always been at war with EastAsia.
- cjwoodall 6mo agoI wish companies that offer such a core technology and what not were at times entered into a public trust, similar to how some public lands are managed, that would protect them from private equity takeovers; I know it defeats the purpose of the companies in the first place (making money), and it probably would backfire in myriad worse ways than the problems it might solve... But I do think there are many options for how products, services and what not can be structured that give the people who maintain them what they need to thrive; without mining the users for money. Overly idealistic thinking, maybe... but still thinking.
- throwaway85825 6mo agoPublic management exists for natural monopolies where no market competition is feasible. The role of the public entities is to protect competition. In this case that would be mandating import/export interoperability.
- subhobroto 6mo agoI'm a huge fan of AliasVault https://github.com/aliasvault/aliasvault https://github.com/aliasvault/aliasvault - the author is responsive, receptive. The whole ecosystem is opensource. Bitwarden/Vaultwarden had a good run but if someone's going to self-host Vaultwarden, I would encourage people to look into AliasVault instead. It's a complete opensource ecosystem.
- cjs_ac 6mo agoI store my passwords using this: https://www.passwordstore.org/ https://www.passwordstore.org/ It's a shell script that stores passwords in a git repository, containing one file per entry. The files are encrypted using a GPG key. Because it's just a git repository, you can synchronise it between devices using whatever infrastructure you want. I use a FOSS client for it on iOS, and there was one for Android before I got an iPhone.
- Depraved4482 6mo ago+1 for pass! I use this on my VPS to store secrets. I love that it syncs with GIT. Good stuff
- ab71e5 6mo agoI'm interested in this, what do you use to host the git repo? Just a private repo on something like github or your own server? How do you backup your private key?
- cjs_ac 6mo agoI run Gitea on my own server. (I didn't switch to Forgejo because it's not in the Debian repositories.) I don't have a backup of my private key... I should do that.
- wfleming 6mo agoI also use pass. Any forge you feel like is fine (I use gitlab). I backup my gpg key with `gpg —export-owner-trust` and store that backup elsewhere. Pass has a pretty good ecosystem of plugins/other clients, as well. There are open source iOS/Android clients and browser extensions so once you’re setup the day-to-day experience is not far off from any of the popular hosted password managers. My only real issue is the dependency on gpg, as it’s pretty long in the tooth and a hassle to operate. (If you are not comfortable using gpg, spend some time learning that before you go all-in on pass!) There’s a fork[1] which swaps gpg for age, but it hasn’t attracted enough attention to get a similar ecosystem of mobile clients/browser extensions, so it’s not a very practical choice IMHO. [1]: https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage
- jrm4 6mo agoThird-party password management as an isolated paid service (i.e. you don't get password management unless you pay specifically for the password management) is just a terribly bad idea all around. Waiting for people to get this.
- e40 6mo agoA bad idea for you. My non-technical family members can barely use 1Password and it is the easiest of the lot. The idea you promote is just not realistic.
- baal80spam 6mo agoNot really. That something is convenient doesn't mean that it's a good idea. It's always a matter of convenience vs security.
- sandeepkd 6mo agoIts a catch 22, with password requirements getting crazy its hard to remember them. At the same time storing the passwords with a password manager means you are entrusting them for your identity. For the first party sites the passwords are hashed, however for these password manager sites they are at the most encrypted with the encryption keys that the third party already has. This essentially means a rouge password manager or rouge individual in password manager service can run away with your plaintext passwords on scale
- starkparker 6mo agoThis frames the only options as mediocre and better, when the reality is likely the third, most common, and worst option: nothing.
