# Bitwarden dual license: store apps go commercial, GPLv3 builds stay on GitHub

> Bitwarden's store and download-page apps become commercially licensed builds, GPLv3 stays on GitHub, and future features may be commercial-only. Here is what that means for self-hosters and teams using Bitwarden in automation.

- Published: 2026-10-11
- By: Samir Sengupta (https://www.samcodeman.com/about)
- Canonical: https://www.samcodeman.com/writing/bitwarden-dual-license-store-apps-commercial-gplv3
- How this was made: Drafted with Claude, Anthropic's model from 1 cited source, then checked against it in a second editing pass; read and approved by Samir Sengupta on 2026-10-12. Editorial policy: https://www.samcodeman.com/editorial-policy

## The short version

- From the next release, Bitwarden apps in the app stores and direct downloads from its download page are commercially licensed builds. A GPLv3 version keeps shipping on GitHub.
- Bitwarden staff say self-hosting, forking and third-party community servers, the category Vaultwarden falls into, are unaffected. They say the change targets those repackaging and reselling Bitwarden.
- All current features exist in both builds, but some future components will be published only under the commercial license, decided case by case.
- The announcement and thread say nothing about the Bitwarden SDK, CLI or Secrets Manager. Teams using them in CI or agent tooling need to read the license files on GitHub rather than rely on the forum summary.

Under the Bitwarden dual license announced on October 9, 2026, the apps published to the app stores and the direct downloads on Bitwarden's download page become commercially licensed builds from the next release. A GPLv3 version continues to be updated and published on GitHub. Bitwarden staff say self-hosting, forking and third-party community servers such as Vaultwarden are unaffected, and that the only people who need to care about the commercial license are those who repackage and resell Bitwarden. Some future components will exist only in the commercial build. Nothing in the announcement addresses the SDK or CLI used in CI pipelines and agent tooling.

The announcement came as a notice on the Bitwarden Community Forums, followed by a thread of clarifications from staff and pushback from users. The change matters to three groups of engineers: people running a Bitwarden or Vaultwarden server, people who build or distribute the clients, and teams that wire Bitwarden into CI pipelines and agent tooling. The sources answer the first group's questions reasonably well and the third group's barely at all.

## What the Bitwarden dual license changes

There are now two licenses over one public codebase. The GPLv3 build is the open source version and stays on GitHub. The commercially licensed build is what end users receive from the app stores. Asked whether the Portable Desktop App link on the download page would be commercial or GPLv3, staff replied that the download page will also direct link to the commercial license. Staff wrote that no action is needed and the apps will work exactly as they do today.

- Store apps: commercial license, starting with the next release.
- Direct downloads from the Bitwarden download page: commercial license.
- GitHub: the GPLv3 version continues to be updated and published.
- Features: all current features are available in both versions.
- Source visibility: staff say code under the commercial license is just as viewable and transparent on GitHub. They say the model provides additional legal protection for select features.
- Commitments: the announcement says Bitwarden will always have a free and open source version and that the free plan is here to stay permanently.

The license text itself is not in the announcement. The notice says license details are on GitHub. Anything more specific about obligations has to come from those files, not from forum posts.

## Self-hosting and Vaultwarden: no change, per staff

The most repeated staff answer in the thread is that self-hosting does not change. A forum user who runs self-hosted Vaultwarden instances asked whether third-party teams like Vaultwarden could keep using the protocol. A staff member replied that third-party community servers see no change and can continue to choose which features to support and build out on their server. Vaultwarden operators keep the same position they had before: an independent server implementation that decides which client features to implement.

> No change to self-hosting, the licensing change affects those who are reselling Bitwarden
>
> - Bitwarden staff edit to the announcement, Bitwarden Community Forums

One commenter on Hacker News who ran Vaultwarden for a team of about 15 argued that the clients, not the server, are the leverage. If the mobile apps stop being buildable from source, the self-host story gets thinner. The sources partly answer this: the GPLv3 clients remain on GitHub, and another commenter already runs the F-Droid build from GitHub on a GrapheneOS phone. Two forum questions were asked and left open in the thread. One is which build the Linux Flatpak store will receive. The other is whether a commercial browser addon stays compatible with an open source client for features like biometric unlock.

## Future features may ship only under the commercial license

The statement that all current features are available in both versions is scoped to current features. When a forum user asked what would differ between the two builds, staff answered directly.

> Some future components will be published under the commercial license and will exist only in that build.
>
> - RyanL, Bitwarden Community Forums

Staff added that newly developed features will be evaluated case by case for which license applies. For self-hosters, that means the GPLv3 build could fall behind over time. A self-hosted server only helps if the clients pointed at it support the features you need. Another forum user asked whether any new features are coming to the OSS version, and the visible thread gives no answer beyond the case-by-case statement.

