Bitwarden Release Notes

This release includes:

• Login with device for self-hosted: Bitwarden applications connected to self-hosted servers can now log in by sending an authentication request to a registered device instead of using a master password (see here).

• Forward Email alias integration: Connect the Bitwarden username generator to Forward Email for easy creation of email aliases (see here).

• Browser extension TOTP auto-fill: Browser extensions will now auto-fill TOTP codes automatically unless you're using auto-fill on page load (see here).

• Policies - Renamed Admin password reset: The Admin password reset policy is now named Account recovery administration (see here).

• Use auto-fill in <textarea>s: Bitwarden apps can now auto-fill credentials into HTML <textarea> elements.

• Create folders and collections from Vaults page: Folders and collections can now be created from the main Vaults page using the New button.

Secrets Manager beta

This release includes:

• Secrets Manager - Service account write access: Service accounts can now be granted write access to projects and secrets (see here).

  tip …

warning

Beginning with the 2023.5.0 release, Password Manager desktop apps will no longer support Windows 8.1 and older or Windows Server 2012 and older.

Users of these operating systems may download a 2023.4.0 desktop app here and must disable automatic updates (learn more here). We recommend upgrading to a supported operating system, as old client versions are not guaranteed to be supported by Bitwarden cloud servers long-term and may present security risks to you in the future.

This release includes:

• Environment selector: The workflow for connecting Bitwarden apps to self-hosted servers was improved. See here.

• Password Manager - Improved auto-fill for German HTML: German-language HTML fields are now available for auto-fill. See here.

• Self-hosting - Clarification to language around server licensing: There is a grace period of 60 days to upload a new license to replace an expired one. See here.

• Low KDF alert: A new alert will appear in the web app when a user's KDF iterations are lower than industry recommendations, currently 600,000 iterations. See here. …

This release includes:

• Splunk integration: Bitwarden organizations can now use self-hosted Splunk Enterprise for security information and event management (SIEM). Learn how to get started with Splunk here.

• Improved reseller billing: Bitwarden resellers will now be the only entities with access to see billing, subscription, or payment information for their customer organizations. See here.

• Master password requirements policy update: If enabled, the master password requirements policy can now be set to prompt pre-existing non-compliant users to update their master passwords. See here.

• Vault timeout policy update: The vault timeout policy now provides the option to designate vault timeout actions. See here.

• Desktop - New biometrics options: You can now choose whether to require a master password on app start or allow biometrics on launch. See here.

• Desktop - Windows Hello security improvements: A vulnerability related to Windows Hello and Windows Credential Manager has been addressed. As an additional measure, we recommend using the new option to require a master password on app start. See here. …

This release includes:

• Domain verification: Organizations can verify ownership of domains (e.g. mycompany.com), allowing users to skip the organization identifier step when using login with SSO. See here.

• Browser Extension - Improved auto-fill security: Browser extensions will now disallow auto-fill on page load for untrusted iframes. Browser extensions will also warn users about untrusted iframes when manually auto-filling, using the context menu, or using keyboard shortcuts, and will warn users when auto-filling HTTP sites that expect HTTPS based on that item's saved URI(s). See here.

• Master password security checks: Users can now check known data breaches for their prospective master password via Have I Been Pwned when creating an account or changing their master password on the web vault. See here.

• Master password length requirement: Master passwords must now be at least 12 characters long. This rule will be enforced for new Bitwarden accounts and for any users that change their master password.

• Activate auto-fill policy: For Enterprise organizations, the Activate auto-fill policy will automatically turn on auto-fill on page load for new and existing members of your organization. See here. …

This release includes:

note

Self-host Announcement

In this release, we've migrated to a new SQL client which expects either a valid certificate or the presence of TrustServerCertificate=True in the connection string set in global.override.env. Please check for one of these before updating your server.

• Argon2: You can now change the algorithm used to derive your account's master key to Argon2id from the Account settings → Security → Keys page. See here.

  note

  2023-02-14: Argon2 is supported by Bitwarden clients version 2023.2.0 and later, and switching to Argon2 via the web vault could mean other clients will not be able to load your vault until they’re updated, typically within a week after release.

• Increased default KDF iterations for PBKDF2: New Bitwarden accounts will use 600,000 KDF iterations for PBKDF2, as recommended by OWASP. Existing accounts can manually increase this number. See here. …

This release includes:

• Bitwarden on Apple Watch: Bitwarden has added Apple Watch support to provide an additional option for accessing TOTP login codes. See here.

• New environment variable: An environment variable to enforce the Require SSO authentication policy for owners and admins is now available for self-hosted servers. See here.

• Bitwarden unified - Support for custom database ports: Unified deployments now support running the database on a custom port using a new environment variable. See here.

• Passky importer (json): A new import option is available for unencrypted Passky (json) exports. See here.