- 9x39 6mo agoThe inverse also doesn’t mean convenience is a bad idea, just happens 1Password has a strong security model and is convenient. I end up helping a lot of older people for a variety of reasons with tech - 60s to 90s, family, neighbors, coworkers. They’re not invalids and have a right to participate in the digital world, even if security requirements have exploded. Anchoring the trust in stuff like 1Password where we setup domains, their account info, their OTP codes means they get to go to their bookmarked site, FaceID to unlock the PW manager, get automatically logged in, and do what they need. Being able to let them navigate this world without always having to hand over the paper secrets notebook to random helpers, or lose sheets of paper with passwords, or get caught up in tracking down an SMS code is better for them. Their password manager with the autofill helps somewhat deter phishing links since relying on autofill usually signals something is off, and they call someone they trust. My point, I guess, was that convenience is basic access for some subset of vulnerable groups of people.
- bilal4hmed 6mo agoThis is getting so tiring. What are the other options out there now?
- skarz 6mo agoProtonPass
- undeveloper 6mo agovaultwarden (self hosted)
- parliament32 6mo agoKeePassXC has always been the one true path.
- culi 6mo agoWhat is the option for people who want access to their passwords on their phones and don't wanna set up a complex or fragile sync regime (I do use KeePassXC btw. I just think this is what GP's real question was)
- parliament32 6mo agoUltimately, you have to store the file somewhere and sync it to all the places you want it. The magic here is that it decouples the "password manager" and the "file syncer" so you can (and should) use whatever you're already using. Greenfield, Nextcloud is the cleanest if you want FOSS and self-hosting (and they have clients for basically every platform under the sun), otherwise pick your poison between google drive, dropbox, icloud, onedrive, etc.
- culi 6mo agohttps://alternativeto.net/software/bitwarden--free-password-manager/ https://alternativeto.net/software/bitwarden--free-password-... Honestly after years of resistance I've finally partially embraced Apple's solution and have to admit it works great. I love that Hide My Email is integrated into it so well too Vaultwarden looks neat: > Lightweight, self-hosted server written in Rust, fully compatible with Bitwarden clients, implements the Bitwarden server API, supports organizations, attachments, web interface, website icon API, YubiKey, Duo, and multiple two-factor authentication options.
- tfarias 6mo agoI've been recommending Bitwarden for a few years now and have also been paying a yearly sub since 2022, as I always thought 10$ was a really good value. But with all this stuff coming out, I'm holding off on recommending it anymore; at least until everything calms down and the new value proposition is fully laid out. Like other folks have said, I don't think it's yet time to migrate. That being said, it doesn't hurt to do an encrypted export for backup purposes, start looking at alternatives, and reach out to people I know use Bitwarden to do the same. Keeping an eye out on how this develops.
- solarkraft 6mo agoAgreed. I will continue using it as it currently fulfills my needs. But I’m not going to shout it at everybody I catch not using a password manager anymore. I’m just not willing to take responsibility for the changes they may make in the near future. As an aside, since it seems like they’re trying to make money: The aforementioned enthusiasm has gotten it adopted at a workplace of mine. The experience hasn’t been good, so no recommendation here either. Their moat was being a trusted name in FOSS and it’s a bit sad to see them going in the direction of abandoning it. But somebody else will probably step up and build on the ruins, like vaultwarden already has. That’s the beauty of choosing FOSS in the first place.
- scrollop 6mo agoYou should try hosting it yourself in docker. Absurdly easy to do if you get an llm to do it and it works very, very well. Hope they don't alter self hosting it.
- horsawlarway 6mo agoIf you're going to the trouble of self-hosting, I'd suggest just running vaultwarden. https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden It's entirely compatible with the clients. It also removes a lot of "rug-pull" potential, and gives you the ability to access all the nice features (ex - multi-org, multi-user, shared vaults, totp, etc...) Honestly - part of the reason I like Bitwarden is that if they ever go full "enshittification", it's going to be relatively easy and straight-forward to just move entirely off their projects and onto open-source forks.
- steviedotboston 6mo agoThis is a whole lot of FUD.
