Bitwarden Review

Password Vault

As a standard functionality of all password managers, Bitwarden enables you to safely store and access your passwords and any other sensitive information in an encrypted vault.

I often like to make the comparison of password vaults to brick and mortar bank vaults where safety deposit boxes are kept. As with the bank, only the authorized user can open their safety deposit box with their unique key. While the bank acts as a host for the safety deposit box, they never know what the client stores inside the box. This concept is the same for Bitwarden, they simply secure the contents of your vault without knowing what data it contains.

The vault can either be hosted by Bitwarden in the cloud or you can self-host the vault. I recommend choosing the cloud – it is the easiest option, especially if you aren’t technical. However, there are benefits to self-hosting – I discuss these in more detail later in the review.

All in all, the secure vault is a safe place to store and manage your passwords as well as other sensitive information (mentioned below).

Unlimited Logins, Cards, Identities & Notes

Previously, Bitwarden only supported the storage of unlimited login credentials while other information had to either be stored in the “Notes” section. Or, if you were technically able, you could create custom fields for data entry. I like to keep things simple and if a password manager doesn’t make it easy to enter and store the information I need then I tend to rate the ease of use fairly low. However, the good news is that, in addition to passwords, Bitwarden now supports the storage of:

• Card information – Credit and debit cards can be stored to make online shopping effortless. Whilst shopping, Bitwarden can automatically fill card information for a secure and fast checkout process.
• Identities – Store names, phone numbers, address information, and any other form of identification. As with login credentials and card information, identity data can also be used to auto-fill online forms.
• Secure notes – Store generic text-based information. This is the same as you would store notes on your phone.

Bitwarden protects your card details, identity data, and notes with the same encryption and security protocols as your login credentials.

Password Generator

Although password generators are generally included by password managers for added value, the Bitwarden one does something a little bit special. Of course, it will generate random, complex passwords made up of special characters and numbers, but it also lets you evaluate password strength by calculating the time it would take a hacker to crack it. This is a nice addition but shouldn’t be a key reason to choose Bitwarden since there are similar tools provided online.

Auto-fill

One of the features that draws so many individuals, families, and businesses to password managers is their ability to auto-fill your credentials at a click of a button, meaning you no longer have the laborious task of manually entering usernames and passwords. In fact, auto-fill stretches beyond the realms of login credentials allowing you to fill addresses, identity information, and even credit card details to facilitate a secure and fast checkout while shopping online.

To use auto-fill on desktop you need the browser extension, and for mobile, you need the app and to enable Bitwarden as your password manager of choice – both are easy to do.

On desktop there are several ways to perform auto-fill with Bitwarden:

1. When you view a website Bitwarden will open a popup window where you can view login, select one, and it will be auto-filled.
2. Alternatively, you can use the right-click menu in your browser to obtain the list of logins for selection – this was the method I chose and although it is straightforward to use, it doesn’t have an as clean of an interface as that of Dashlane or LastPass.
3. Another way to use the auto-fill feature to quickly complete a login form is to use hotkeys or keyboard shortcuts. When you view a website you can enter the keyboard shortcut and Bitwarden will fill the credentials that were last used for the website.

On mobile, there is one way to auto-fill your credentials. When you need to fill a form, a Bitwarden pop-up will appear below the input field, you then select the appropriate login from the list. It’s a very simple process. Bitwarden’s mobile auto-fill is on par with the rest of the password managers for ease of use.

File Storage

File storage is only available to premium individual and organization accounts. Is it a deal-breaker? Not really. I don’t store many files in my secure vault, probably because I don’t have any that are confidential. However, if you have confidential contracts or agreements that you need to keep away from prying eyes, then file storage can be beneficial. If that resonates with you, then the 1GB encrypted file storage and option to add further 1GB increments may be worthwhile.

You can store any type of file, including certificates, photographs, documents, and much more.

Device Sync

Bitwarden has always included syncing between devices as a feature in all their applications although syncing wasn’t always immediately available across all devices. This caused frustrations for many users and as a result, Bitwarden improved the feature to now offer live sync. This simply pushes synchronization between Bitwarden apps in seconds, meaning the latest data stored in your secure vault will be immediately available across your desktop and mobile devices.

Organizing Your Vault with Collections and Folders

I’ve tested a wide range of password managers and although I like to be able to organize my credentials in an orderly fashion, I often find myself using the search function to find the information I’m looking for. So, while being able to organize your vault is a nice-to-have feature, it’s certainly not a critical one. Nevertheless, here are my thoughts on Bitwarden’s organization abilities.

