Bitwarden

An auto-updating self-hosted instance crashed during the database upgrade script and kept restarting and retrying, leaving the vault inaccessible.

Affects: Self-hoster on Synology

After updating a long-running self-hosted instance, the generated compose file became invalid and the stack would not start; root cause appears to be an old docker-compose version despite docs saying it should work.

Affects: Self-hoster

Out-of-the-box settings required re-entering a complex master password over and over, and finding a reasonable balance meant decoding misleadingly labeled options such as unlock with PIN.

Affects: New user across browser, desktop and phone

Passkeys registered in Bitwarden cannot be moved to another provider, which the commenter calls an annoying limitation, though adding a second passkey on the site works around it.

Affects: Passkey user

The Chrome extension often picks the wrong sign-in URL, sending the user through a registration auth redirect. This is the user's main complaint despite otherwise being happy.

Affects: Chrome extension user migrated from LastPass

Affects: Self-hoster who imported from LastPass

Affects: Screen reader user on iOS

Affects: User with browser and desktop clients

Affects: Household sharing credentials with spouse, LastPass migrant

Affects: Self-hosting user

Affects: iOS user

Affects: Self-hoster behind Traefik

Affects: Android user

Affects: User migrating from LastPass

Affects: Self-hoster

Affects: Self-hosting Linux desktop user

Affects: Self-hoster

Affects: Self-hoster with Postfix

Affects: Experienced Docker admin

Affects: Passkey user with a third-party manager

Affects: Firefox user

Affects: Firefox extension user

Affects: LastPass migrant

Affects: User moving between password managers

Affects: Self-hoster

During a server outage the clients stayed locked and did not revert to offline read-only access as documented. A commenter agrees the experience should be improved so clients fall back to offline mode.

Affects: User who lost vault access during an outage

An admin asks how to disable new account registrations on a self-hosted Bitwarden server.

Affects: Self-hosting admin

Failed logins currently return HTTP 400, making it hard to write a Fail2Ban filter; the requester asks for 401 as the API docs suggest.

Affects: Self-hosting admin

The requester says the server's maximum KDF iteration count is too low to protect against hardware dictionary attacks.

Affects: Security-minded users

A company using YubiKeys and TOTP wants to require 2FA for every organization member and be alerted about users without it, but enforcement apparently only works with Duo.

Affects: Enterprise admin using Yubikeys and TOTP

Affects: Experienced Docker admin

Affects: Single-user self-hoster on small hardware

Affects: Individual users

Affects: Self-hosters

A self-hosted Families license repeatedly expires early, cutting all users off from the organization until the license file is downloaded again and uploaded.

Affects: Self-hosted Families organization

After upgrading to 2026.6.1 the MSSQL container enters a restart loop, and downgrading to 2026.6.0 resolves it with no data changes.

Affects: Docker self-hoster

After a new beta release the unified deployment began aborting connections to MariaDB and the admin process crashed repeatedly; reverting to the earlier beta image fixed it.

Affects: Unified beta self-hoster

On Firefox for Android, Bitwarden autofill is not recognized after logging in until the browser app is killed and restarted.

Affects: Firefox for Android user

On Synology the installer still wrote ports 80 and 443 in docker-compose despite proxy answers, and missing folders made the stack fail to start until fixed by hand.

Affects: Self-hoster on Synology

Recent iOS app changes log the user out about once a week and repeatedly require the master password with no way to reduce the friction. They are considering the native iOS password app.

Affects: iOS and Linux user

The user dislikes the email-based verification on new devices, especially for people using VPNs, and says it may make them leave. They bought a subscription and refunded it within an hour.

Affects: Individual user, VPN user

Users who contributed because the project was open source see the licensing change as a breach of trust, which threatens forks and departures from a product whose value rests on trust in the code.

Affects: Open-source supporters and contributors

A long-time KeePassXC user moved to Bitwarden for sharing, but found the folder-only organization without tags unmanageable for a big collection, and is moving back.

Affects: Household sharing passwords with partner

A user lost access to their vault twice because the master password stopped being accepted, even though a copy kept elsewhere was correct. They are now evaluating other password managers.

Affects: Family user managing around 500 logins

Affects: Desktop browser user

Affects: Firefox extension and mobile user

Affects: Firefox user with multiple Google accounts