- ChrisArchitect 6mo agoRelated: The quiet renovation at Bitwarden https://news.ycombinator.com/item?id=48163389 https://news.ycombinator.com/item?id=48163389
- Humorist2290 6mo agoI'm taking a "wait and see" approach with Bitwarden. I've been a paying customer for a while, happy with it, and hoping the leadership changes won't be too user hostile. Still, a major reason I chose Bitwarden to begin with is they have a decent "Export" button, and all of this news reminded me that my offline backup of the vault was a few months old. Regardless of their product roadmap, they could have an incident tomorrow that keeps users away from their passwords -- offline backups are a good idea. And Vaultwarden is nice. I've used it at work, hosted it myself, and as a user of the password manager I can say it's basically indistinguishable. But I don't really pay Bitwarden for a password manager -- I pay them for a secure sync of a password manager I can share with family members who can't figure out a VPN.
- bitlevel 6mo agoI have been paying for Bitwarden (BW) premium since 2019 and earlier this year decided to move away from BW due to the password filling becoming somewhat hit-and-miss (even on a fresh install), along with taking its time to do so. Had previously used Enpass in the past and was pleased to see how much it had improved since then. Also allows me several choices when it comes to where I store my vaults. And fills passwords quickly and efficiently in comparison to BW. So I've migrated fully to Enpass - clients everywhere, browser plugins available, and it just works. With this news, it now looks as though my migration was somewhat prescient. I also use KeypassXC as a backup on USB should it ever be needed.
- bitlevel 6mo agoJust to add - in my experience, exporting from Bitwarden loses a bunch of things - attachments, passkeys and a few obtuse items. This isn't a good - particularly as passkeys are effectively just certs - migrators should be aware of those caveats.
- donmcronald 6mo ago> I'm taking a "wait and see" approach with Bitwarden. I won’t. The optics look bad and that alone is enough to show the leadership is either hostile to users or too inept to understand why their recent actions signal a change away from what people value in their product. If they don’t understand or care about the same things as the community / customers, there’s no reason to think they’ll make choices that continue to be a good value proposition for their customers. The only thing that’s going to stop tech companies from pulling this crap is if a hint of private money coming in to ruin everything ends up ruining things before everyone gets to cash in. Basically, a mass exodus and bankruptcy would be the only outcome that makes the next company think twice about using the enshitiffication playbook. We need some companies built around fair value instead of extortion and they need to be run like Steam. Steam has an unbreakable hold on gaming because they’ve never screwed their users.
- stormed 6mo agoI only use Vaultwarden, which to my understanding is an open source reimplementation of Bitwarden's API. I personally haven't had any issues with it, not sure if it'll eventually stop being compatible with Bitwarden's official applications however.
- AdmiralAsshat 6mo agoThe original creator of Bitwarden still works there as a CTO. I am curious whether he has any failsafes/poison pills in his contract when he took VC money that allows him to fork the product and start over in the event that they decide they want to lock everything down. Or did he sign all of those rights away when he took the $100M "fuck you" VC funding in 2022.
- cortesoft 6mo agoDo you need a contract like that when the product is open source? The only thing he couldn’t keep would be the name.
- AdmiralAsshat 6mo agoThere would be nothing preventing him in the source license, but I'm saying he may be prevented as part of the contract he signed when he sold the company.
- HeartStrings 6mo agoKeepassXC
- Terr_ 6mo agoSo I have an admission here: I keep seeing HN stuff about these networked password managers and I don't quite understand the appeal. Is it because everybody else is swapping between several different computers, and you need the synchronization? I just have everything in KeepassXC, and the ciphertext is subject to the same kind of backup regime I use for other files, [edit: and also additionally] a copy kept on a USB stick in my pocket.
- Angostura 6mo agoIs it because everybody else is swapping between several different computers, and you need the synchronization? .. and phones, and tablets. Yes
- 9x39 6mo agoHaving a password manager synced to phone, desktop, laptop, browsers is handy. I used Keepass 10 years ago but I prefer integrated experiences now, particularly since I often pull them up on mobile. Also consider teams or multiple teams across an org sharing secrets. Flat files are a tough sell, so these apps eliminate almost all the hassle. We pay for a lot of 1Password accounts, and I couldn’t imagine rolling our own solution.
