YSK that Bitwarden will require you to enter verification codes sent to your email before letting you log in, starting February 2025 (Edit: This is for those who aren't currently using 2FA)

Why YSK: Because if you are like most people, you also store your email's password in your Bitwarden Vault and not bother remembering it, causing you to potentially get locked out (since you wouldn't be able to log in to your email to get the verification code, because your email's password is in the vault itself 👀)

(Imagine leaving your key in your house, lol)

Source: https://bitwarden.com/help/new-device-verification/

Excerpt:

To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login. After entering your Bitwarden master password, you will be prompted to enter a one-time verification code sent to your account email to complete the login process when logging in from a device you have not logged in to previously. For example, if you are logging in to a mobile app or a browser extension that you have used before, you will not receive this prompt.

Good thing I noticed, otherwise I might've had a bad time next month 😖

Edit: Updated title to clarify that people who have 2FA are not affected.

87 comments

On the other hand, NOT using MFA on an online password manager is just poor opsec.
- I understand that perspective, but honesly, for me, the threat of misplacing 2fa is higher than getting hacked.
  
  People are "hacked" all the time in massive breaches. Its accelerating, not getting less likely. Password managers are a huge target, and have been breached in the past.
  If youre worried about it, use something like Aegis. Its an mfa app that lets you easily save password protected backups. You can set it up to automatically save a copy to a folder on your phone. Then just copy that file off and store it somewhere safe.
  If thats too much work and you dont run syncthing/nextcloud/etc, they also have an option to let it it sync with the google backup service.
  The above gives you the best of both worlds : strong security and strong redundancy.
  
  Where TOTP is concerned is you enroll multiple devices for redundancy, and there are scratch codes. Plus you'll eventually be forced to resolve this issue when passkeys become more mainstream.
  Happy to help or talk through things if you'd like a hand getting comfortable with MFA 🩵
  
  Sorry dude, if keeping your 2fa codes safe is too much to ask then you really shouldn't be on the internet.
  Using a password manager without 2fa is a recipe for disaster, you might as well just use the same password for all your accounts at that point, then you don't need the inconvenience of a password manager
This is a good thing. Any account you care about and don’t want to be accessed by anyone without your consent should have multifactor authentication enabled. Use an app like Google Authenticator or a hardware token like a Yubikey. 2FA through text or email is insecure and easily bypassed.
Friends don’t let friends raw dog the internet. Don’t be dumb and get your shit stolen. Use MFA everywhere.
- Cant wait for someone to use bitwarden to store their bitwarden 2FA codes and recovery codes, thus locking themselves out of their account.
  This is just a dumb move by bitwarden.
  
  I'm fine, I use Aegis to store my bitwarden 2FA code. I just need my Aegis password to access it that is stored in ... Bitwarden ....
  I might not be the sharpest egg in the basket, thanks OP to have made me realize my mistake and I'll change that.
  
  Multi device. If you have more than one device with your vault configured and protected with MFA then the risk of locking yourself out of the account drops logarithmically with each additional device.
The amount of people not already using MFA in this thread is too damn high!
- I wish that we could use same MFA more often! My bank can get outa here with that texting me a code bullshit. Let me use a rotating key!
  
  100%. It's crazy that banks haven't caught up with the times.
I hate this so much. My Bitwarden password is the one thing I know. I'm not confident I could ever learn another password, especially one I barely ever need.
And 2FA? What if my phone breaks? My 2FA recovery codes are in Bitwarden.
Ugh. I have no idea what I'm going to do.
- Print or write down your recovery codes, and stash them in a safe spot. And don't store your primary email password in bitwarden either.
  With your current setup, you're one keylogger away from losing all your stuff.
  
  With your current setup, you’re one keylogger away from losing all your stuff.
  With keyloggers as a malware, the malware could just steals the contents of the vault when you unlock it, even if you have 2FA.
  Physical keyloggers are extremely unlikely, since you would be using your devices most of the time, and if your adversary can put a physical keylogger, they probably would also put malware in your computer, again, they'd steal the contents of your vault when you unlock it, 2FA or not.
- Using different apps for password management and for 2fa is good for your security and good for redundancy. If your vault is compromised, you don't want your OTP info compromised with it. I personally use Aegis.
  That said, Aegis is still an Android app and while I have a backup of it's data, I think I'm still out of luck if my phone breaks until it gets repaired or replaced. I've been trying to figure that one out, because it doesn't seem like there's a lot of good options with desktop support.
  
