Changed E-Mail, now can't login

Hello!

I changed my login-Email to a new one and now the vault (web, app, everywhere) says that my password is incorrect. During the process I did get the code and verified the new Email.

I also did check that I choose the right server and I am getting the “forgot password” hint to the new/changed E-Mail address but it still says that my password is incorrect. This seems like something happened during the process on the Bitwarden end? I am a bit panicking…

Yesterday I performed the same process without any issues. However, I took a backup beforehand because, well, you never know.

It sounds like the change itself has been successful. Are you absolutely sure that you typed the correct password? Does it work on a different device?

Thanks for responding. Yes the password is 100% correct, I type it in several times a day and I tried it on several devices as well. I’m not sure how the password could have changed in the process of changing the login email.

I sadly didn’t make a backup, big mistake I guess. It’s also not the first time I changed my login mail and I didn’t have problems then.

I am already in contact with support but so far the troubleshooting is unsuccessful.

@Strako Welcome to the forum!

I just want to clarify that during the authentication process, the validity of your master password is checked by computing a hash that uses your email address as a salt. Therefore, it is possible that you would get an “incorrect password” error even when entering the correct master password, if the form of the email address used when authenticating is not identical to the form of the email address that was used when computing the authentication hash that is stored in Bitwarden’s servers.

I haven’t done any tests to check if the following scenario is possible, but one hypothesis is that you accidentally entered one or more whitespace characters just after (or before) your new email address when changing your email. The email change form does apparently allow such whitespace characters to be entered, but the login form does not permit the entry of whitespace characters before or after the email address. Therefore, it may be possible that the new master password hash (kept on the servers for authentication purposes) was computed using a version of the new email address that included a trailing or leading whitespace — if this is the case, you will never be able to successfully authenticate using any Bitwarden app or extension.

If it has been less than 7 days since the email address change, I would strongly advise you to reach out to the Support team and request that your account be restored from a Bitwarden’s PITR data. After 7 days, your vault access will be lost forever.

3 Likes

I made a short test of this hypothesis with a freshly created account. After changing the address to a new one with a leading whitespace, I was able to login without any issues.

That said, it may be something different like a swallowed line wrap, non-printable characters, …

3 Likes

Thank you so much for the response. That would be quite the bug or oversight, since I was able to authenticate the new e-mail address with the sent code. Support confirmed my new login email as well so this is all really strange.

I will contact them regarding restoration and hopefully support will be forthcoming.

edit: I already made a new bitwarden account and changed my most sensible account passwords, just in case. But it would of course be nice to get all my vault back.

2 Likes

Seems like, sadly, my vault is gone as support can’t restore it. (as it’s not a disaster recovery)

Hopefully they can delete my account and remove me from premium. I don’t want my data floating around, even if encrypted.

Will be a good lesson to make a backup from time to time but also be more cautious with forms. Still, I think this shouldn’t have happened and I think the error happened on bitwardens end somewhere - either with the form fields or the comparison and validation of data.

I hope the issue gets escalated and looked into.

@Strako

When the email still works – and you wrote you get the password hint – you could do this yourself: Delete an Account or Organization | Bitwarden

Hm. Maybe in vain and not much left, but you could also go through that entire list here: [Guide] "I can't login" - Some tips for login problems/issues and maybe there is an idea…

Did you also restart your router and/or change to cellular (on a phone), in case it’s something about your IP being blocked? Did you also try to delete cache in you browser (regarding the web vault) and/or try it on a new browser – and/or deinstall any of the BW apps, delete the local data and reinstall it?

If you didn’t receive the master password hint, I would also think of a typo in the email address. You didn’t use any alias for that email for your Bitwarden account? (because then you would receive the emails, but couldn’t login to Bitwarden)

And yeah, next time: regular exports/backups – especially before those kind of changes – and emergency sheets.

It does seem to me that this is a situation in which there could have been data corruption on Bitwarden’s end (which should qualify you for a PITR restore).

The evidence for this is the fact that you did not change your master password when changing your email, the fact that you use(d) your master password daily (making a memory failure unlikely), and that the new email address appears to be correctly captured in the server database.

@dwbit Are you able to intervene on behalf of OP?

Hi @Strako if you haven’t already, please contact the official support team using the form in the right sidebar at: Help Center | Bitwarden

 

@dwbit It seems that @Strako has already been in touch with the Support Team, and they have indicated that they are unwilling to restore his vault from the PITR backups. However, as described in my comment above, I believe that the cause of the issue may be a back-end corruption, in which case the OP should be eligible for data recovery (at least this has been the practice previously). Are you able to escalate this matter?

1 Like

I am indeed in contact with support (account e-mail is a different than this forum account here) already and @grb is correct.

