Bitwarden Dual License Model
AIThis post was created with the assistance of artificial intelligence (AI).

TL;DR

Buying for a business?Offer from Amazon

Get business pricing on networking and server gear

  • Business-only prices and quantity discounts
  • Tax-exempt purchasing
  • Multiple users, one account, clear invoices
As an affiliate, we earn on qualifying purchases.

Bitwarden says apps distributed through app stores and its download page will move to commercially licensed builds starting with the next release. The company says its GPLv3-licensed code will continue to be published on GitHub, current features will remain in both versions, and self-hosting will not change; it has not yet specified how future features will be divided between licenses.

Bitwarden will distribute its apps through app stores and its download page under a commercial license starting with the next release, the password manager said in a post on its community forum on October 9. The company says it will continue publishing a GPLv3-licensed version on GitHub, and that no user action is required for the apps to keep working.

Bitwarden said all current features will be available in both the commercial and GPLv3 versions. It also said the apps it releases are built from code in its GitHub repositories, which users can continue to read, audit, and contribute to. The company described the change as a licensing adjustment, not a move to close the codebase, and said users can still fork the project.

The company clarified in the forum discussion that direct downloads from its website, as well as app-store releases, will point to the commercial build. It said the licensing change affects people who repackage and resell Bitwarden, and that self-hosting is unchanged. Bitwarden also said its free plan will remain available permanently.

Some details are not settled publicly. Responding to questions, Bitwarden representative RyanL said future components may be available only in the commercial build, and newly developed features will be assigned a license on a case-by-case basis. The company characterized the commercial model as providing additional legal protection for selected features; it did not publish a list of which future features would use each license.

At a glance
announcementWhen: Announced October 9, 2026; the change b…
The developmentBitwarden announced that its next releases distributed through app stores and its download page will use commercial builds, alongside continued GPLv3 development on GitHub.

What the License Change Means

The announcement changes the license attached to the builds most users will obtain from app stores and Bitwarden’s download page, while preserving a GPLv3 codebase on GitHub. That distinction matters to users who want to inspect, modify, or redistribute the software, and to developers and organizations that package Bitwarden for other users.

For people who simply use Bitwarden’s apps, the company says there is no immediate action or feature change. For the open-source community, the longer-term effect will depend on which features Bitwarden keeps under GPLv3 and which it places under the commercial license. The case-by-case approach means the two builds may diverge as new components are developed, although the company says current features remain available in both.

Community members raised concerns about whether a dual-license approach could gradually reduce the scope of the open-source version. Those concerns are reactions in the forum, not evidence that Bitwarden plans to discontinue GPLv3 development. The company has stated that development of GPLv3 code will continue, but has not specified a minimum set of future features that will remain in that version.

Amazon

Bitwarden password manager

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

How Bitwarden Describes the Model

In its October 9 forum announcement, Bitwarden said the next release of store-distributed apps would be commercially licensed and that its GPLv3 open-source version would continue to be updated and published on GitHub. A follow-up edit stressed that the code would remain visible and available for community contributions, and that users could still fork it.

Forum participants asked which license would apply to direct downloads and whether the versions would differ. RyanL confirmed that the download page would also direct users to the commercially licensed build. In response to a separate question about new functionality, the representative said licensing would be decided feature by feature. The company did not provide a full comparison of the two builds or a schedule for when any commercial-only components might appear.

“No action is needed, and the apps will work exactly as they do today.”

— Bitwarden, in its community forum announcement

Amazon

open source password manager

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Open Questions on Future Features

Bitwarden has not identified which future features or components will be limited to the commercial build, or when any such components will arrive. It has also not published a detailed comparison of the two versions beyond saying that all current features are included in both.

Forum participants asked about specific distribution channels, including the Linux Flatpak, and about compatibility between commercial and open-source clients or third-party services. The supplied announcement and replies do not answer those questions in detail. Bitwarden’s statement that self-hosting is unchanged addresses its own licensing change, but does not spell out how every third-party implementation or repackaging arrangement will be affected.

The company says GPLv3 development will continue and that users can fork the code. The forum material does not provide a binding commitment about the scope or pace of future GPLv3 releases. Whether the two builds remain functionally close over time is therefore not yet clear.

Amazon

self-hosted password manager

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Next Release and License Details

The change is due to begin with Bitwarden’s next release distributed through app stores and its download page. Users can check the release materials and GitHub repositories to see which build is offered through each channel and what code is available under GPLv3.

Bitwarden invited users to post further questions in the forum thread. The next useful clarification from the company would be a version-by-version explanation of distribution channels, compatibility, and how it will identify components or features that are commercial-only. Until it provides those details, the practical impact on users remains limited by the company’s assurance that current functionality and self-hosting are unchanged.

Amazon

password manager with GPLv3

As an affiliate, we earn on qualifying purchases.

As an affiliate, we earn on qualifying purchases.

Key Questions

What is Bitwarden changing?

Starting with the next release, Bitwarden says apps distributed through app stores and its download page will be commercially licensed rather than distributed as GPLv3 builds.

Is Bitwarden becoming closed-source?

Bitwarden says no. It says its GPLv3-licensed code will continue to be published on GitHub, where users can read, audit, contribute to, and fork the codebase. Some future components may, however, be available only under the commercial license.

Will current users lose features or need to take action?

Bitwarden says no action is needed and that all current features are available in both versions. It has not detailed how future features will be divided between the builds.

Does the change affect self-hosting?

Bitwarden says the licensing change does not change self-hosting. The announcement does not provide detailed answers about every third-party implementation or distribution arrangement.

Which new features will be commercial-only?

That has not been specified. Bitwarden representative RyanL said future components may be commercial-only and that newly developed features will be evaluated case by case.

Source: hn

COLUMBUS DAY / I

Columbus Day / Indigenous Peoples' Day Picks

As an affiliate, we earn on qualifying purchases.

You May Also Like

Cursor 0day: When Full Disclosure Becomes the Only Protection Left

A newly discovered Cursor 0day vulnerability highlights the risks of full disclosure, raising questions about cybersecurity transparency and protection strategies.

Google.com/goto: Google’s Anti-scraping Update

Google has introduced new anti-scraping updates on google.com/goto, impacting automated data extraction. Details are emerging, and the full scope remains unclear.

How Network Taps Help Teams Understand Traffic Without Guessing

Guiding teams with real-time, unencrypted traffic insights, network taps reveal patterns and anomalies—discover how they can transform your security approach.