# Bitwarden moves app-store clients to a commercial licence while keeping GPL builds on GitHub Bitwarden says its next app-store and direct-download clients will be commercially licensed, while GPLv3 builds remain available through GitHub. Self-hosting is not being discontinued, but future client features may be commercial-only. Bitwarden is changing which client binaries it distributes through app stores, not retroactively relicensing GPL code. Self-hosters and downstream redistributors should distinguish current compatibility from future feature divergence. - Status: Active - Published: 2026-10-17T23:00:00+13:00 - Updated: 2026-10-17T23:00:00+13:00 - Categories: Web Development, Cloud & Infrastructure, Hosting, Deployment & DevOps, Developer Tools - Tags: Bitwarden, open source, self-hosting, software licensing, Vaultwarden - Canonical HTML: https://beyondthe.news/dossiers/bitwarden-app-store-commercial-builds-gplv3-dual-licence-october-2026 ## What changed On 9 October 2026 Bitwarden staff announced that, beginning with the next release, apps delivered through app stores will use its commercial licence rather than the GPLv3 build. Bitwarden says it will continue to publish GPLv3 builds on GitHub, and that current features remain available in both versions. Staff clarified that self-hosting and third-party compatible servers such as Vaultwarden are not being disabled. Some future components, especially business features, may exist only in commercial builds. This is a change to the distribution of official client binaries and future feature boundaries; the client repository already contained GPL and proprietary-licensed modules, so it is not accurate to say Bitwarden has newly relicensed all existing code. ## Why it matters For a password manager, source visibility, redistribution rights and interoperability matter beyond the normal product-release cycle. Most users installing from app stores need no immediate action, but people who require GPL-licensed software must select the corresponding GitHub or community builds rather than assume store binaries carry the same rights. Downstream packagers and resellers face materially different permissions. Self-hosted operators should track client/server compatibility, because the future divergence of commercial-only features could affect third-party implementations. Independent tests found the existing commercial and GPL CLI builds can both authenticate to and exchange vault items with Vaultwarden, but that result cannot guarantee future compatibility or establish that all clients behave identically. ## What changed in distribution, and what did not Bitwarden's October 9 forum announcement says the next official app-store builds and download-page binaries will use the Bitwarden commercial licence. GPLv3 builds remain on GitHub. This is not a blanket withdrawal of the source code: Bitwarden's clients repository states that GPLv3 is the default unless a file is marked otherwise, with commercial modules separated under bitwarden_license. The separate commercial licence imposes restrictions on redistribution and production use of commercial modules. Distinguish the rights attached to a particular build from whether its source can be inspected. ## What self-hosters and Vaultwarden users can verify Bitwarden staff said self-hosting is unaffected and third-party servers may continue to implement compatible client features. In an independent Debian 13 test, Big Iron installed Vaultwarden 1.37.4 and tested Bitwarden CLI 2026.9.1 commercial and OSS binaries. Both logged in, synced, created items and decrypted each other's items. That is a reproducible compatibility check for the tested CLI releases only, not a guarantee about mobile, browser, desktop, enterprise integrations or future versions. ## Existing dual licensing versus the future split The repository's GPL and Bitwarden Licence files predate the October announcement. An independent release-artifact comparison by SoloSoft found that Bitwarden's September 2026 self-hosted web packages already contained differing commercial and open-source feature bundles. This is an independently reported binary comparison, not a claim that the October notice itself introduced all those differences. Bitwarden says future features will be evaluated case by case and some will ship only under the commercial licence. Exactly which features, platforms and packaging channels will diverge remains unresolved. ## Operational choices for maintainers and small teams If licensing terms matter, identify the exact binary and licence before packaging or redistributing it. Inspect Bitwarden's GitHub release assets for OSS-labelled CLI and web vault builds; do not assume every