I already told my partner to leave the premium/organization of my now inaccessible account in any case something happens. I already made a new bitwarden account as well, restoring passwords for the past two days. I can not imagine what disaster it would have been if I had used bitwarden’s two factor service as well - I would not be able to restore passwords at all.

Did you by any chance setup emergency access for your partner? That would be another solution to recover your vault.

I got further requests from support and a follow up to that, but I don’t think they understand the issue completely as - and by no means I am blaming support here as they can only do so much - they seemed to think it is a network problem upon login and the issue is related to the password being entered.

And I absolutely blame myself for not taking security measurements before making changes to the account login/e-mail, but I am still a bit frustrated.

Honestly, I am looking into different password services right now, even if my partner for sure does not want to make the move to a new service again (after the lastpass disaster).

Silly idea as some things you wrote speak against it, but did you try to login with the old email address as well? (hypothesis: maybe the email was never changed)

Understandable. And you can consider that. But I would also consider this:

  1. Such problems/issues can happen with any service.

  2. The measures to prevent this (1. regular backups/exports, 2. make a current export before exerting any serious change like changing the email/master password etc., 3. create emergency sheets) are the way to go with any service.

Honestly, I have no clue if they can “see” if there would be a technical issue on their side. If they could, then I would see that as a sign from them, that it must be something else. And if that would be the case, I personally would again check if it is indeed the correct email address and master password you are using (no typo, not a different one than you thought etc. …).

The E-Mail got changed to the new one, confirmed by support even plus I am getting the master password hint to the new E-Mail. It’s just that the master password does not work anymore.

Even if not, there would be no harm in reverting and restoring my account to the state of a few days back.

Aye, lesson learned the hard way :slight_smile:

Yes, but did you actually try to login with the old address anyway?

Honestly, I am looking into different password services right now, even if my partner for sure does not want to make the move to a new service again (after the lastpass disaster).

Of course that is your choice, but I doubt the community would be as nice as here. :innocent:

And more serious: Did you see my question regarding the emergency access? When I made an evaluation of password managers a year ago, Bitwarden was the only one providing such a service.

1 Like

Of course, even if it doesn’t make any sense :wink:

The community is very nice and helpful indeed.
It’s one of those things that happened sadly - we always meant to set it up and was one reason to go premium - but ultimately forgot, that’s life sadly. Again, not blaming anyone for my stupid mistakes regarding security precautions.

Not sure how attributing the issue to a network problem would make any sense. You can refute this by using two tabs in the same browser to simultaneously log in to your account and your partner’s account.

Is the Support rep aware of the discussion in this thread? @dwbit mentioned that he was going to link the thread to your support ticket, but if they have not already confirmed that they have read this information, it may be worthwhile sending them a link. You could mention that one of the senior forum moderators (moi) believes that the issue might be due to back-end corruption of the master password hash, as explained here.

Further, I would suggest asking them if they are able to review the PITR transactions for your account and check how many times there were changes to the stored master password hash and protected user key in the past seven days. If there was only one such update each to these two database entries, coinciding with the date and time that your email address was changed, then your master password should be the same now as it was before the email address change; conversely, if there was more than one update to the master password hash and protected user key, then this would be evidence that your master password has been changed in the last 7 days (and Support should be able to give you a timestamp of when this happened).

 

This is not necessarily a valid assumption. First, understand that restoring a backup is not a simple operation. Bitwarden does not keep any backup copies of the state of your vault from a few days back; the only thing they have available is a log of database transactions going back 7 days. Thus, they would be able to see that at 1:23pm on 9/26/2025, the database field X associated with user account Y was changed from value Z to a new value; they would have to sift through the logs to find all entries associated with your user account, and then “undo” each transaction one-by-one, starting from the end and working backwards.

The “harm” in doing such a recovery is two-fold:

  1. The time and effort needed to complete this process is not insignificant, and employee time is valuable.
  2. There is a risk that the recovery process could be exploited by an attacker (for example, if you changed your master password because it was weak or leaked, an attacker may be able to compromise your vault if they can impersonate you and convince the Support team to restore your old master password).

Both of the above risks/costs will increase the more frequently that a database recovery is done, so it makes sense that there should be some barriers to initiating a recovery process.

I see, thanks for the detailed explanation.

In the end all of this causes more frustration for everyone I think and the “solution” would be to cancel the premium membership for that account even if I lose some months of membership, and delete that account (as I understand, one single person is not allowed to own multiple free bitwarden accounts), if even possible. That way I can at least be a little bit relieved.

I linked this thread, yes. I do feel a little ignored, since the support responses can be summarized with “you are entering the wrong password” and “we have no insight to user data” (but they could confirm my new e-mail/login…)