  Maybe you could use an Android VM and install Aegis into it
- I can tell you what most are going to do. Same password for both the vault and the email provider. Which is counter productive to everything.
- Option 1: Set Email password same as Bitwarden Password (probably not a good idea, but technically an option 😉)
  Option 2: Make a Keepass Vault with the same password as Bitwarden, and put your Email password in it. Make sure to backup the keepass vault file to many different Hard Drives, SDDs, and cloud (file is encrypted so its probably safe in cloud)
  Option 3: Move every password into Keepass.
  Hurry, time is ticking, February is in a few days. (I'm moving to Keepass btw, already have my Email password in Keepass and the vault is backed up)
  
  I've never used bit warden, but I migrated from Nordpass to keepass, I currently use a private key for my second form of Authentication so even if my vault is stolen it can't be decrypted cuz they would need the private key along with it
  It's a stupid simple setup, because I use syncthing to synchronize my Vault across all systems, and I have syncthing set up that way it keeps three or four versions of the Vault active at a time so if I somehow managed to corrupt The Vault I can just use an older version, this way I only have one account that I'm locked out of instead of all accounts.
  As for 2fa, yeah I do the same thing as the other guy my 2fa is stored in my vault. I used to use authy for everything, then they decided that it wasn't secure to have a desktop app, and since I don't have my phone on me at all times I decided just fuck it and threw it all in one location. It's less secure but there isn't a decent desktop 2fa app available that I know of. Technically I could make a seperate keepass vault only for 2fa but that would be a second password to remember
- Recovery codes. Take them seriously. Some I trust have them for glass break.
My email is one of the few passwords I still know without my password manager.
It probably is time for me to rethink that 🤔
- 100%. Control of someones email is just about the #1 target for someone to breach. It not only gives someone a ton of data about you, its almost always the method companies use to reset passwords. Someone with full access to your email can wreck your day/month/year.
  
  These are basically the same reasons I haven't turned it over to my password manager.
- If I was in a coma for five years and woke up, I’d still remember my 40-something character password manager password. I should do the same thing for my E-mail.
To be fair your post title does not match their own text
To keep your account safe and secure, in February 2025, Bitwarden will require additional verification for users who do not use two-step login.
So it's not all accounts, just the ones that don't already have 2FA. Personally I wouldn't have noticed any changes since I already use 2FA enabled with an authenticator app. But I can see how this might bite you in the ass if you weren't already using 2FA.
Interestingly I used to run into a similar issue when using Lastpass. When logging in from other IP addresses they would often do mandatory email 2FA, and of course I couldn't get into the email account without Lastpass. But it sort of resolved itself since I also have email on my phone so I just had to make sure those Lastpass emails didn't end up in spam or wherever.
This is likely timed to meet the new PCI requirements, since they are designed to store your credit card info if you want to, and MFA will be a requirement as of April 1st this year. Everyone should be using MFA for this kind of information anyway, I know people hate inconvenience in the name of security, but if safety wasn't forced on people we wouldn't have things like seat belts, hand rails, and factory safety lockouts.
- but if safety wasn’t forced on people we wouldn’t have things like seat belts, hand rails, and factory safety lockouts.
  But like... They just posted the announcement on Jan 27. I literally didn't get any notice before that, and I still have yet to receive a notice via email, only knew because I was logging in via the web. (Did anyone else even get a notice?)
  They should've given at least 3 month notice in advance for such a drastic change that could potentially get someone locked out.
  
  They should've given at least 3 month notice in advance for such a drastic change that could potentially get someone locked out.
  Absolutely. Their Lawyer/Risk/Compliance person probably just noticed and went "oh fuck". With the short timeline they gave vs. compliance effect date, I hope it means they will have all hands on deck to support and work around the inevitable lockouts next month.
  
  actually I would say one step further. It should give a notice for popular email service urls or tagged email saying the alert with a timed window (meaning it can't just be clicked through)
This is not the end of the world, some mighty overreaction on the comments. This is why diversity is the answer to security. Multi factor, multi mode, multi device. Something you know, something you have, something you are, etc.
If you have more than one device, like PCs, laptop, phone, in any combination, and you have your access config on all. Then there's an infinitesimally small chance you'd lose access to your vault.
- If you have more than one device
  That's the problem, many people only have one device. (My parents, grandparents, probably aunts and uncles all mostly use their phones, probably doesn't have a second phone, or even touched a computer for a while, imagine if one of them used Bitwarden)
  I personally haven't used my PC for a while, since I don't feel like playing games anymore, so most of my time using electronics is mostly doomscrolling Lemmy and watching Youtube (don't judge). So if my phone happened to break, or if my app got corrupted for some reason and I had to re-download, I could definitely have gotten locked out, but luckily I saw that notice, I have the Email password saved in Keepass, so now that threat is over).
  (I know I should've backup the vault, but I kinda procrastinated 🙃)
  
