Bitwarden Dual License Model

Original Article ↗ Hacker News Discussion ↗

Bitwarden’s move to a dual licensing model, where future features may be released under a commercial, closed license while core code remains open, has raised concerns about a gradual shift away from its open-source roots. Commenters debate whether this is a necessary response to funding and “cloud scavenging” by big providers, or the start of classic “enshittification” driven by private equity and price hikes. Many are weighing alternatives such as Vaultwarden, KeePass-based tools, Proton Pass, or Apple’s built-in manager, and questioning how sustainable truly open, user-trusting password managers are under current business pressures.

Scope of the Change & Motivation

  • Bitwarden is moving to a dual-licensing / open-core-like model: existing open-source code remains, but some future components/features will be under a commercial, source-available license only.
  • Official explanation is vague; several commenters say the rationale (“why now, what exactly changes”) is poorly communicated.
  • Some argue the move is to protect against large cloud providers “leeching” on OSS (Elasticsearch, Redis pattern). Others see it simply as “they want more money” and private equity/VC returns.

Trust, “Enshittification,” and VC Concerns

  • Many see this as the start of “boil the frog” enshittification: today dual license, tomorrow enterprise-only features, later abandonment of the OSS path.
  • The link to new management with private equity background increases anxiety about long‑term direction and pricing.
  • Some paying subscribers are fine for now, willing to stay unless there is a clear user-hostile move; others canceled immediately, citing broken trust.

Self‑Hosting, Vaultwarden, and Clients

  • Vaultwarden (Rust, self-hosted, Bitwarden-compatible) is widely discussed as an alternative backend; praised for low resource use and bundled “premium” features.
  • Key risk: leverage is in the official clients (browser/mobile). If they stop being OSS/buildable or break protocol compatibility, self-hosting becomes fragile.
  • Some expect an eventual ecosystem fork (server + clients) if incompatibilities grow; AI-assisted reimplementation is mentioned but flagged as legally and practically dubious.

Alternatives & Migration Ideas

  • Common suggestions: KeePassXC + mobile clients (KeePassDX, KeePassium) with SyncThing/WebDAV/OneDrive; Proton Pass; 1Password; Enpass; Apple Passwords/Keychain; pass/gopass; AliasVault; various paper/offline workflows.
  • Tradeoffs discussed: usability, self-hosting burden, lack of SSO, closed source, platform lock-in, missing features like YubiKey support or passkey migration.

Security & Hosting Debate

  • Intense debate over hosted vs self-hosted vs fully offline password management:
    • Some view any hosted manager as equivalent to publishing passwords; others strongly dispute this as infosec-ignorant.
    • Self-hosting is seen by some as essential sovereignty, by others as unnecessary risk/maintenance compared to trusting a specialized security team.
    • Design differences (single master password vs extra secrets/keys, 2FA/YubiKey’s role, threat models around breaches and government access) are debated.

OSS Licensing, CLAs, and Sustainability

  • Bitwarden’s contributor license (assigning copyright to the company) is highlighted as what enables relicensing.
  • Broader point: many note that large OSS projects require serious, ongoing funding; donations rarely cover true costs, hence VC or corporate backing and eventual license tightening.