- markdown 6mo agoThe Apple Passwords app does all this just fine. The only thing it's missing is secure notes to store my 2FA recovery codes in.
- cortesoft 6mo agoThat works if all your devices are Apple devices.
- markdown 6mo agoYes
- benhurmarcel 6mo ago
- sys32768 6mo agoWe were just about to go to BitWarden from KeePass.
- TN1ck 6mo agoI switched to Apple Passwords this week. Really good passkey support, 2FA support, best iOS integration. You can even share passwords with others. Sadly no first party cli support. If you only use Apple devices, it’s really solid.
- WolfeReader 6mo ago"If you only use Apple devices, it’s really solid." It's not a good idea to become dependent on a single corporation's products.
- Shank 6mo agoYou can leave via Strongbox (a KeePassXC client), which supports the new export system that includes Passkeys.
- CharlesW 6mo agoYou can eject whenever you like: https://support.apple.com/guide/iphone/export-passwords-iphf28f2e93e/ios https://support.apple.com/guide/iphone/export-passwords-iphf... Passkeys too: https://sixcolors.com/post/2025/09/export-keys-securely-from-passwords-to-third-party-managers/ https://sixcolors.com/post/2025/09/export-keys-securely-from...
- fidotron 6mo agoSurely they have their reasons, but if they made Linux support work I suspect a lot of the dev community would jump. This household certainly would.
- chuckadams 6mo agoI only use Apple devices myself normally, but if I'm stranded out in the middle of nowhere and have to borrow someone's Android phone or Windows box in order to connect to important stuff like my bank, I'd really rather not be out of luck. Same reason I don't self-host my vault.
- markdown 6mo agoThe only thing it's missing for me is secure notes for me to store my 2FA recovery codes in. So I mainly use Apple Passwords now, but still keep Bitwarden going for secure notes.
- craigmart 6mo agoThis is an incredible overraction over a minor change that did not even happen. You can still find "Always free" in the pricing line of the very same page everyone keeps linking as proof https://bitwarden.com/products/personal/#whats-the-difference-between-free-and-premium https://bitwarden.com/products/personal/#whats-the-differenc... Edit: it actually disappeared for some time but they put it back on May 18 snapshot from May 15: https://web.archive.org/web/20260515190646/https://bitwarden.com/products/personal/ https://web.archive.org/web/20260515190646/https://bitwarden... snapshot from May 18: https://web.archive.org/web/20260518183728/https://bitwarden.com/products/personal/ https://web.archive.org/web/20260518183728/https://bitwarden...
- Angostura 6mo agoWell it did happen - and then unhappened when people noticed.
- craigmart 6mo agoI had checked as soon as I found out about the news the other day and it was there. I just checked on wayback machine and you're right, it was removed for some time. However, if they're willing to put back that claim immediately, I doubt that their intention was to drop the free plan anytime soon, but probably it was to incentivize people to use the paid plans. Enshittification must happen sooner or later afterall, but fortunately vaultwarden exists and the export feature is highly unlikely gonna be removed immediately as the free plan disappears, so people could just switch to a third-party or self-hosted backend as soon as that happens.
- SubiculumCode 6mo agoYes, there are signs of an oncoming enshitification, and these types of articles gaining traction is good because it sends a signal to the company of potential consequences....but at the same time, the evidence supporting Bitwarden enshitification is pretty weak at this point. There are degrees here, not just either/or, on/off, good/shit.
- VLM 6mo ago"This way your passwords are truly yours" They were never yours, and zillions of people you don't know have access to them.
- ranger207 6mo agoMy company just finished switching from LastPass to Bitwarden. Just in time for that to become terrible too it looks like lol
- abfan1127 6mo agoI've been using LastPass for years. I really like it. Why did you switch away?
