agent safety

Agent safety answer

bitwarden-cli accesses vault items and secrets from local workflows.

Credential access

Can read passwords, notes, tokens, and vault metadata after unlock.

Remote mutation

Can create, edit, delete, and sync vault items.

Publish/artifact risk

Can export secrets into files or downstream release commands.

Recommended control

Gate item reads, exports, unlock, and mutations.

Agent-use guidance

Allow metadata-only operations; require approval for secret retrieval, export, and item changes.

install

Additional install commands

macOS

Homebrewverified · 100%

brew install bitwarden-cli

local Homebrew formula metadata

MacPortsverified · 94%

sudo port install bitwarden-cli

MacPorts ports tree · security/bitwarden-cli/Portfile · source: api.github.com

Linux

Nixverified · 92%

nix profile install nixpkgs#bitwarden-cli

nixpkgs package indexes · pkgs/by-name/bi/bitwarden-cli/package.nix · source: api.github.com

Arch Linux pacmanverified · 92%

sudo pacman -S bitwarden-cli

Arch Linux sync databases · bitwarden-cli · source: geo.mirror.pkgbuild.com

Windows

Chocolateyverified · 92%

choco install bitwarden-cli

Chocolatey community package catalog · bitwarden-cli · source: community.chocolatey.org

Scoopverified · 92%

scoop install main/bitwarden-cli

Scoop official bucket manifest trees · bucket/bitwarden-cli.json · source: api.github.com

Windows Package Managerverified · 92%

winget install --id Bitwarden.CLI -e

Windows Package Manager source index · Bitwarden.CLI · source: cdn.winget.microsoft.com

overview

Package summary

Secure and free password manager for all of your devices

Project links

Commands and aliases

bw

history

Project history and usage

Bitwarden CLI, invoked as bw, is the command-line client for Bitwarden Password Manager. Official docs describe it as a full-featured vault-management tool whose features mostly parallel Bitwarden's desktop and browser clients.

The package is significant because it puts an end-to-end encrypted password manager into shell scripts, CI jobs, server migration workflows, and terminal-first daily use.

Project history

The Bitwarden clients repository was created in 2016 and houses the web, browser extension, desktop, and CLI clients, with mobile clients split into separate iOS and Android repositories.

By the 2020s, the CLI had dedicated release tags in the clients repository, including cli-v2022.6.0 and continuing through cli-v2026.6.0. Bitwarden's CLI docs now document native executable downloads, npm installation, Chocolatey, Snap, Flatpak use through the desktop app, and GitHub checksums.

Adoption history

The input package-manager data shows broad package adoption across Homebrew, Chocolatey, MacPorts, Nix, Arch, Scoop, and winget. The official docs also list npm, Chocolatey, Snap, native executables, and Flatpak-mediated use.

Bitwarden's own help center positions the CLI for interactive login, API-key login, SSO login, server geography selection, and self-hosted deployments, which explains its reach beyond personal password lookup into business and automation workflows.

How it is used

Typical CLI use starts with bw login, then bw unlock to generate a session key for commands that touch encrypted vault data. Official docs also document API-key login through BW_CLIENTID and BW_CLIENTSECRET environment variables for automated work.

The CLI can list, get, edit, generate, encode, import, export, and serve vault data. Package users care about the serve mode and raw/JSON output options because they let local tools consume vault data without binding to Bitwarden's GUI clients.

Bitwarden documents BITWARDENCLI_APPDATA_DIR for separate data.json configurations, which lets users keep multiple accounts or environments isolated.

Why package nerds care

bitwarden-cli is one of the canonical examples of a security GUI product with a serious command-line surface. It lets package managers deliver a password-vault client into headless machines and scripted environments without requiring a desktop app.

Its package story is also interesting because the official docs distinguish OSS and non-OSS CLI bundles on GitHub while common distribution platforms carry the default build. That distinction matters to users who audit package provenance.

For shell users, bw is a bridge between human secret storage and automation: strong enough for personal use, but scriptable enough for infrastructure migration and controlled retrieval.

Timeline

2016: bitwarden/clients repository created.
2022-07-05: cli-v2022.6.0 release published in the clients repository.
2024: Official CLI docs reference OSS and non-OSS bundle naming examples such as bw-oss-windows-2024.12.0.zip and bw-windows-2024.12.0.zip.
2026-06-25: cli-v2026.6.0 release published.

Related projects

bitwarden/server provides the backend infrastructure for Bitwarden.
bitwarden/ios and bitwarden/android provide the mobile clients outside the clients monorepo.
bitwarden/directory-connector supports enterprise directory synchronization.
Bitwarden Secrets Manager is a related Bitwarden product for machine secrets, but it is distinct from the Password Manager CLI.

Sources

https://bitwarden.com/help/bitwarden-security-white-paper/
https://bitwarden.com/help/cli.md
https://bitwarden.com/help/cli/
https://github.com/bitwarden/clients#readme
source_facts.package-manager

security posture

No protected-tool coverage found yet

No matching local secret-handling manifest was found for bitwarden-cli. Nucleus package metadata is still published here so future coverage has a stable package URL.

Install behavior

No Homebrew post-install hook is recorded in formula metadata.
Homebrew bottle metadata is available for 1 platform targets.
Installs with 1 runtime dependencies.

