Bitwarden

The problem you have, whether you have noticed it or not

A company collects logins faster than anyone expects. Instagram, a domain, Swish or some other payment method, email, maybe a web shop and an accounting tool. Four people in the company need access to them, and the passwords end up in a group chat or on a note in a binder.

That works until someone leaves the company, until a phone is lost or until one of the accounts is hijacked. Then all the other accounts are open too, because the password was the same everywhere with a number at the end.

Bitwarden solves this by being the only thing you need to remember. The program generates a long random password for each account, stores it encrypted and fills it in for you when you log in. You share what you should share with the rest of the company, and only that.

What you need

• An email address. Use one the company can access, not a private address that disappears the day the person who created the account leaves.
• A master password that you can remember and that nobody else can guess. More on that shortly.
• The browser you already use. The rest is optional.

Time needed: twenty minutes to get started, another fifteen to move the company's existing passwords in.

The master password, and why it is the whole guide

Bitwarden encrypts the vault on your computer before anything is sent anywhere. The key is the master password, and Bitwarden never has it. That is exactly why the system is worth trusting, and it is also why there is a hard consequence:

If you forget the master password, there is no reset button. No support can help you. The vault remains but cannot be opened, and you start over from scratch with all accounts.

So choose a sentence instead of a word. Four or five Swedish words that do not belong together, for example lodret kaffekopp silver tolv. It is long, it is possible to remember and it is harder to crack than Sommar2026!. Write it down on paper once and leave the note at home with the person who is most organized. Yes, paper. It is the only place that cannot be hacked.

Keep åäö in your passwords if you want, but be prepared for some phone or keyboard to make it awkward. On a master password that will be typed on several devices, it is an unnecessary risk.

Create the account

1. Go to vault.bitwarden.com and choose to create an account.
2. Choose server region. EU if you want the data to stay within Europe, which is reasonable for a Swedish company. The choice cannot be changed afterward without moving the vault manually, so make it before you fill up with a hundred passwords.
3. Enter email and master password. The hint that Bitwarden asks for can be vague. It is sent by email to you if you request it, meaning through a channel someone else can access.
4. Log in to the web vault and turn on two-step verification under Settings, Security. An authenticator app on your phone is free and works well.
5. Save the recovery code for two-step verification on the same paper as the master password. If you change phones without that code, you have a problem.

The browser extension, what you will actually use

The desktop program is nice. The browser extension is what makes it possible to keep this up after week two, because that is where passwords are filled in without you doing anything.

Go to bitwarden.com/download and choose your browser. There are extensions for Chrome, Edge, Firefox, Safari, Opera, Brave, Vivaldi and a few more. Log in to the extension with the same account.

Pin the icon to the toolbar. In Chrome and Edge you click the puzzle piece and then the pin next to Bitwarden. If the icon is hidden in a menu, you will stop using it.

When you then log in to a site, Bitwarden asks whether the password should be saved. Answer yes. If you create a new account somewhere, you click the Bitwarden icon in the password field and let it generate one. The default setting of fourteen characters is on the low side; drag it up to twenty. It costs nothing since you should never type it by hand anyway.

Windows: the desktop app

At bitwarden.com/download there are four options for Windows, and they do the same thing:

• The standard installation. Download the file, run it, done. The program updates itself.
• Microsoft Store. The same program, handled by Windows' own update.
• Portable version for a USB drive. It does not update itself, which Bitwarden also points out. Use it only if you really need an app that comes along on the drive.
• Chocolatey with choco install bitwarden, for anyone who already has that package manager.

Go with the standard installation. Bitwarden lists Windows 11 for the desktop app, so if you run Windows 10 you may need to stick to the web vault and the browser extension. That is no great loss: the extension does almost everything the app does.

Linux Mint: five formats, choose Flatpak

Bitwarden offers .deb, .rpm, AppImage, Snap and Flathub for Linux. On Linux Mint, Flatpak is the right choice, because it is already installed, Flathub is enabled and updates arrive through the Software Manager along with everything else.

Open the Software Manager, search for Bitwarden, install. Or from the Terminal:

flatpak install flathub com.bitwarden.desktop

The version on Flathub follows Bitwarden's own releases, with only a day or so of lag behind the latest release.

A few words about Snap, since it comes up: Linux Mint has snap turned off from the start, deliberately. You can turn it on, but do not do it just for Bitwarden when Flatpak is one click away. And the .deb file works too, but then you have to update it by hand every time, which nobody does in practice.

Sharing passwords in the company

This is where Bitwarden differs from just having passwords saved in the browser.

An organization in Bitwarden is a shared vault alongside each person's own. What you put in the company's collections is visible to everyone in the company. What you keep in your personal vault is visible only to you. Create the organization in the web vault under New, Organization, and invite the rest of the company using their email addresses. They receive an invitation that they accept.

Create two collections right away, not more: one for what everyone needs access to, such as social media and the company email, and one for what only the person responsible for finance needs access to. Then you put the right login in the right collection. A company of four people can manage with that division for a long time.

Bitwarden has a free tier and several paid tiers, and what is included in each changes over time. Check bitwarden.com/pricing before you decide, so you do not build your way of working on something you will later have to pay for.

If you want to run everything on your own server instead, the guide Install Vaultwarden is available here on the site. Vaultwarden is a smaller server component that Bitwarden's own apps can talk to, and that is the route we recommend for anyone who wants to own the whole chain. Bitwarden's official server installation can also be run yourself, but it requires an installation ID that you get from Bitwarden and is considerably heavier to keep running.

Move in what you already have

The passwords are probably already saved in Chrome or Edge. Export them from there to a CSV file and import them into Bitwarden's web vault under Tools, Import data.

Then comes the important part, and it is easy to forget: delete the CSV file. It contains every password in plain text and is now in the Downloads folder. Empty the trash as well.

While you are at it, turn off the browser's own password manager, otherwise two programs ask the same thing every time and you no longer know where anything is saved.

If something goes wrong

The extension does not fill in on one site. Some login pages sit in a frame that the extension cannot reach. Click the icon, find the entry and copy the password manually. The clipboard is cleared automatically after a while, and that time is set in the extension settings.

You keep getting logged out. Under Settings in the extension there is Vault timeout. Fifteen minutes is reasonable on your own computer. On a shared computer at the office it should be shorter, not longer.

Someone in the company cannot see what you shared. Check that the person has accepted the invitation to the organization and that the entry is actually in a collection, not in your personal vault. It is almost always the latter.

You have changed your email address. Change it in the account settings before the old address is closed, otherwise two-step verification becomes difficult to recover.

The license

Bitwarden's server component is under AGPL-3.0 and the clients under GPL-3.0, in both cases free software with the source code open. That makes independent security audits possible in a real sense, which has been done several times. For you, it mainly means that you are not locked in: the vault can be exported and moved whenever you want.

Unsure how to divide up the company's accounts? Get in touch, and we will sort it out.