desktop or mobile release already has a separately downloadable GPL binary. Self-hosters should keep tested backups and run a dedicated test-account smoke check after upgrades: authenticate, sync, write a dummy item, read it back, delete it, then verify failures are correctly detected. Users who only install the official app from an app store have not been told to migrate or pay as a result of this announcement. ## Key details - Announcement dated 9 October 2026: next app-store and official download builds use commercial licensing. - Bitwarden says GPLv3 client builds continue on GitHub and all current features remain available in both versions. - Bitwarden says self-hosting and third-party servers such as Vaultwarden are unaffected at present. - Some future components may ship only under commercial licensing; the exact future feature split is not fixed. - Bitwarden's repository already contains GPL and proprietary-licensed modules; the October change is not a wholesale relicense of historical GPL source. - Independent Big Iron test: commercial and GPL CLI 2026.9.1 builds both worked against Vaultwarden 1.37.4; other clients not tested. - Independent SoloSoft comparison reports pre-existing differences between September self-hosted commercial and OSS web bundles; interpret separately from the new app-store distribution choice. ## Builder takeaways - Check whether the client build you redistribute or package is GPL or commercially licensed; source visibility alone does not confer GPL rights. - Use OSS-labelled release artifacts where available if your deployment requires GPL software; check each platform's actual release assets. - Self-hosted users need not assume immediate loss of compatibility; verify it after updates with a dedicated nonproduction account. - Track future commercial-only features and their server-side dependencies rather than treating a promise about current features as a permanent guarantee. - Preserve an encrypted export and restore plan independent of the password manager's licensing roadmap. ## What to watch - First app-store releases carrying the new commercial licence and matching OSS GitHub assets per platform. - Whether Bitwarden documents commercial-only features and their effect on third-party servers. - Any change to Bitwarden's official self-hosted server terms or its client APIs. - Independent compatibility tests of new browser, mobile, desktop and CLI versions with Vaultwarden. - Clarification of permitted redistribution and commercial integration under the exact licence terms. ## Uncertainties - Original Bitwarden community forum thread returned access-denied to automated fetching; staff statements were corroborated through independent reporting and the public repository. - Announcement does not provide a definitive cross-platform OSS artifact schedule or complete future feature list. - CLI compatibility testing is limited to 2026.9.1 and Vaultwarden 1.37.4; no claim of broader interoperability validation. - SoloSoft's binary comparisons have not been independently reproduced here; numerical differences remain attributed to its audit. - No announced change to free-plan pricing has been verified as part of this distribution change. ## Sources - [Published version update in app stores — Bitwarden community announcement](https://community.bitwarden.com/t/published-version-update-in-app-stores/102750) — Bitwarden · primary/vendor · 2026-10-09T00:00:00+13:00. Company forum notice and staff clarification, corroborated by independent reports; direct automated fetch denied. - [Bitwarden clients LICENSE.txt and dual-licence boundaries](https://github.com/bitwarden/clients/blob/main/LICENSE.txt) — Bitwarden GitHub · primary/vendor · 2026-10-17T00:00:00+13:00. Primary licence structure; GPLv3 default, commercial modules under bitwarden_license. - [Bitwarden's Dual Licence: What Changes for Self-Hosters and Vaultwarden](https://www.bigiron.cc/guides/bitwardens-dual-licence-what-changes-for-self-hosters-and-vaultwarden) — Big Iron · independent reporting · 2026-10-13T00:00:00+13:00. Staff statements plus independent commercial/GPL CLI compatibility test with Vaultwarden. - [Bitwarden's Dual License Move: commercial and open-source artifact comparison](https://www.solosoft.dev/post/bitwarden-dual-license-audit/) — SoloSoft · independent reporting · 2026-10-11T00:00:00+13:00. Independent binary-diff analysis of already-divergent September web vault artifacts; counts attributed to researcher. - [Bitwarden License Agreement v1.0](https://github.com/bitwarden/clients/blob/main/LICENSE_BITWARDEN.txt) — Bitwarden GitHub · primary/vendor · 2020-09-04T00:00:00+12:00. Licence rights and restrictions; not interchangeable with GPL.