• Custom avatar colors: Change the color of your avatar from the web vault Account settings → My account page.

This release includes:

• Browser Extension - Themed notification bars: Themed notification bars have been added to the Bitwarden browser extension to match the popular color themes.

• Browser Extension - UI update: UI updates have been made to the Bitwarden browser extensions.

• Bitwarden on Apple Watch (beta): Bitwarden on the Apple Watch will be available in beta to users who sign up through TestFlight and will provide an additional option for accessing TOTP login codes. Learn more here.

Bitwarden unified self-host deployment (beta)

Bitwarden is excited to announce the beta release for a new option available to self-host users. The Bitwarden unified deployment is light weight and flexible option for users who wish to control and deploy Bitwarden on their own server. For more information on the beta, see here.

note

This release does not include updates to the browser extension, which will remain at version 2022.10.1.

This release includes:

• Organization vault updates: As part of an ongoing effort to improve the web vault UI, some organization administration functions have been moved, for example into dedicated Billing and Reporting tabs.

• Login flow updates: To accommodate new log in options, the log in process has been separated into two screens.

• SCIM updates: SCIM-triggered events will now log from SCIM instead of Unknown, and the SCIM API key will now be obfuscated by default.

• Generate username & password from iOS app extension: "On-the-fly" generation of usernames and passwords can now be done from the iOS app extension, accessible from the Share menu while using apps like browsers.

• New theme for mobile: The popular Solarized Dark theme has been brought to mobile.

• Directory Connector - Group filter queries for Google Workspace: Query parameters can be used in group filters for Google Workspace (see here).

• Performance Optimization: We've improved web vault load times and experience for accounts with access to thousands of vault items.

This release includes:

• Password protected encrypted export: Encrypted .json exports can now be encrypted with a password of your choosing. Password protected exports can be imported to any Bitwarden account (see here).

• Mobile username generator: The username generator is now available for use on Bitwarden mobile apps (see here).

• DuckDuckGo email alias integration: Connect the Bitwarden username generator to DuckDuckGo for easy creation of email aliases (see here).

• DuckDuckGo macOS browser integration: We've partnered with DuckDuckGo to create an integration with their forthcoming macOS browser! Stay tuned for more information on when they'll launch this feature.

• SCIM update: Revoked users will no longer occupy licensed seats in your organization (see here).

This release includes:

• Fastmail email alias integration: Connect the Bitwarden username generator to Fastmail for easy creation of email aliases (see here).

• Provider Portal update: The main Provider Portal screen now has at-a-glance seat and plan reporting for each client organization.

• Organization vault export event: When an owner or admin performs a vault export, the action will now be recorded on the organization's event logs (see here).

• Browser Extension - Support for pre-configured environment URLs: Self-hosting customers can now pre-configure environment URLs for browser extensions, streamlining rollout for end users by using endpoint management to deploy your configuration (see here).

• Mobile - Update to Bitwarden Authenticator: Mobile apps now have a Verification Codes screen that provides quick and easy access to your TOTPs (see here). We've also improved the process for adding TOTP codes to vault items through the mobile app (see here).

• CLI - **serve** Origin protection: The serve command will now block any requests made with an Origin header by default (see here).

This release includes key features and usability improvements that make Bitwarden even better on-the-go:

• Account Switch during Auto-fill (iOS): Quickly switch to another account during auto-fill by tapping the avatar button, now available on Android and iOS (see here).

• Vault Filter for Mobile: On mobile apps, you can now filter items by vault.

• Org Member Premium Status: Organization members can now use premium features like advanced 2FA methods as soon as they're invited, rather than confirmed.

• Accessibility Improvements: This release includes a few changes that will improve the performance of Bitwarden with assistive technologies, including the ability for users with hCaptcha Accessibility Access to use their Accessibility Cookie to skip hCaptcha challenges (now available for desktop and mobile apps).

note

We've got new version numbering!

To make it easier to track versions of the many Bitwarden apps as we move to a near-monthly release cycle, we've adopted a new version numbering system that will be shared by all clients. This release is 2022.5.0 because it's the base release ( .0) of May ( .5.) 2022 ( 2022.).

This release includes:

• Web Vault UI Updates: The Web Vault has received design updates, some of which improve filtering between individual and Organization vault items. This is the first phase of a multi-part project to update the Web Vault for both individual users and Organizations.

• Families Sponsorships for Self-hosted Enterprise Orgs: Families Organization Sponsorships can now be issued for members of self-hosted Enterprise Organizations (see here).

• Username Generator - Forwarded Email Alias Type: Integrate the username generator with SimpleLogin, Addy.io, or Firefox Relay to automate simultaneous creation of usernames and corresponding email aliases (see here).

• Item Linking: Copy the URL of an item for use as a direct link to provide to Organization members or in documentation (see here). …