Add "Unlock with Device" (i.e. with another BW client)

I think another option is to set the vault timeout action to Log out instead of Lock.

I find it so odd that “unlock with device” is missing.
My guess is that it would be easy to do with just the existing code, so it must have been intentionally left out but I can’t think why?
Login with device transfers the accounts master key and I can’t see any reason why this key can’t be used to unlock the client.

1 Like

This, yes please, this! As I use my personal Bitwarden vault at work (despite me proposing they roll it out in their corporate environment), this option would prevent me having to type my master password into a work computer that is potentially monitored. Having to log out and log in to unlock my vault with my device is just clunky.

1 Like

You are right, we can just
Goto Settings → Vault timeout action → tick “log out”
tick “remember email”, then click “continue” to login
click “log in with device”

The issue with “login with device” is that if you have login 2FA enabled, you would need to either disable it or deal with it every time you want your vault unlocked. Not exactly solving the problem of easily unlocking your vault.

2 Likes

@bw-admin Any progress on this feature? It is really needed by your users!

Just finally made the switch from “no password manager” to Bitwarden and I really miss this.

One more use case:

I run a PWA using Chrome in a Windows VM on my M1 mac, this is so that I have consistent keyboard shortcuts in all my environments, e.g. win/linux/mac

But Chrome in Windows has no access to the fingerprint sensor of the M1. Having this will effectively allow the Windows Chrome to have biometric unlocking abilities, i.e. Chrome extension fires a request to the server which forwards it to the M1 BW app, popping up the prompt for the fingerprint

@bw-admin Any news? I created an account just to upvote this but apparently don’t have votes yet anyway. It’s been over a year and it’s not clear if this is planned or denied or what? Can you let us know please?

I also long for this feature.

I understand there are clear differences between logging in and unlocking:

  • Login:
    • Downloading data from the remote.
    • Requires online authentication.
    • Can log in using other devices since it is online.
  • Unlock:
    • Basically uses local data.
    • Can be unlocked offline.
    • Unlocks via offline-compatible methods (master password or biometric authentication).

However, for devices that do not support biometric authentication, or even if they do but are connected via remote desktop, it is necessary to enter the master password. Setting the action on timeout to log out allows logging in on other devices each time, but this requires being online constantly, which poses risks. Considering offline scenarios, it is preferable to lock each time, but this limits unlocking options.

When unlocking, is it possible to change the feature to allow to TRY unlocking it on another device?

(If online) I have gotten used to logging out and then logging in once, but since it is a daily operation rather than an occasional one, I truly hope for simplification…

My Bitwarden master password is VERY long.
I work with a computer 99% of the time and constantly need to unlock (not re-login) my Vault.

The Microsoft Hello solution is not a viable solutions here, however, being able to unlock it with my iPhone biometrics would be awesome. You already do it for LOG-IN, why not Unlock vault ? This is a feature that will be constantly used: were talking about authentication, day to day action, not a random hidden option in the app.

Please can you consider adding this feature ?

Thank you

3 Likes

I’m waiting for this feature also (if it become one).

My password is too long for me to have to type it every time I need to use my vault (many times per day). Right now, i’m using the auto logout to be able to use my phone to login without password. This come with inconvenience also, as not being able to use my vault while offline. Because I’m frequently using trains, I’m constantly loosing internet connection and often finding myself without my vault on my computer.

Being able to unlock my vault with my phone would be much simpler. Allowing me to get in my vault with my password when I lose my internet connection. It should be possible to enable or unable the button “Unlock with device” if there is an internet connection or not.

Sadly, without stable internet connection, you could only be using pin or biometric to unlock your vault on your computer even if “unlocking with a device” feature is implemented.

With “logging in with a device”, your computer sends a request to Bitwarden’s server, which then communicates with your phone to approve the login. Once approved, the server sends encrypted keys and hashes back to your computer for decryption and vault access. This process relies on a stable internet connection for both devices. You can refer to the whole process here in documentation: Log In With Device | Bitwarden

Since the above authorization process requires internet connection for both your phone and computer, implementing “unlocking with a device” would be basically the same.

Personally, I want “unlocking with a device” feature, but it would likely generate many more server requests than logins, as unlocking is a frequent action. This could explain why Bitwarden prioritizes this feature for logins (less frequent, especially with biometrics) rather than unlocking.

Welcome, @cken to the community!

Given that Bitwarden does not pretend to be an off-line password manger, I don’t think this a serious limitation.

Off-line use of Bitwarden (in read-only mode) is officially supported, so potential compatibility issues with “unlock with device” while off-line seem like a legitimate concern.

I was thinking the opposite. Since 99% of the users will be using it online 99% of the time, I don’t see off-line use as a reason to avoid developing unlock with device.

As @cken mentions, pin, biometric and master password presumably still would work so I am curious as to what compatibility issue one might envision.

My take on Bitwarden’s offline support is that it really is for border cases, (server/ISP maintenance, field work, etc.) due to being very limited (read-only, must already be logged in). Fundamentally, Bitwarden really wants one to be online, as contrasted with KeepassXC, which is truly a offline password manager.

I wasn’t suggesting anything like that (not developing the feature), and I don’t believe that @cken was making such a suggestion either. It seems that @cken was just pointing out (and lamenting) that “unlock with device” would not work to unlock an off-line device. Personally, I wouldn’t even take that assumption as a given — it may be possible to develop an “unlock with device” feature that also works for off-line use.

Just wanted to mention that Remote Desktop is another use-case for this FR.

One can not use Biometrics “through” remote desktop; this FR would work around this limitation.

I wonder if this feature can work offline with the PC acting as the server and phone as a Bluetooth passkey.

A naive example flow:

  • Bitwarden on desktop generates a QR
  • User scans the QR with their phone
  • Bitwarden on phone opens and prompts
  • User approves with biometric auth
  • Bitwarden on desktop is unlocked

This is similar to how I login to my iCloud on Edge. The browser asks me to choose a passkey, I select mobile device, it shows a QR, the QR has enough info for my phone to connect via Bluetooth, so when I scan it, the phone pairs with the PC and the two devices now have a channel to transfer data. I don’t know what exactly they exchange, but the feature only works with Bluetooth enabled, so I assume they can talk to each other directly.

As long as a channel can be opened without Internet in a standards-compliant way, Bitwarden can, in theory, send the encrypted master key to the phone and get back the decrypted one totally offline.

1 Like

And I wonder, if that would still be “Unlock with device” (in a more narrow sense) – or if that wouldn’t be this other feature request then: Unlock with FIDO2/“passkeys” :thinking:

Totally fair!

Since the other request already seems to cover using the device as a passkey in an offline manner (e.g., using Bluetooth or USB), the scope of this one can be pretty specific to online unlock with push notifications like OP described.

Maybe a rename could help clear things up? At face value, “Unlock with device” sounds broad enough to cover the other request.