There are two primary methods of organization: collections and folders. The difference is that collections can be used by companies to control user access, while folders are used by individual users to organize items in their vaults. Folders can also be broken down further using nested folders (sub-folders). Nested folders follow a naming protocol where a forward slash (/) acts as a delimiter.

For example, you may create a folder titled “Social” to store your social media credentials. In this folder, you could create a nested folder for each social media platform, e.g. “Social/Facebook”. Here, “Facebook” will be nested as a sub-folder under the parent folder “Social”. There is no limitation on how deep you can go with the nested folders but, for ease of use, I only recommend going 3 deep max.

If no “parent” folder is created, nesting won’t happen even if you used a forward slash as a delimiter. For example, a folder named “Finance/Correspondence” won’t become a sub-folder if no “Finance” folder exists.

Secure Sharing

Secure sharing is for companies only. If you are a personal user you can’t use this feature. This is one of the major downfalls of Bitwarden when compared to some of the market-leaders like Dashlane and LastPass, where secure sharing is available to all users.

Not being able to share passwords via Bitwarden may seem trivial since you can share them via text, email, and even in spreadsheets, but it is extremely important to be aware that all of these methods are unsecure. Sharing passwords without layering them in encryption opens you up to exploitation from hackers which can result in both financial and identity damage. Being able to plug all the holes in your security shield will make you far less susceptible to being targeted by hackers. Don’t just take my word for it though, secure sharing is one of the most asked for features by Bitwarden users.

For companies, it is a simple case of adding users to collections (groups of login credentials) to give them the right to either view or edit the login credentials. All data that is shared follows Bitwarden’s zero-knowledge and end-to-end encryption protocols to ensure that no unencrypted data ever leaves the user’s device when it is being shared.

Vault Health & Data Breach Reports

To maintain a stronghold on your cybersecurity, reviewing the strength of your current credentials is essential. Bitwarden’s auditing tools allow you to do just that. However, you can only take advantage of them if you are a premium account user.

The reports are broken down into the following:

• Exposed passwords – Identifies passwords that have been exposed in data breaches and need changing immediately.
• Reused passwords – Reusing passwords is a sure-fire way to compromise multiple accounts. To make it easy to remove this risk, the report highlights duplicate passwords so you can replace them.
• Weak passwords – Hackers use sophisticated scripts that can easily guess weak passwords to gain unauthorized access to your accounts. This report shows the passwords that need to be more complex. Using Bitwarden’s password generator is a simple and quick way to create new strong passwords. However, you need to do this on a password-by-password basis which can be quite frustrating, especially when you compare it to other password managers like LastPass that feature auto-change capabilities letting you change multiple passwords at once.
• Unsecured websites – This simply checks whether you have accounts with unsecure websites. Bitwarden defines unsecure as sites that use the http:// protocol instead of https://.
• Inactive 2FA – Locates items in your vault without a stored TOTP authenticator key. This allows you to enable two-factor authentication to improve the security of your accounts. In layman’s terms, every time you log in to an account with two-factor authentication set up you will need to authenticate the login on your mobile device. For example, if a hacker managed to get their hands on your username and password, they would also need your phone to authenticate themselves when logging into accounts that have 2FA set up. 2FA adds a layer of security to your online accounts.
• Data Breach Report – With hackers striking every 39 seconds, it is vitally important to know if any of your information has been compromised so you can quickly change your passwords. Without knowing, you can’t take the necessary steps to protect your data. To make it easy for you, Bitwarden scans your credentials against haveibeenpwned.com’s database to check if any of your credentials have been compromised in known data breaches. Top tip: you can also subscribe to haveibeenpwned.com to receive notifications of any data breaches as they are reported.

Two-step login (2FA) with YubiKey, U2F & Duo

Two-step login, otherwise known as two-factor authentication (2FA), is used to add an extra layer of security to the sensitive data stored in your vault.

When you access an application or website, you are required to verify your identity. You do this with something you “know” – your master password, and something you “have” – your mobile device.

For example, when logging in to Bitwarden you are asked to enter your master password. You then need to verify that it is you logging into your account by authenticating the login on your mobile. If a hacker guessed your master password, they would still need access to your mobile device to authenticate the login and gain access. Authentication is completed via the Google Authenticator app which you can download from the App Store or Google Play. The authenticator app sends you a unique 6-digit code to enter as verification.