- nacs 6mo agoLastpass has had multiple large breaches, especially after LogMeIn bought them out
- culi 6mo agoMy old company switched through 4 different managers in the span of 3 months. They switched to LastPass just before all the seemingly endless breaches started. I think they were willing to weather it at first but things just got worse and worse. I think they also ended up with Bitwarden
- nickburns 6mo agoAnyone not already using KeePass (or KeePassXC) has been doing it wrong for at least a decade. KeePass2Android Offline and KeePassium on mobile.
- deleted 6mo ago[deleted]
- normalaccess 6mo agoFor TRUE offline password storage use "Off The Grid". A cryptographically secure paper based password generator created by Steve Gibson from he Security Now podcast. https://www.grc.com/offthegrid.htm https://www.grc.com/offthegrid.htm
- fpauser 6mo agoThats why I use vaultwarden. I also like the fact, that vaultwarden is written in rust and does not consume a lot of resources, which is great for selfhosting.
- 9x39 6mo agoSerious question - how come free is a requirement for a password manager? Everyone's gotta eat, including the maintainers of password managers. Tech has generous TC, lots of high-end laptops and phones worth thousands, AI & cloud spend, and yet the only acceptable price for secrets management is $0 it seems at times.
- culi 6mo agoThey promised an "always free" option. People committed to the service based on that. Many companies offer a free tier and a paid tier and are willing to incur the cost of users who will never convert. If a company doesn't actually intend to keep it "always free" they shouldn't make the promise in the first place
- gregoriol 6mo agoI think a company has to be able to change its commitment, but should not screw users at the same time. For example, if they want to remove the free plan, why not, strategy can change with context, the world is moving around the company, so then remove it for new users not existing ones and it's all good.
- culi 6mo agoMaybe that's fair but that's not what's happening here.
- cocoa19 6mo agoI’ve been a paying user for years, but the free tier change announcement is a sign of the enshittification to come. It means the old guard is moving away and potentially starting initiatives not in the best interest of the user. In the worst case scenario they will sell my data or introduce stupid changes that risk security.
- fontain 6mo agoPasswords are critical, losing them because you forget to pay or run out of money would be a disaster. I suspect they would still provide access in read only mode to non-paying users so it wouldn’t be a disaster if they didn’t offer a free version but I think it’s pretty easy to see why someone thinks it should always have a free offering.
- colordrops 6mo agoI knew when I started hearing ads for BitWarden on NPR that the good times were over.
- arikrahman 6mo agoJust switched to KeepassXC and syncthing. Transferring keyfiles over LocalSend. This has been a great local FOSS way to keep autonomy over secrets, without even needing internet.
- SilverElfin 6mo agoAll these companies are being bought by PE right? So what's a safe vendor to use?
- blablabla123 6mo agoThe last months didn't make Bitwarden look very good. On the other hand, what about the competition? Sure there's KeePassXC but that's essentially local. Bitwarden even has Send to quickly share with anyone. I might self-host something at some point. But even choosing something seems a menial task, not to speak of setting it actually up...
- aryan14 6mo agoYou can host your keepass db file anywhere you like, whether that’s google drive or on a hard drive.
- nullbyte 6mo agoSince Bitwarden is open source, can't somebody create a community-driven fork? Maybe a self hosted option?
- 28304283409234 6mo agoSomebody did: https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden
- cortesoft 6mo agoSomeone can, and did
- rootsudo 6mo agoIt’s good to review, but what is the risk if you do become a paying customer? Paying mean they have revenue, an interest to keep it secure and innovate more. I recall last pass and the last pass breech and the class action from that but that resulted from improper crypto rollout. Would the same risk happen with Bitwarden?
- gbell12 6mo agovim has an encryption feature (:help encryption). With some AutoCommands, keeping your own encrypted password list becomes painless. On other platforms (phone), enter your 12 or so passwords once and let them store them.
- gaws 6mo agoThe great thing about Bitwarden is its ability to sync passwords between multiple devices seamlessly. KeePassXC is the next move here, and I'd like to know how people made syncing work, especially for iPhone users.