A forum user also asked whether the split creates up to four tiers, with GPLv3 and commercial crossed with free and Premium, and how they would be priced. That question was raised twice and had no answer in the visible thread. Another user asked whether commercial-only features would be available to self-hosted users, and staff replied that there is no change to self-hosting. The same user's follow-up, about whether all future features will reach self-hosters, has no staff reply in the visible thread.

## Who needs a Bitwarden commercial license

According to staff, the change only affects those who are repackaging and reselling Bitwarden. Staff describe store-app users as unaffected, since no action is needed. They say there is no change to the ability to self-host with a Bitwarden subscription, and the announcement states that you can still fork Bitwarden. That is the full extent of what the sources say about who needs a commercial license.

Many engineering teams embed the Bitwarden SDK or CLI to fetch secrets in CI pipelines or to give agent tooling scoped credentials, and the sources do not cover that case. Neither the announcement nor the thread mentions the SDK, the CLI, Secrets Manager or automation use. The forum posts cannot settle whether a pipeline that bundles a Bitwarden component inside an internal or customer-facing product counts as repackaging. Teams in that position should pin the versions they use today and read the license files in the relevant GitHub repositories for each component. They should also treat a component moving to the commercial license as a dependency change that needs review.

## Is Bitwarden going closed source?

One commenter on Hacker News said Bitwarden is making its app closed source with closed source features. The announcement, as edited, says the opposite. It says the App Store clients are built directly from 100% publicly auditable code on GitHub and that nothing has been made closed source. It also says users can still read, audit and contribute to the codebase, and still fork Bitwarden.

A forum user asked whether the new commercial-only features would still be open source. Staff answered yes, saying development continues under GPLv3 and that code under the commercial license is just as viewable and transparent on GitHub. The sources do not quote the commercial license terms. Whether that license permits modification and redistribution of the commercial-only code is therefore not stated in them.

That uncertainty is what worried the critics. One forum user pointed to Coinkite's ColdCard, which was published as open software but without a FOSS license. The user argued that this removed the community's motivation to fork, audit and review the code, and said a bug that festered as a result cost users a few million dollars. Hacker News commenters compared the move to Elasticsearch, Terraform and Redis. One forum user cited MinIO as a prior migration they did not want to repeat.

Not every reaction was negative. One Hacker News commenter found the move understandable as protection against larger companies taking the codebase and outcompeting on distribution. That commenter said they would keep their subscription as long as all source continues to be available and personal self-hosting remains viable.

## Exit paths: GitHub builds, CXP export, alternative clients

For anyone whose risk model requires an exit, the sources point to three options. First, the GPLv3 builds continue on GitHub. Second, a forum user said they see no sign yet that vault export is getting removed, and noted that the Credential Exchange Protocol and Format (CXP/CXF) was recently added to the mobile apps. Third, third-party clients exist: a Hacker News commenter pointed to Keyguard, an alternative Bitwarden client on the Play Store, then corrected themselves that it is source available but fully copyrighted.

Self-hosters and teams with Bitwarden in automation are in the same practical position. Per the announcement, the apps will work exactly as they do today on the next release, but the license of each new component is now a variable. Track which builds you install and confirm the license of any component you redistribute. Watch whether future features land in the GPLv3 tree or only in the commercial one.

## Questions this raises

### Does the Bitwarden dual license affect self-hosting or Vaultwarden?

Bitwarden staff say self-hosting does not change and that third-party community servers such as Vaultwarden see no change. Vaultwarden can continue to choose which client features to support on its server.

### Who needs a Bitwarden commercial license?

According to staff, only people who repackage and resell Bitwarden are affected. Store-app users need to take no action, and forking remains allowed. The sources do not say whether bundling the SDK or CLI in a pipeline or product counts as repackaging.

### Is Bitwarden going closed source?

The announcement says nothing has been made closed source and that store clients are built from publicly auditable code on GitHub. Staff say commercially licensed code is just as viewable on GitHub. The commercial license terms on modification and redistribution are not quoted in the sources.

## Key facts

- Bitwarden announced the dual license on October 9, 2026, on its Community Forums.
- App store and download-page builds become commercially licensed starting with the next release.
- A GPLv3 version continues to be updated and published on GitHub.
- All current features are in both builds, but some future components will exist only under the commercial license.
- The announcement does not mention the SDK, CLI, Secrets Manager or automation use.

## Sources

1. [Bitwarden Dual License Model](https://community.bitwarden.com/t/published-version-update-in-app-stores/102750) - community.bitwarden.com

Discussion read (practitioners' reactions, not a source): https://news.ycombinator.com/item?id=50033407