Is Bitwarden Open Source? The Truth Behind Its Licensing

Bitwarden is open source. Sort of. Its browser extension, desktop, and mobile clients are GPLv3--truly open source. The server is AGPLv3 with proprietary components under the Bitwarden License Agreement. That gap between marketing claims and reality matters when vetting Bitwarden for a team. This guide explains what each license means, why mixed licensing exists, and what the October 2026 commercial shift means for your company.

The Short Answer: Yes, But With Nuance

Bitwarden's answer to "is it open source" is technically correct but incomplete. The clients you download are open source under GPLv3. The server code is open source under AGPLv3. But both contain proprietary code under a separate commercial license, and Bitwarden's marketing often glosses over this fact. You can read the code. You cannot modify or redistribute it without purchasing a commercial license. That distinction--auditable vs. truly open--is why this matters.

When Bitwarden's website says "100% open source," they mean the source is published on GitHub. When the open-source community reads that claim, they hear "you can fork it and run your own version without restriction." Those are different things. The October 2026 shift toward commercial licensing made this distinction unavoidable. Bitwarden isn't disappearing behind a paywall. But features and support are increasingly moving there.

For a 10-50 person company, this means understanding what you're actually getting: a password manager with visible code and regular security audits, but limited freedom to modify it for your specific needs without a commercial agreement.

What Each Component Really Is: GPL vs AGPL vs Proprietary

Bitwarden ships three layers of code, and they have three different licenses. Understanding the difference tells you what you can and cannot do.

The client apps (browser extension, desktop, mobile) are GPLv3. GPLv3 is the standard open-source license: you can read it, fork it, modify it, and run your own version. This is genuinely open source. The VPSBG review and IsItReallyFOSS analysis both confirm this layer is clean. If you built your own password manager client compatible with Bitwarden's API, you could do it legally without Bitwarden's permission, though it would take serious engineering work.

The server code is published on GitHub under AGPLv3. AGPL is stricter than GPL: if you run modified server code on a network, you must publish your modifications back to the community. This protects against closed-source forks. In practice, it means if you run Bitwarden's server and modify it, those changes have to stay open source. This is why many companies self-host Bitwarden using AGPL: they cannot secretly lock in proprietary changes.

But here's the catch: Bitwarden's repository contains code under a third license: the Bitwarden License Agreement (proprietary). Both the client and server repositories include /Commercial directories with code you cannot modify, redistribute, or use commercially without permission. Features in those directories include advanced enterprise functionality: SSO integration, policies, event logging, directory sync, SCIM, and more.

The IsItReallyFOSS review identified Commercial.Core.pdb and Commercial.Infrastructure.EntityFramework.pdb files in Docker images--proprietary compiled code embedded in what Bitwarden markets as open source. This isn't a violation of GPLv3 or AGPLv3 (both allow mixed licensing), but it's opaque in a way that matters for audit and modification.

In practice: You can run Bitwarden's server. You can read most of the code. You cannot use the enterprise features without a license, and you cannot modify the proprietary parts without permission. This is source-available, not open source in the strict OSI sense.

The October 2026 Shift: Bitwarden's Commercial License Announcement

In October 2026, Bitwarden announced a shift in its licensing strategy. App store builds (iOS, Android, Windows Store) would move to a commercial license by default. The free GPLv3 version remains on GitHub. Self-hosting is unaffected. The free tier stays free permanently.

On the surface, nothing changed. In Lemmy discussions with 149+ comments, the community read between the lines. Bitwarden's official statement said "All current features are available in both versions." That word--current--triggered valid anxiety. It strongly implies future features will diverge.

One critical comment (74 upvotes) spelled out the concern: "If you read their announcement carefully... 'All current features are available in both versions' which strongly implies the different versions will start to diverge over time." The community cited MinIO's recent rug pull--a company that deleted open-source repositories entirely--as a precedent to watch.

Bitwarden's response: open source is a business strategy, not a constraint. The company is backed by $100M+ from Battery Ventures and private equity (PSG). Open source reduces acquisition costs and builds trust. But it also limits revenue. The commercial license shift tests whether they can keep both: the trust of open-source users and the revenue of closed-source upmarket features.

For your team: Bitwarden is not going closed-source. But the incentive structure has shifted. Features available today might move to the commercial tier tomorrow. If lock-in is your concern, this announcement is a legitimate reason to look at Vaultwarden.

What "Open Source" Actually Protects You From (And What It Doesn't)

Open source sounds like it solves everything. It does not. Understanding what it actually protects is the decision point.

What open source protects: You can audit the code. No black-box algorithms or hidden backdoors. Third parties (researchers, competitors) can verify claims. Bitwarden has Cure53 audits and publishes results. The open source means those audits mean something: researchers actually see the code being audited. You can fork it. If Bitwarden turned evil tomorrow, Vaultwarden proves the entire stack can be rewritten. No vendor lock-in at the code level.

