Bitwarden store apps switch to commercial license builds while GPLv3 version stays on GitHub

What Bitwarden announced

Bitwarden is changing which builds of its password manager reach the public app stores. According to an announcement posted on the Bitwarden community forum on October 9, 2026, in a thread titled "Published version update in app stores" that reached the front page of Hacker News, every store-published app will switch to the commercially licensed build starting with the next release. The company says no user action is required and that the apps will work exactly as they do today.

The GPLv3-licensed open source version will continue to be developed and published on GitHub, and all features that exist today are present in both builds.

What stays open

Bitwarden moved quickly to address the most obvious worry. According to the announcement, the project is not going closed source, the code remains forkable, self-hosting arrangements are unchanged, and the free plan is permanent. The company frames the licensing change as aimed at parties that repackage and resell Bitwarden, not at end users or self-hosters. A staff member replying in the thread added that code under the commercial license is still viewable on GitHub, and that the dual-license model is intended to give certain features stronger legal protection.

Where future features land

The consequential detail appeared in follow-up replies. A Bitwarden team member confirmed that some future components will be published only under the commercial license, and that newly developed features will be evaluated case by case to decide which license applies to them. Direct downloads from Bitwarden's own download page will also point to the commercial build, which means obtaining the GPLv3 desktop app will involve going to GitHub instead. Some distribution questions were still open in the thread, including which build the Linux Flatpak channel will receive.

Community reaction

Forum members pressed on how the two tracks might diverge. One asked whether functionality would effectively split across a grid of free versus premium and open versus commercial, with unclear pricing implications. Another, who runs self-hosted Vaultwarden instances for team projects, asked whether the open source version will keep receiving new features and whether third-party server implementations will continue to work with the protocol. Commenters also invoked recent licensing shifts elsewhere in open source: one described being burned by MinIO's license change and said the episode fits a familiar pattern of gradual retreat from open source, while another pointed to the Coinkite Coldcard situation, arguing that security products whose source is viewable but not freely licensed can lose the community review that catches serious bugs. Several of these questions remained unanswered as the discussion stood.

Why it matters

Bitwarden is one of the most widely used password managers, and open auditability has been central to its reputation among technical users. Today the practical difference between the two builds is zero: same features, same behavior, no action needed. But a case-by-case licensing policy means the open source and commercial versions can drift apart over time, and new capabilities may start appearing only in the build that most users install by default from a store or the official download page.

Users who specifically chose Bitwarden because it was GPLv3 across the board will now need to pay attention to where each binary comes from, and self-hosters and downstream projects will be watching whether feature parity actually holds. More broadly, the move fits a wider trend of open source companies adopting dual licensing to block commercial resellers, and the forum reaction shows exactly how much trust rides on keeping the open side of that bargain genuinely maintained.