Locked out on mobile devices

You might get away with a Unicode password if you are sticking to a single OS/Browser, but things will rapidly go haywire if you use multiple operating systems or browsers.

A huge complication with Unicode is that it has many encoding schemes and multiple ways of composing characters, each of which can make the in-memory representation of a Unicode string different. A string encoded in UTF-8 will not look the same in-memory as the same string encoded in UTF-16. Since password algorithms are using the “in memory” representation as input to an encryption method, everything breaks down if different encodings are used when typing the password. And, since there is no single “standard” normalization process, things most often fall apart when you are using multiple devices.

This is not just a Bitwarden bug (although they could do more to mitigate the impact, as you suggested). It can impact any password, not just Bitwarden’s, so even if Bitwarden were to somehow “fix” it, you still would be bitten by the problem on some random website.

As you discovered, the safest approach is to stick with the original 95-character ASCII set (or less, as the Bitwarden generator does) so that you avoid this whole mess. If you want a stronger password, the safer approach is to increase length and/or randomness.

Another lesson to take from this is that changing Master Passwords, encryption, and anything else that touches your whole vault at once is a risky activity and should be preceded by first creating an export of your vault so you have something to fall back on if things had gone even more haywire.

1 Like