What open source doesn't protect: It doesn't prevent feature removal. Open source doesn't force a company to keep the free tier free (though Bitwarden promised this). It doesn't prevent licensing changes--which we just saw happen. It doesn't guarantee security: open source code can have vulnerabilities; plenty of users just don't bother checking. It doesn't mean zero cost: Bitwarden's free plan is free, but advanced features cost money whether the code is open or not.

For a company, the real protection is self-hosting. If you run your own Vaultwarden or Bitwarden server, Bitwarden cannot revoke your access or delete your data. You control the infrastructure. You own the deployment. This is why the self-hosting option matters more than the license itself.

Bitwarden's cloud vault is convenient. You pay with surveillance and trust: Bitwarden stores encrypted data, but it controls the service. If they decide to shut down or change pricing, you must migrate. Open source doesn't change that because you're not running the open-source code--you're using their service.

Vaultwarden and self-hosting remove this dependency. You run the code. You own the data. That's the real benefit of open source for companies concerned about lock-in.

The Vaultwarden Alternative: Fully Open Source, AGPL

Vaultwarden is a full, AGPL-licensed rewrite of Bitwarden's server. It works with Bitwarden's official client apps (browser extension, mobile, desktop). It is fully open source: no proprietary components, no commercial license, no feature divergence between free and paid.

The numbers tell the story: 69.8K GitHub stars, 3.4K forks, 3,129 commits. It's actively maintained and deployed by thousands of teams. Interestingly, one Vaultwarden maintainer is employed by Bitwarden and is allowed to contribute on their own time. This unusual arrangement means Vaultwarden gets bug fixes and receives some institutional support.

The trade-off is infrastructure. Vaultwarden requires self-hosting: you need a server, a database, and a domain to run it. You cannot simply click "deploy" and let Bitwarden handle it. This is where Opsily fits: Opsily offers managed Vaultwarden hosting, removing the ops burden while preserving your open-source control.

Vaultwarden is the answer to the licensing question. It is truly open source under AGPL. It has no commercial tier, no proprietary components, no future feature divergence to fear. It works with Bitwarden's official clients, so you gain open-source control without sacrificing the user experience. For a team concerned about lock-in, this is the obvious choice.

The question then becomes: is the self-hosting burden worth the open-source guarantee? For teams running 10+ staff, the answer is usually yes. Opsily handles the burden; you keep the control. For a solo freelancer, Bitwarden's free cloud tier is probably more practical.

Red Flags in Bitwarden's Licensing

IsItReallyFOSS explicitly flags Bitwarden for openwashing: marketing that overstates open-source commitment. Several details support this concern.

Bitwarden's official Flatpak says "Bitwarden is 100% open source software." This is marketing language that ignores the proprietary components in the Commercial directories. It is technically true that all code is published, but it is practically false that you have freedom to use it.

Default builds can include proprietary code. Docker images shipped by Bitwarden contain compiled proprietary .pdb files. A user downloading a standard Bitwarden image gets proprietary code without explicit notice of the licensing distinction. This is different from opting into an enterprise license--it is the default distribution.

Features require license keys even in self-hosted versions. If you self-host Bitwarden, certain enterprise features are locked behind a license key system that requires registration with Bitwarden's servers. This defeats the premise of self-hosting: you are still dependent on Bitwarden's infrastructure for feature access.

IsItReallyFOSS's review (last updated August 4, 2025) concludes: "It's not open source in the strict definition; it's more accurately described as source-available." This distinction matters when evaluating claims.

Bitwarden's response would be: enterprise software has always mixed open and proprietary code. MongoDB does this. Elastic does this. It's a standard business model. The company is right. But it also means the "100% open source" marketing claim is misleading.

Practical Decision: Open Source vs Source-Available vs Cloud Convenience

Now you understand the licensing landscape. Here's how to decide.

For a solo user or freelancer: Bitwarden's free cloud plan is genuinely the right choice. You get convenience, zero ops, and regular security audits. The open-source licensing is less relevant because you are not running the code yourself. The risk of feature removal or price changes is minimal for individuals. Trust Bitwarden's free-tier promise. If they break it, Vaultwarden is a one-weekend migration.

For a 10-50 person team concerned about lock-in: Vaultwarden self-hosted is the answer. 69.8K GitHub stars prove it works at scale. It is genuinely AGPL with no proprietary components. Deploy it through Opsily if ops bandwidth is limited. Cost is typically $20-50/month for hosting plus Opsily's managed service. This is cheaper than Bitwarden's team plan ($60/user/month for 5+ users) and you own the deployment.