Recommended review

Before unattended agent use, check whether the tool reads plaintext credentials, writes remote state, publishes artifacts, or shells out to plugins.

local files

Configuration and credential file locations

These source-backed paths show where this package keeps local settings or durable credentials. Automic Vault can use them as review targets for secret scanning, migration, and command approval.

Credential files

Credential-bearing paths to review before unattended agent runs.

macOS: ~/Library/Application Support/Bitwarden CLI/data.json

executables

Installed executables

Command	Kind	Exposure	Note
`bw`	cli	global executable

freshness

Version and freshness

These signals separate page generation age, package-manager activity, and upstream release comparison. Version lag is warned only when an evidence URL and comparable versions are present.

page generated2026-07-10

manager version2026.6.0

manager updated2026-06-25

local dataok

upstreamnot checked

latest detectednot detected

https://github.com/bitwarden/clients

infoNo cached GitHub release or tag data was available.https://github.com/bitwarden/clientsnone confidence

install metadata

Package metadata

Package key	brew:bitwarden-cli
Version	2026.6.0
Package manager	Homebrew
Package manager page	https://formulae.brew.sh/formula/bitwarden-cli
Homepage	https://bitwarden.com/
Repository	https://github.com/bitwarden/clients
Upstream docs	https://bitwarden.com
License	GPL-3.0-only
Source archive	https://github.com/bitwarden/clients/archive/refs/tags/cli-v2026.6.0.tar.gz
Last updated	2026-06-25T21:14:47Z
Pulse	updated
Dependencies	node
Bottle	available (on all)
Homebrew post-install	not defined
Service	none declared

registry facts

Source database details

Source Database	Homebrew formula API
Tap	homebrew/core
Full Name	bitwarden-cli
Version Scheme	0
Revision	0
Head Version	HEAD
Bottle Stable Root URL	https://ghcr.io/v2/homebrew/core
Deprecated	no
Disabled	no
Keg Only	no
URL Keys	head stable

source database matches

Other package-manager records

Matches are pulled from external package-manager indexes and kept separate from local Automic Vault package links.

Nix95%

bitwarden-cli

nix profile install nixpkgs#bitwarden-cli

normalized package name match
Matched by: Bitwarden Cli

nixpkgs package indexes · api.github.com · nixpkgs package indexes: pkgs/by-name/bi/bitwarden-cli/package.nix from https://api.github.com/repos/NixOS/nixpkgs/git/trees/master?recursive=1

pacman95%

bitwarden-cli 2026.2.0-1

The command line vault

https://github.com/bitwarden/clients

sudo pacman -S bitwarden-cli

License: GPL-3.0-only
Architecture: x86_64
3 dependencies
normalized package name match
Matched by: Bitwarden Cli

Arch Linux sync databases · geo.mirror.pkgbuild.com · Arch Linux sync databases: bitwarden-cli from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz

MacPorts95%

bitwarden-cli

sudo port install bitwarden-cli

normalized package name match
Matched by: Bitwarden Cli

MacPorts ports tree · api.github.com · MacPorts ports tree: security/bitwarden-cli/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1

Chocolatey95%

bitwarden-cli

choco install bitwarden-cli

normalized package name match
Matched by: Bitwarden Cli

Chocolatey community package catalog · community.chocolatey.org · Chocolatey community package catalog: bitwarden-cli from http://community.chocolatey.org/api/v2/Packages?$filter=IsLatestVersion&$select=Id&$top=1000&$skiptoken='11','backupper-standard'

Scoop95%

main/bitwarden-cli

scoop install main/bitwarden-cli

normalized package name match
Matched by: Bitwarden Cli

Scoop official bucket manifest trees · api.github.com · Scoop official bucket manifest trees: bucket/bitwarden-cli.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1

winget95%

Bitwarden.CLI

winget install --id Bitwarden.CLI -e

normalized package name match
Matched by: Bitwarden Cli

Windows Package Manager source index · cdn.winget.microsoft.com · Windows Package Manager source index: Bitwarden.CLI from https://cdn.winget.microsoft.com/cache/source.msix

package graph

Links come from deterministic package relationships, av.db category and tag curation, ecosystem matches, and package hub membership.

source trail

Generated from repository data

This page is generated by av-web from the private package SQLite artifact built by scripts/generate-pkg-sqlite.py.

Combined YAML source

View the package source record on GitHub.

combined/bitwarden-cli.yml

Used sources

Geiger risk classifier
Nucleus package database
av.db category and tag curation
cross-ecosystem install command graph
curated agent safety answer
curated configuration and credential file locations
curated package history
external package-manager database matches
package relationship graph
package version freshness
package-page enrichment

Install bitwarden-cli with Homebrew, chocolatey, MacPorts, Nix, pacman, scoop, winget

Agent safety answer

Credential access

Remote mutation

Publish/artifact risk

Recommended control

Agent-use guidance

Additional install commands

macOS

Linux

Windows

Package summary

Project links

Commands and aliases

Project history and usage

Project history

Adoption history

How it is used

Why package nerds care

Timeline

Related projects

Sources

No protected-tool coverage found yet

Install behavior

Recommended review

Configuration and credential file locations

Credential files

Installed executables

Version and freshness

Package metadata

Source database details

Other package-manager records

Internal package links

Topical hubs

Related tools

Same workflow

Agent security guides

Generated from repository data

Combined YAML source

Used sources