Bitwarden continuously delivers security across the flagship Password Manager and suite of security tools. In 2026, Bitwarden accelerated development with new R&D investments, delivering more features and product updates than ever before.
Highlights from this year include:
Bitwarden Privileged Controls, which gates privileged credential access and enforces lease durations and automated password rotation. Now in private preview.
New enterprise policies for organization ownership, user onboarding, and autofill.
Access Intelligence reporting that tracks credential risk and remediation over time.
Passwordless options, including passkey vault unlock and passkey login to Windows 11.
A redesigned Password Manager interface, now available in beta.
The roundup below covers features released so far in 2026.
Redesigned Password Manager interface (available in beta) (September): An opt-in beta for the Chrome extension and Windows and macOS desktop apps introduces clearer navigation, unified search, persistent filters, and updated folder terminology. Available to users with cloud-hosted accounts. Existing vault data, sharing permissions, and security model remain unchanged. General rollout to cloud customers is planned for November, with self-hosted support to follow.
Quick-copy actions in the web and desktop apps (September): Users can enable shortcut buttons to copy credentials, credit card numbers, and saved identity fields directly from the vault list.
New action bar (September): Makes it easier to manage multiple items at once in the Bitwarden web and desktop apps.
Save and fill through inline autofill (August): Users can save previously unstored login credentials through a new prompt in the inline autofill menu. The browser extension opens with entered information prefilled, allowing users to review the item, save it to their vaults, and autofill the login.
Vault item archiving (March): Users on paid plans can archive items in the web, desktop, mobile apps, and browser extension. Archived items remain accessible but are excluded from regular search results and autofill suggestions. Archiving a shared item affects only the user who archives it.
Image attachment previews on Android (April): Users can preview image attachments directly in the Android app without downloading the file to their device. Image previews on iOS are planned for a future release.
Expanded import options (August): Users can import credentials directly from Keeper without creating an export file. Bitwarden also supports importing encrypted KeePass KDBX files protected by a password or key file. These additions build on existing import options from other password managers and browsers, including LastPass, Chrome, and Edge.
Credential Exchange Protocol on iOS and Android (July): Users on Android 10 and later can import and export credentials directly between Bitwarden and other apps that support the FIDO Alliance Credential Exchange Protocol. This extends support that was already available on iOS 26.
Email verification for Bitwarden Send (March): Users on paid plans can restrict access to shared text or files to specified email addresses. Recipients must enter a verification code sent to an approved email address before accessing the content.
Automatic update to user account encryption strength (March): Older user accounts that are not already at the recommended 600,000 KDF iterations for the PBKDF2 algorithm will have this setting updated automatically on their next login or unlock that utilizes their master password. Users already logged in, or logged in by other means, will be shown a notice if their account is deficient and asked to enter their master password to start the process, which will complete seamlessly.
Passkey vault unlock (February): Users can unlock a locked vault without entering their master password, using a compatible passkey configured for vault encryption. Available in the web app and supported Chromium-based browser extensions.
Vault item sharing through a link (October): Users with access to premium features can share vault items through a secure link, alongside expanded Manage Send policies governing vault item sharing.
Vault health reports in browser extension (October): Users can run vault health reports from the browser extension to identify exposed, weak, and reused passwords. Premium and Families users can see which specific logins are at risk. Free users can see how many passwords are flagged. (Note: Personal accounts only at this time.)
SSH Key autofill (September): The browser extension can autofill SSH key items stored in the vault, using the same methods as logins, cards, and identities.
Fill Assist (July): Available as an opt-in setting to improve autofill for websites that require special autofill rules. Bitwarden can publish tailored rules in response to user reports without waiting for a new app version.
Prompt to be default password manager (July): When the browser extension is installed, it prompts users to make Bitwarden the browser’s default password manager. This keeps the browser’s built-in password manager from competing with Bitwarden autofill.
Unless otherwise noted, the features in the General and Personal feature updates also apply to business plans
Policies enforced on acceptance (June): All configured organization policies apply to a member’s account as soon as the member accepts an organization invitation. This helps administrators keep new members compliant from the start.
Vault banner policy (July): Enterprise administrators can display custom banners at the top of members’ vaults for service announcements, company reminders, and other messages. Banners extended to iOS and Android vaults in September.
Enterprise Fill Assist policy and custom rulesets (September): Enterprise administrators can set Fill Assist on by default for members who have not selected a preference and replace the default Bitwarden ruleset with custom autofill rules maintained by their organization. Members retain control over their individual Fill Assist setting.
Centralize organization ownership (April): This new enterprise policy gives users a space in the organization vault for unshared items and disables the separate individual vault. This brings control over items when a user leaves the organization and full reporting through Access Intelligence. This is a unique differentiator in the business space among password managers.
Reset users’ 2FA with account recovery (May): Administrators can use account recovery to reset a member’s two-step login methods. This helps members regain access after losing their second factor. Account recovery also now supports revoked members.
