454
Bitwarden Switches to Commercial License (community.bitwarden.com)
submitted 3 weeks ago by to c/technology@lemmy.world
149 comments fedilink hide all child comments
 

cross-posted from: https://thelemmy.club/post/57178743

RyanL Bitwarden Employee

Hello everyone!

Starting in the next release, the Bitwarden apps published to the various stores will be the commercially licensed builds. No action is needed, and the apps will work exactly as they do today.

Bitwarden remains committed to open source security and transparency
The GPLv3 OSS licensed version continues to be updated and published on GitHub
All current features are available in both versions
License details are on GitHub
Bitwarden remains committed to a robust, free forever plan for everyone

If you have any questions, please ask them in this thread. Thanks all!

EDIT:

Bitwarden is not going closed-source
You can still fork Bitwarden
No change to self-hosting, the licensing change affects those who are repackaging and reselling Bitwarden
The free plan is here to stay permanently
you are viewing a single comment's thread
view the rest of the comments
[–] 18 points 3 weeks ago (7 children)

When Bitwarden got a meh "refresh" of the user interface and started vibe coding stuff (I'm not some super hard-line anti-AI person, but dammit, you absolutely should not vibe code security-critical apps), I switched to KeePassX. It was like coming back home! I used to use KeePass and KeePass 2, switched to Bitwarden for a long while, and while it was neat, KeePassX is just neater. (Doesn't have cloud sync, but syncing the vault files with LocalSend is easy enough.)

  • permalink
  • fedilink
  • source
  • hideshow 7 child comments
    •
  • [–] 22 points 3 weeks ago (6 children)

    I guess you mean KeepassXC, because the last release of KeepassX apparently was in 2016.

    KeepassXC is also using AI, they even made a blog post about it a year ago.

    https://keepassxc.org/blog/2025-11-09-about-keepassxcs-code-quality-control/

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 6 child comments
    •
  • [–] 6 points 3 weeks ago

    Yup, I was supposed to say KeepassXC. (...I mean I probably considered using KeepassX at some point, it's XC's predecessor after all. But as I recall Keepass 2 worked well enough on Mono, so I didn't need to switch.)

    Also, whoopsies on XC's AI use. At least they don't seem to embrace it as much as Bitwarden, but still makes me go hmm.

  • permalink
  • fedilink
  • source
  • parent
  • [–] 1 point 3 weeks ago (1 child)

    They never vibe code though:

    This process is fully transparent and open for anyone to see, and it does not change with AI. We take no shortcuts. At KeePassXC, we use AI for two main purposes:

    As an additional pair of “eyes” in code reviews.
    In this function, AI summarises the changes (the least helpful part) and points out implementation errors a human reviewer may have missed. AI reviews don’t replace maintainer code review, nor do they relieve maintainers from their due diligence. AI code reviews complement our existing CI pipelines that perform unit tests, memory checks, and static code analysis (CodeQL). As such, they are a net benefit and make KeePassXC strictly safer. Some examples of AI reviews in action: example 1, example 2.

    For creating pull requests that solve simple and focused issues, add boilerplate code and test cases.
    Unfortunately, some people got the impression that KeePassXC was now being vibe coded. This is wrong. We do not vibe code, and no unreviewed AI code makes it into the code base. Full stop. We have used Copilot agent to draft pull requests, which are then subsequently tweaked in follow-up commits, and reviewed by a maintainer, openly for anyone to see, with the same scrutiny as any other submission. Good pull requests are merged (example), bad pull requests are rejected (example).

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 1 point 3 weeks ago

    To be honest, I don't really know where AI assistance stops and vibe coding starts. It was not my intention to say the KeepassXC team now only produces some half-assed unreviewed garbage.

    I use KeepassXC myself, but OP has valid concerns about AI usage in security critical applications and I just wanted to point out that KeepassXC isn't AI-free either.

  • permalink
  • fedilink
  • source
  • parent