Bitwarden
Bitwarden stores passwords, payment cards and private notes in an encrypted vault that syncs across devices. It’s made by Bitwarden, based in the United States.
Criminals have used its name in fake downloads or scams, so get it only from bitwarden.com.
What it is
People use Bitwarden to save login details, generate passwords and share selected items. The Mac app lets you browse and edit your vault, then copy details into other apps.
It handles the passwords and other information you save in its vault. Data is encrypted on your device before being sent to the server. The direct-download Mac version can also import passwords from supported browsers after you confirm with your computer password.
Bitwarden publishes its source code and independent security assessments, including a desktop app audit by Cure53. It supports unlocking with Touch ID and stores authentication tokens and biometric unlock data in the macOS Keychain.
Who makes it
Bitwarden is a password management software company founded in 2016 and based in Santa Barbara, California. Its legal name is Bitwarden, Inc.. Its website is bitwarden.com.
Is it the real one?
Every Mac app carries a signature from the developer who made it. Apple checks who the developer is before handing out the certificate, and macOS refuses to open an app whose signature has been tampered with.
HARD hasn’t yet recorded the signature on a real copy of Bitwarden. Its Mac app shows who signed the copy you have.
Its bundle ID, the name macOS knows it by, is com.bitwarden.desktop. Download it only from bitwarden.com or the Mac App Store, not from an ad or a link someone sends you.
Fakes. In November 2024, criminals used Facebook ads claiming to offer a Bitwarden security update. The ads led to a fake Chrome Web Store page and a malicious extension that stole Facebook account and billing information.
What it connects to
In normal use, Bitwarden talks to these places on the internet. A firewall that asks before apps connect, like the one in HARD’s Mac app, will show them.
| Address | Why |
|---|---|
api.bitwarden.com | Vault service and synchronisation, US region |
api.bitwarden.eu | Vault service and synchronisation, EU region |
identity.bitwarden.com | Account authentication, US region |
identity.bitwarden.eu | Account authentication, EU region |
icons.bitwarden.net | Website icons for saved logins |
artifacts.bitwarden.com | Direct-download desktop app updates |
Security record
Problems with Bitwarden or Bitwarden in the last three years, newest first. Keeping the app up to date covers the ones that were fixed.
| When | What happened | Source |
|---|---|---|
| A server flaw let organisation members add vault items to collections they could not edit; it was fixed in server version 2026.10.1. | ↗ | |
| A server flaw could let a user sign in as another organisation member under specific single sign-on conditions; it was fixed in server version 2026.5.0. | ↗ | |
| A malicious command-line package briefly reached npm users; Bitwarden revoked compromised access and deprecated the package, and said ordinary desktop users were unaffected. | ↗ | |
| Researchers found weaknesses assuming an attacker controlled Bitwarden’s server; Bitwarden reported fixes and ongoing remediation, while accepting three findings as intentional design choices. | ↗ |
References
- Bitwarden desktop build configuration github.com
- Bitwarden legal company information bitwarden.com
- About Bitwarden bitwarden.com
- Bitwarden company and product facts bitwarden.com
- Password Manager Desktop Apps bitwarden.com
- Import from Chrome, Edge, and Chromium Browsers bitwarden.com
- Desktop App Feature Support bitwarden.com
- Download Bitwarden bitwarden.com
- Release Notes bitwarden.com
- Compliance, Audits, and Certifications bitwarden.com
- Bitwarden Domains, Endpoints, and URLs bitwarden.com
- Bitwarden Public API bitwarden.com
- Sync your Vault bitwarden.com
- Data Privacy for Website Icons bitwarden.com
- Bitdefender investigation of fake Bitwarden Facebook ads bitdefender.com
- CVE-2026-119414 github.com
- CVE-2026-101878 github.com
- Bitwarden Statement on Checkmarx Supply Chain Incident community.bitwarden.com
- Bitwarden response to ETH Zurich cryptography findings bitwarden.com