For a regulated company (finance, healthcare, legal): Consider both. Vaultwarden's full open-source model means you can audit every line of code for compliance. Bitwarden's commercial license and SOC 2 Type II certification might satisfy auditors. The choice depends on your specific compliance requirements. Some regulators prefer open-source auditability; others prefer vendor certifications.

For a company that wants open source but cannot self-host: This is the hardest position. Opsily solves it: open-source Vaultwarden with managed hosting, so you get open-source control without infrastructure responsibility. Compare this to Bitwarden's cloud: you pay Bitwarden for convenience and proprietary features you may never use. Opsily costs less and gives you actual open-source guarantees.

For a company using Bitwarden today and concerned about October 2026: Migrate to Vaultwarden now while the Bitwarden clients still work with it. The migration is straightforward: export your Bitwarden vault, import to Vaultwarden, update clients to point to the new server. No data loss, no re-entry. The Vaultwarden vs Bitwarden comparison walks through this process.

Red Flags in Your Own Vetting

When you see "open source password manager," ask these questions:

Who controls the official clients? If the company owns them, they can push updates that break compatibility or introduce tracking. Bitwarden owns all official clients, which is why some users choose Vaultwarden with alternative clients like Goldwarden or KeyGuard.

Does the company offer free self-hosting? If yes, open source is likely genuine. If they push you toward cloud, the open source may be marketing. Bitwarden offers free self-hosting but makes the cloud plan more convenient and feature-rich, which is a legitimate business strategy but not pure open source.

What's the license on the parts users actually interact with? Vaultwarden's entire stack is AGPL. Bitwarden's clients are GPLv3, but the server has proprietary components. This difference is material.

How do they handle feature divergence? Ask explicitly: will free and paid tiers have feature parity? Bitwarden won't promise this. Vaultwarden cannot diverge by design: all code is AGPL, which means any feature differences are in the open-source repo where the community can see and fork them.

These questions clarify what you're actually buying into.

Frequently Asked Questions

Is Bitwarden an app?

Yes, multiple apps. Bitwarden ships browser extensions (Chrome, Firefox, Safari, Edge), desktop apps (Windows, Mac, Linux), mobile apps (iOS, Android), a web vault, and a command-line tool. All are available for free and open sourced under GPLv3.

Has Bitwarden been hacked before?

No major security breaches on record. Bitwarden's encryption is zero-knowledge: even if Bitwarden's servers were breached, the attacker would get encrypted data. The encryption keys never leave your device. This is true whether the code is open source or not.

Is Bitwarden safe for bank accounts and financial data?

Yes. Zero-knowledge encryption means financial data stays encrypted even if Bitwarden is compromised. The limitation is that Bitwarden's master password hashing is PBKDF2 with 100,000 iterations--good but slower than Argon2. This does not weaken security meaningfully. Both Bitwarden and Vaultwarden handle financial credentials safely.

Who owns Bitwarden and why does it matter?

Bitwarden Inc. is backed by Battery Ventures and PSG (private equity). The company raised $100M+. Private equity backing means exit is likely: acquisition or IPO. This increases incentive to monetize aggressively. It doesn't mean Bitwarden is evil, but it means the incentive structure favors shareholders over users. This is why Vaultwarden's AGPL licensing--no ownership, no exit pressure--matters to some teams.

What was the October 2026 commercial license announcement?

Bitwarden announced that app store builds (iOS, Android, Windows Store) would transition to commercial licenses. The free GPLv3 version remains on GitHub. Self-hosting is unaffected. The free tier stays free. But the announcement triggered concerns about future feature divergence. The community fears that features will gradually move to the commercial tier, making the free version less useful over time.

Can I run Bitwarden myself and avoid the cloud?

Yes. Bitwarden is self-hostable via Docker. But self-hosted Bitwarden still requires license keys for enterprise features. You cannot avoid Bitwarden's servers entirely unless you use Vaultwarden instead. The open-source self-hosted alternatives guide compares self-hosting options.

What is Vaultwarden and why would I use it?

Vaultwarden is a full rewrite of Bitwarden's server, AGPL-licensed with zero proprietary components. It works with Bitwarden's official client apps but removes the cloud dependency and licensing restrictions. If you want open-source password management with no lock-in, Vaultwarden is the answer. The trade-off is self-hosting infrastructure, which Opsily manages for you.

The Bottom Line

Bitwarden is open source in source code, but source-available in practice. The distinction matters if lock-in is your concern. The October 2026 shift toward commercial licensing validated community fears about feature divergence.

Vaultwarden solves this: fully open source, AGPL, no proprietary components, no future licensing changes. If your team values open-source control and wants to avoid vendor lock-in, Vaultwarden is the clear choice. The infrastructure burden disappears when you choose managed Vaultwarden hosting.

For individuals or teams comfortable with cloud and willing to trust Bitwarden's commitment to the free tier, Bitwarden works fine. For everyone else, the answer is Vaultwarden.