What changed
On 9 October 2026 Bitwarden staff announced that, beginning with the next release, apps delivered through app stores will use its commercial licence rather than the GPLv3 build. Bitwarden says it will continue to publish GPLv3 builds on GitHub, and that current features remain available in both versions. Staff clarified that self-hosting and third-party compatible servers such as Vaultwarden are not being disabled. Some future components, especially business features, may exist only in commercial builds. This is a change to the distribution of official client binaries and future feature boundaries; the client repository already contained GPL and proprietary-licensed modules, so it is not accurate to say Bitwarden has newly relicensed all existing code.
Why it matters
For a password manager, source visibility, redistribution rights and interoperability matter beyond the normal product-release cycle. Most users installing from app stores need no immediate action, but people who require GPL-licensed software must select the corresponding GitHub or community builds rather than assume store binaries carry the same rights. Downstream packagers and resellers face materially different permissions. Self-hosted operators should track client/server compatibility, because the future divergence of commercial-only features could affect third-party implementations. Independent tests found the existing commercial and GPL CLI builds can both authenticate to and exchange vault items with Vaultwarden, but that result cannot guarantee future compatibility or establish that all clients behave identically.
What changed in distribution, and what did not
Bitwarden's October 9 forum announcement says the next official app-store builds and download-page binaries will use the Bitwarden commercial licence. GPLv3 builds remain on GitHub. This is not a blanket withdrawal of the source code: Bitwarden's clients repository states that GPLv3 is the default unless a file is marked otherwise, with commercial modules separated under bitwarden_license. The separate commercial licence imposes restrictions on redistribution and production use of commercial modules. Distinguish the rights attached to a particular build from whether its source can be inspected.
What self-hosters and Vaultwarden users can verify
Bitwarden staff said self-hosting is unaffected and third-party servers may continue to implement compatible client features. In an independent Debian 13 test, Big Iron installed Vaultwarden 1.37.4 and tested Bitwarden CLI 2026.9.1 commercial and OSS binaries. Both logged in, synced, created items and decrypted each other's items. That is a reproducible compatibility check for the tested CLI releases only, not a guarantee about mobile, browser, desktop, enterprise integrations or future versions.
Existing dual licensing versus the future split
The repository's GPL and Bitwarden Licence files predate the October announcement. An independent release-artifact comparison by SoloSoft found that Bitwarden's September 2026 self-hosted web packages already contained differing commercial and open-source feature bundles. This is an independently reported binary comparison, not a claim that the October notice itself introduced all those differences. Bitwarden says future features will be evaluated case by case and some will ship only under the commercial licence. Exactly which features, platforms and packaging channels will diverge remains unresolved.
Operational choices for maintainers and small teams
If licensing terms matter, identify the exact binary and licence before packaging or redistributing it. Inspect Bitwarden's GitHub release assets for OSS-labelled CLI and web vault builds; do not assume every desktop or mobile release already has a separately downloadable GPL binary. Self-hosters should keep tested backups and run a dedicated test-account smoke check after upgrades: authenticate, sync, write a dummy item, read it back, delete it, then verify failures are correctly detected. Users who only install the official app from an app store have not been told to migrate or pay as a result of this announcement.