Bitwarden — Open Source Password Manager for Teams

What it is

Bitwarden is an open-source password manager that provides end-to-end encrypted credential storage synchronized across all devices. It offers clients for web, desktop, mobile, browser extensions, and CLI. Personal use is free. Teams and enterprise plans add shared vaults, RBAC, and SSO integration.

This tool is for anyone who manages passwords, but especially developers and teams who need secure credential sharing, CLI access for automation, and self-hosting options.

How it saves time or tokens

Bitwarden eliminates password reuse and insecure credential sharing. The CLI client integrates with scripts and CI pipelines to inject secrets without hardcoding them. Browser extensions auto-fill credentials, saving time on repeated logins. For AI-assisted workflows, the CLI can programmatically retrieve credentials that agents need for API authentication.

How to use

1. Create a Bitwarden account or deploy a self-hosted instance.
2. Install clients on your devices.
3. Import existing passwords or add them manually.
4. Use the browser extension for auto-fill and the CLI for automation.

# Install Bitwarden CLI
npm install -g @bitwarden/cli

# Login
bw login

# Unlock vault
export BW_SESSION=$(bw unlock --raw)

# Get a password by name
bw get password 'My API Key'

# List items in a folder
bw list items --folderid <folder-id>

# Use in scripts
API_KEY=$(bw get password 'production-api-key')
curl -H "Authorization: Bearer $API_KEY" https://api.example.com

Example

Using Bitwarden CLI in a CI pipeline:

# GitHub Actions example
steps:
  - name: Install Bitwarden CLI
    run: npm install -g @bitwarden/cli

  - name: Unlock vault
    run: |
      bw login --apikey
      export BW_SESSION=$(bw unlock --raw --passwordenv BW_PASSWORD)
      echo "BW_SESSION=$BW_SESSION" >> $GITHUB_ENV
    env:
      BW_CLIENTID: ${{ secrets.BW_CLIENTID }}
      BW_CLIENTSECRET: ${{ secrets.BW_CLIENTSECRET }}
      BW_PASSWORD: ${{ secrets.BW_PASSWORD }}

  - name: Deploy with secrets
    run: |
      DB_PASS=$(bw get password 'prod-db-password')
      deploy --db-password "$DB_PASS"

Related on TokRepo

• Security tools — More security and credential management tools
• Self-hosted solutions — Tools you can host yourself

Common pitfalls

• The master password cannot be recovered if lost. Bitwarden uses zero-knowledge encryption, so even Bitwarden cannot reset your password.
• Self-hosting requires maintaining the server, database, and SSL certificates. Use the cloud version unless you have specific compliance requirements.
• The CLI session token expires. Scripts that run for long periods need to handle re-authentication.
• Browser extension conflicts with other password managers. Disable competing managers to avoid auto-fill confusion.
• Free personal accounts support unlimited passwords but limit sharing. Team features require a paid plan.