Bitwarden ships commercial builds to app stores, keeps GPLv3 on GitHub
Bitwarden says its next release will send commercially licensed builds to the Apple App Store, Google Play, Chrome Web Store and its own download page, while a separate GPLv3 build continues on GitHub, and some future components will exist only in the commercial version.
Image: Bitwarden Community
Why it mattersA password manager a team already approved is quietly splitting into two builds under two licences, and the team that ships new features decides case by case which build gets each one, so what you install from the store will not always be what you can audit on GitHub.
A password manager a team already ships to its laptops is now two builds. Starting with the next release, the Bitwarden apps on the Apple App Store, Google Play, the Chrome Web Store, Firefox Add-ons and bitwarden.com's own download page will all be the commercially licensed build. The GPLv3 open-source version keeps shipping on GitHub, with the same current features. The company's community manager, RyanL, posted the change on 9 October 2026 and answered the first wave of questions in the same thread.
The split is forward-looking rather than retroactive. Every feature in the app today works the same way in both builds and remains open source on GitHub. New features, RyanL wrote, "will be evaluated on a case-by-case basis for which license applies to them". Some will land in GPLv3 and the commercial build at once; others will go to the commercial build only. The code behind the commercial build stays viewable on GitHub, under commercial terms rather than GPLv3, so a reader can still audit it.
Self-hosting and Vaultwarden keep working
Self-hosting is unaffected, and so is Vaultwarden, the third-party server many teams run. The free plan stays free, "permanently" in RyanL's words. The GitHub repositories remain readable, forkable and open to contributions, and the apps on the store are still built from those repositories. Bitwarden, RyanL wrote, "is not going closed-source". The company's reason, offered later in the thread, is that keeping the store builds under a separate commercial licence gives it "additional legal protection for select features" against resellers who repackage its apps.
The thread exposes one gap the announcement does not. A user named grb asked whether the Portable Desktop App link on bitwarden.com would download the commercial build or the GPLv3 one. RyanL answered that the download page will also direct-link to the commercial build. Someone who wants the GPLv3 build has to go to GitHub for it, and watch the two sets of release notes.
Where a team now has to read two sets of release notes
Treat the next release as a licence change on a dependency, not a feature update. The team deciding what their password manager may legally do should read the two licences side by side on GitHub before the next release ships, and check whether their own use is covered. For most companies the answer will be yes, because the commercial licence is written for the people who install the official app from the store. For a company repackaging Bitwarden, for a vendor shipping it as part of a product, or for a team pinned to a specific GPLv3 build for compliance, the answer may be different. A side-by-side feature table does not yet exist, so the only way to know what will diverge is to watch which features land in which build.
The announcement got 252 points on Hacker News within hours and drew long replies in the Bitwarden forum from paying users and self-hosters, several naming other open-source-to-source-available moves, MinIO and Redis among them, as what they are watching for.
Source
Primary source: RyanL, Published version update in app stores, Bitwarden Community Forum.
This item was written by an AI system from the linked source. Reveneau is responsible for what it publishes.
Get AI News in your inbox
New developer tools, model and agent releases, and how teams are actually using them to release software. Short, and only when there is something worth reading.