You can also use email for two-step login. When logging in, a verification code is emailed to you. You need to enter the code when prompted by Bitwarden where it will be validated before granting access.

Although both methods of two-step login are arguably as easy as each other to set up, I strongly recommend using an authentication app over email. Email accounts are notorious for being targeted by hackers.

Alternatively, if you opt for a premium plan you can use Bitwarden to generate the authentication key (6-digit code) for you, meaning you don’t need to rely on an external authenticator app like Google Authenticator. Bitwarden changes the authentication keys every 30 seconds so that they can only be used to grant access within the specified time slot.

If you are extremely conscious about your security, you can take two-step login even further by using Fast Identity Online (FIDO) and Universal Second Factor (U2F). This may sound complicated but all it means is that to authenticate access, you can opt to use a physical security key to unlock your vault. You simply insert a FIDO U2F security key into your computer or hold it next to your phone. Then, press the U2F key button to gain access to your secure password vault. FIDO U2F security keys cost between $30-$50 dollars and they are well worth the investment to tighten the security protocol needed to decrypt your passwords. I understand that not everyone who has read the above may understand how these keys work so I’ve included a helpful video below to give more context.

Vault Timeout Options

Vault timeout options simply allow you to protect your vault when you are away from a device that is currently logged in. You have two options:

1. Vault lock – Requires you to re-enter your master password to regain access to your vault.
2. Vault logout – Requires you to re-authenticate yourself through two-step authentication to regain access to your vault.

The choice is up to you but I recommend opting for vault logout – it provides the highest level of security.

You can also choose when your vault will timeout, stretching from every 1 minute to 4 hours, as well as other options that aren’t time-based such as on browser restart, and even the choice to set it to ‘never’.

Restore Deleted Items From the Trash

Until recently, one of Bitwarden’s pitfalls was that anything you deleted from your vault, even if it was by accident, was gone forever. Thankfully, after the frustration of many users, Bitwarden now places deleted items in a trash folder for 30 days before they are permanently wiped from your vault.

You can restore any items that you want to keep.

A nice feature but late to the game.

Self-Host

Out of all the password managers I have reviewed, Bitwarden is the only one that lets you self-host.

Straight off the bat, I am going to recommend against self-hosting if you are an individual wanting a password manager for personal use.

Self-hosting your password manager isn’t worth it. First, you need to be technically capable. Second, you need to find a way to backup your data which will add to costs. Third, you should let the password manager do all the hard work for you so you can reap the benefits without lifting a finger. Feel free to skip this part of the review if that resonates with you. However, if you are looking for a password management solution for your organization, then you may want to read on.

The self-host feature was added to enable organizations who want to control their data or whose policies dictate that data must be stored on-premise, to host Bitwarden on their servers. This removes dependence on Bitwarden’s cloud-based servers. According to Bitwarden, it can be deployed on machines that run Windows, macOS, and Linux operating systems, and takes less than three minutes. However, be aware that organizations need to have an enterprise license to self-host.

Access Control & User Groups

While we are on the topic of organizational password management, it is also worth noting the capabilities of Bitwarden in a business environment.

The first and most notable capability is access control. This allows for the implementation of fine-grained control to determine who has access to what, as well as the level of access e.g. read-only, edit, etc. It can be used to define user types and demarcate collections (groups of login credentials).

Second, is user groups. Admins can use groups for the management of users across teams and departments. Each group can be broken down further into different user types including User, Manager, Admin, and Owner. Each level has varying access and permissions.

Both access control and user groups work in conjunction to create a framework where all users or user groups are given the appropriate access and permissions to business-critical credentials in their vaults.

Enterprise Policies, Directory Sync, and Event Logs

For enterprises who have large numbers of employees, Bitwarden offers some additional features to help keep sensitive password information secure:

• Enterprise Policies – Owners or administrators can set and enforce parameters for each user’s master password and the use of two-step login.
• Directory Sync – Keep Bitwarden and your user directory synced. Users from your configured user directory will be automatically provisioned or de-provisioned. Bitwarden supports syncing with the following directories: G Suite (Google), OneLogin, Okta, Azure Active Directory, and any LDAP-based directory.
• Event Logs – An audit trail of all the actions and changes which the users of the organization performed. This feature aids in the management of the Bitwarden application.