An open-source badge on your password manager guarantees your company nothing

On 9 October 2026 Bitwarden told its users that, from the next release, the apps in the stores would be commercially licensed builds. So would downloads from its own site. The GPLv3 version carries on, updated on GitHub, for anyone who wants to build it themselves. Bitwarden says nothing changes for users. I read it differently. If you buy Bitwarden for a company, the software your staff actually install now runs under a licence Bitwarden wrote and can rewrite. The open-source build becomes a parallel artefact that almost nobody in your organisation will ever touch.

I expected the usual reassurance, and the announcement delivered it: not going closed-source, still forkable, self-hosting unchanged, free plan permanent. What surprised me was how quickly the staffer running the thread gave away the important part once users pushed. Asked what would differ between the two builds, he wrote that "some future components will be published under the commercial license" and would live only in that build, with each new feature assigned a licence case by case. One user pointed out that the word current, in the promise that all current features are in both versions, was carrying a lot of weight. He was right.

This is the second attempt. In October 2024 the desktop client picked up a dependency, sdk-internal, whose licence barred using it to build apps for software other than Bitwarden. Someone filed a GitHub bug saying version 2024.10.0 was no longer free software. Kyle Spearrin, the founder and CTO, called it a packaging bug, and by 4 November 2024 the SDK had been moved to GPLv3. He also said that if Bitwarden License code came into the client later, the company would offer a way to produce multiple build variants. Two years on, that is exactly what has arrived. I give Spearrin credit for saying it out loud at the time. My reading is that the 2024 climbdown only postponed the change.

Follow the money. Bitwarden says the change is aimed at people repackaging and reselling its software, and I believe that is part of it. But a vendor that decides, feature by feature, which licence new code ships under also decides what paying customers get when they upgrade. I think the commercial-only components will cluster around the things companies pay for, because that is where the leverage sits. Nobody needs to lock up a feature that free users want and enterprises ignore.

We have watched this film twice. HashiCorp shipped Terraform under MPL 2.0 from 2014 until August 2023, then moved it to the Business Source License, which the Open Source Initiative does not recognise as open source. More than 100 companies, AWS, Google Cloud and Cloudflare among them, signed the OpenTF Manifesto, and the OpenTofu fork was a Linux Foundation project within weeks. IBM still paid $6.4 billion for HashiCorp in December 2024. Redis Ltd. swapped BSD-3-Clause for RSALv2 and SSPLv1 from version 7.4 in March 2024; within a week the Linux Foundation announced Valkey, backed by AWS, Google Cloud, Oracle, Ericsson and Snap. In May 2025 Redis went back to an open licence, AGPL, with version 8.0.

The obvious reply is that this proves the licence already protects buyers. Old code stays forkable, forks appear fast, and Redis even reversed course. I don't buy it for password managers. Valkey and OpenTofu happened quickly because some of the richest companies on earth had products riding on that code and paid engineers to keep it alive. I see no equivalent sponsor lining up to maintain a fork of a password vault. And even a healthy fork freezes at the last open release, without whatever Bitwarden has since put behind the commercial licence. Your security team would then be trusting credentials for every employee to a codebase maintained by people it has never vetted. A fork gives you source code, but no refund on prepaid seats and no support contract.

That gap belongs in the contract. Define the open build as the GPLv3 release. If any feature in the tier you pay for moves to commercial-only, or the vendor changes the licence on the client you deploy, you get the right to terminate without penalty, a pro-rata refund on prepaid seats, and vendor-assisted export of every vault in a documented format. Ask for the same terms from 1Password, Keeper and anyone else on your shortlist, because none of them is exempt from the same temptation.

Before the next Bitwarden release reaches your staff's phones, email your account manager and ask for a written list of which features in your plan are covered by the GPLv3 build. Attach that list to your order form as a schedule, and make any change to it a termination event at renewal.

Prompted by Published version update in app stores - Announcements / Notices - Bitwarden Community Forums, community.bitwarden.com.