Manage Send policies (August): A single Manage Send policy gives organizations control over all Send functions from the Admin Console. It replaces the previous set of separate Send policies. Its access controls are also enforced on iOS as of September.
AWS and Azure Marketplace Deployment (May): Organizations can deploy a self-hosted Bitwarden server directly into an existing AWS or Azure account. The preconfigured virtual machine image includes Docker, Docker Compose, and the Bitwarden installation script. The images cost nothing beyond standard cloud infrastructure costs, and they join the existing DigitalOcean deployment option.
Staged provisioning through SCIM and Directory Connector (September): Administrators can provision users into a staged state and assign roles, permissions, and collections before sending invitations. Staged users do not occupy subscription seats or receive automatic invitation emails.
New invitation links (September): Allow Enterprise administrators to create a durable link that acts as an evergreen invitation.
Automatic confirmation of new users (June): A new option and enterprise policy allows for automatic confirmation of users to an organization, completing the final step of a secure key exchange required for onboarding.
Public API endpoints to revoke and restore members (Feb): The Bitwarden Public API now includes endpoints to revoke and restore organization member access. Administrators can use them to automate access changes in existing workflows.
SIEM integrations: Huntress (February), Blumira (May), and any HEC platform (August).
Automatic Login with SSO (March): An Enterprise policy enables automatic login to configured applications launched from an identity provider (IdP) dashboard. The Bitwarden browser extension fills and submits stored credentials, extending SSO-like convenience to applications without native SSO support.
Secrets Manager Jenkins integration (February): Development teams can use the Bitwarden Secrets Manager CLI to inject secrets into Jenkins pipelines. This keeps sensitive values out of build configurations.
Import from Delinea (August): Users can import .csv and .xml files from Delinea, including Delinea Secret Server. Items with an associated URL import as logins, and other data imports as secure notes with custom fields.
Access Intelligence reporting for risk over time (April): Enterprise organizations can track changes in credential risk and remediation progress across applications, vault items, and members. Historical reporting helps security teams identify trends, prioritize remediation, and assess progress over time.
Passkey login to Windows 11 (March): Users can sign in to a Windows 11 device joined to Microsoft Entra ID using a passkey stored in their Bitwarden vault and accessed through the Bitwarden mobile app. This requires the organization to enable FIDO2 security key sign-in and the Web sign-in policy, and the user to register a passkey for their Entra ID account.
Send event logs (July): Creating, editing, deleting, or accessing a Send now logs an event in the Admin Console. This gives administrators visibility into how members share information.
Agent Access SDK (March): Available in early alpha, the SDK provides a secure end-to-end encrypted pathway for AI agents to request and receive just-in-time access to credentials with human-in-the-loop approvals.
FedRAMP High commitment (September): Bitwarden committed to achieving FedRAMP Class D (High) certification for cloud-hosted Password Manager and Secrets Manager. Certification will introduce a dedicated government cloud option for federal agencies. Self-hosting on compliant infrastructure remains available for organizations that need direct control over their deployment.
Bitwarden Privileged Controls (September): Helps IT and security teams manage privileged access to credentials already stored in Bitwarden. Available now in private preview for select customers, with general availability expected in Q4 2026. Bitwarden Privileged Controls includes:
Credential leasing: Makes login usernames and passwords available only once access conditions are met. Each request specifies an access period and reason. Leases expire automatically or can be revoked by an administrator.
Advanced access rules: Enables administrators to configure approvals, IP checks, and lease durations through templates or custom rules, reducing standing access to privileged credentials.
Automated password rotation: Rotates passwords when a lease ends or on a schedule. Supports Microsoft Entra ID at private preview launch, with custom scripts available for server-related credentials on Windows and Linux. Credentials outside automated coverage can be flagged for manual rotation.
Compliance-ready audit logs: Record timestamped details of credential requests, approvals, access, and lease completion. Logs can integrate with SIEM solutions to support auditing.
Across 2026, Bitwarden releases centered on one goal: helping organizations reduce credential risk while making secure habits easier for everyone.
Security teams gained tighter control over who can access sensitive credentials and when, through temporary privileged access, automated password rotation, and centralized organization ownership. Access Intelligence reporting and expanded SIEM integrations give administrators a clearer view of credential risk and remediation progress over time. Staged provisioning, invitation links, and marketplace deployment help IT teams onboard users and roll out Bitwarden faster. As AI agents take on more work, the Agent Access SDK extends the same human-in-the-loop control to how agents request and use credentials.
For everyday users, passkey sign-in, improved autofill, and a cleaner interface make strong security feel effortless.
More updates are on the way. General availability of Bitwarden Privileged Controls and the redesigned Password Manager interface is planned for later this year, along with expanded passkey login, native passkey integration, and desktop autotype.
To stay up to date on new features and security insights, sign up for the Bitwarden newsletter.