  They have different threat models. If they don't have a PC, they most likely don't and never will have bitwarden. They'll let apple or Samsung or Google handle their security for them. In the end, we all accept some level of risks across different threat dimensions. Some people are more lax and some people are more strict. It's not the end of the world.
@OP There will be an option to turn it off, maybe add that to the post
An option to turn off new device login protection will be available in the web vault account settings
Anyways thank you so much OP for notifying me, their fuckup would've impacted me as well
PSA: Vaultwarden is easy to self host.
- Absolutely, but this is one of the worst reasons to advocate self-hosting a service. The kinds of people that are upset about higher security standards should not be self-hosting anything.
- I just setup vaultwarden a few days ago for a small group, it's very simple.
"who do not use two-step login"
- Enough people that they decided to make this mandatory.
  So, probably a lot.
  
  They should be using 2FA then. There are at least 3 other multifactor authentication options available. Configure one of them, or you can be affected by the device verification change. Or, you can disable the feature, but without any secondary auth factor, you're just begging to have your passwords stolen.
This introduces so many failure modes. What if my email provider goes bankrupt, or fucks up their servers, or bans me? Access to my Bitwarden Vault is now dependent on some company's whims
- I mean, you could set up 2FA and save the QR code that you used to set up the 2FA in unencrypted format on some cloud, making it a de facto 1FA. That could be the workaround if you just refuse to use 2FA.
  Or you could just move to Keepass like I'm planning to do.
  
  I set up 2FA, took a screenshot of the QR code, printed it out, and stuck it in a fire safe.
- This is only for devices you haven't logged in from before.
  
  I liked the thought that if I were to lose my phone while traveling, I could just borrow a computer and access all my accounts anyway and not getting very uncomfortably stuck. This is putting me at big risk there.
I don't use bit warden but, that sounds like a flaw that can very easily fuck your system up.
I find it stupid as a mandatory requirement, if you don't want to use 2fa then you should be allowed not to, it's still a multitude better than just using the same password for everything of having it on a text document on your computer.
Also, I'm not sure if anyone else get any notice, but in my experience I didn't even get a notice in my email at all. I just went to the browser page moments ago and saw the notice. I was like "WTF". I logged in a few days ago on the 22nd and didn't see that, so this must be recent. Less than 10 days of notice? Wtf Bitwarden?!?
(I don't currently use 2fa because I have trouble with misplacing 2fa stuff, so I'm more likely to get myself locked out with 2fa, than having someone hack my vault without 2fa.)
- Just use something like ente auth, then you can just login online anytime and get your 2fa codes.
- Are you able to remember a strong password? If you can then you can use something like KeePass, it is an offline password manager (and authenticator) that you can use on your phone and PC and backup the file anyway you want, in storage and the cloud. It is very easy to import and export.
  Use the 3-2-1 rule for storing your vault:
  Maintain three copies of your data: This includes the original data and at least two copies.
  Use two different types of media for storage: Store your data on two distinct forms of media to enhance redundancy.
  Keep at least one copy off-site: To ensure data safety, have one backup copy stored in an off-site location, separate from your primary data and on-site backups.
  I have a Bitwarden vault for passwords and a KeePass vault for TOTP. I would use at least 2 Yubikeys as well but I'm using degoogled Grapheneos. I hate email and SMS verification for MFA, and my stupid banks only support these two methods.
Thanks for the heads up, though this would be less of an issue if you have the email app on your phone or the tab pinned in Firefox.
The real issue is i gotta use another authentication app for my email now, have been using Bitwarden itself for 2fa codes for proton. Definitely can’t use proton pass to 2fa for my proton account.
I don’t even know. Gonna have to find another reputable authenticator app.
Guess I should also check if Bitwarden or proton support physical security keys. Would be pretty bomb proof since my keys are always in my pocket anyway.
- Aegis is a good Authenticator app you could consider
  Generally, it's not recommended to keep TOTP and passwords at the same place
  
  Two apps on the same device is still the same place. Same app but on different devices is different places.
- Bitwarden supports phys. keys but you have to pay for the premium subscription to use them, which is 10$/year
Guess its time to set up a hardware key
- I'll probably move to Keepass, I like to have control over my vault file, probably better than whatever "2fa" they are forcing anyways, since only I know where the vault is at.
  
  I mean, if they're forcing 2FA at all, that's a good thing, but they still have the usual TOTP and hardware key options.
  Anyway, I understand why people would want to host their own vault file. Just remember that obfuscation (i.e. being the only one who knows where your vault is) isn't a viable security method. Removing access to potential thieves is.
  
  Already store the most critical stuff in keepass; use bitwarden for the lower-risk stuff that benefits from the higher convenience factor.
something done by many services, sites, and games.
but yea, i get it. the problem of asking someone to login to a service that they (bw) are holding your key for, in order for you to get into where that key is held.
What if you host via Vaultwarden? Do you have control over it?
- Who is excluded from this account email-based new device verification?
  The following categories of logins are excluded:
  Users who have two-step login set up are excluded.
  Users who log in with SSO, a passkey, or with an API key are excluded.
  Self-hosted users are excluded.
  Users who log in from a device where they have previously logged in are excluded.
  Source: https://bitwarden.com/help/new-device-verification/
  
  Cool ty
  
  Thank God I self host!
This is stupid.. Now where would i save my mail password
I'm getting sick of all this two step verification and code confirmation bullshit. I don't need my Instagram password stored in a bank vault with 24 hour security. Let me opt out of all this extra security and if it gets breached then blame me for opting out.
I don't even have two step verification turned on for something and I still needed to check my email for a code and then when logging into the email I needed to check my phone for a second code just so I could access the first code for some bullshit account I hardly ever use. It's incredibly frustrating.
If I want to go through all that shit for security purposes then I will ask you to go through all those steps. Don't force me to. Fuck.
- It's because PCI requirements, they offer to store credit card information and PCI compliance now requires that be under a 2FA. Also honestly, you should be using 2FA regardless, make it less annoying by using a proper token Authenticator. Authy is a decent one, avoid Google Authenticator bit Warden also offers a separate program for token Authentication that you can use on your phone.
  Tokens are still an extra step but less annoying than having to go check your email for a code. Or you can go the extra mile and purchase something like a yubikey, all you have to do is have it plugged into a computer USB port and it will handle the two-factor for you automatically
Thank-you. Made me check my shit.
Just a reminder that most of us have backups of the vault. It's not like the apocalypse.
For what it's worth, as of a minute ago the form that's for sending the email code asks if you have reliable access to the email before sending the code.
But otherwise seems to be a non-issue with any of the software/hardware mfa options it supports. Good to let others know about this though!
The only two passwords I know are my Bitwarden's and my Email's.
Why would they ever force this?
The purpose of MFA is to:
Mitigate using the same password on multiple sites and one of them has a data breach.
Mitigate the impact of keyloggers/other kinds of malware.
Mitigate the bad security of bad passwords.
Mitigate the password manager's own data breach.
If you have at least two braincells, you will chose a unique and secure password for your password manager. That's the point of password managers, that you only have to remember 1 password so it can be unique and strong. Also, a password manager (specially open source) should have almost perfect security, so them being hacked should not be a concern.
The only thing MFA is doing on password managers is to mitigate malware. Which I don't think is a good justification to force everyone the hassle of MFA.
Fine if the wanna give the option of MFA, but don't force it on everyone.
- I mean, I don't necessarily oppose it, I just hate how they never gave any notices until like Jan 27, 2025 (according to this article: https://bitwarden.com/blog/adding-more-security-to-bitwarden-user-accounts/ look at the date on it).
  They should've given at least 3 months notice for such a drastic change like this. I feel like there would be a lot of people getting locked out because they didn't know about this.
I don't see anyone mentioning it, but what if you do forget (or don't know) your email password? Is there absolutely no way to recover your account? I'm sure there might be some services that are that restrictive, but I'd think that most are recoverable with some extra steps, no? Unless I'm missing something?
- I don't know, they haven't implemented it yet.
  I hope that if enough people started to get locked out, they will reverse or delay it for a few months and give people time to access the vault and make preparations.
  Since you are seeing my post, you know this is happeneing, so you should probably change your email password to something memorable.
  Or put that in a Keepass vault, and remember the Keepass password, and back up the vault to multiple cloud accounts, multiple Hard Drives / SSDs, etc. (I had this done just before I posted this post)
  Or just move entirely to Keepass, like I'm planning to do.
I just got a pop-up about this today... It would have been nice to get this at the beginning of the month......

87 comments