Master Password not working on webapp, chrome extension (macbook), and Iphone

Hello,

I’m having trouble logging in with my master password on the webapp, chrome extension (macbook), and the app on my Iphone. I’ve already validated the following:

  • Using the correct email
  • Using the correct BW server
  • Using the correct master password

I have my password written down on paper and no matter how many times I try, I get an incorrect email and password error during login.

What other options do I have?

Before you do anything else, if you have a device(s) that might have the vault logged in, disconnect it from the Internet (put it in airplane mode, unplug its network cable, etc). Only after that is done and you confirm that you can not access the Internet with a web browser, check if you can access your vault. If you can, export your vault (password protected or unencrypted are both OK, but do NOT use account restricted). Having a current backup will keep things from getting worse and will dramatically reduce your stress level.

After that,

I actually made the situation worse before making this post b/c I was logged into my vault via the chrome extension but I cleared cache and cookies which logged me out so I no longer have access on any devices.

I tried logging into my vault on other devices, on web app, app itself, extension, phone app, and get the same results… I did not change my password ever. Re-installing the extension and app didn’t work either.

I’ll re-try all the troubleshooting steps again just in case but this is not looking good =/

Focus first on restoring access to the the web vault as it has the fewest dependencies on your device.

You might also contact [email protected] and ask them to check that your IP address has not been blacklisted. You can find your public IP by going to https://whatismyip.com (amongst other sites).

For those who might stumble on this thread (OP already knows this): at the first sign of trouble, the very first thing you ought to do is to create a new backup without destroying the old one.

@Jimmy_Nguyen Welcome to the forum!

If you cannot access the Web Vault app (vault.bitwarden.com or vault.bitwarden.eu) from any browser on any device (you should try many different combinations), then there are only three possible explanations:

  1. What you have claimed above is not accurate. For example, perhaps you changed your master password and did not update what’s written on your piece of paper.
  2. Someone has obtained your master password and 2FA, and then taken over your Bitwarden account (including changing the master password). If this is the case, you are likely to have noticed other signs of trouble.
  3. There has been some technical glitch that has caused the authentication data (master password hash) stored on Bitwarden’s servers to become corrupted, preventing you from successfully authentication.

When was the last time that you successfully completed a login using the master password written on your piece of paper? And by “login”, I don’t mean “unlock” — I’m only asking about the full login process, which typically requires you to enter you email address, press Continue, enter your master password, press Log in with master password, and then provide your 2FA when prompted. When did you do this last and were successful?

Regardless, you should contact Bitwraden Customer Support a.s.a.p. and let them know your situation. If the problem was caused by server-side corruption, and if it has been less than 7 days before the corruption occurred, then Bitwarden should be able to restore your account data to a point in time prior to the corruption of your authentication data.

Time is of the essence, because Bitwarden only retains backup data for 7 days.

I haven’t changed my password before and I was able to confirm with BW support that no changes were made to my password so that rules out 1 & 2 for me.

Unfortunately, it’s been over a month since I completed a login since I’ve been using the chrome extension and had the setting to only sign out if I close my browser. I’m now kicking myself for doing this…

Has option 3 ever happened before? I didn’t know this was even possible.

Anyways, I’m going to keep playing around with the password and hopefully I’m just making some stupid mistake…

You might also check your email account for messages from Bitwarden. At a minimum, there should be “good” ones from when you first signed up and logged in. These can help validate that you used the login-email you think you did, and they can also tell you if you are using the eu or the com vault, based on where the email was sent from. You should also be pay attention to any recent messages that may be “bad” or “suspicious”.

You can try creating a new account using the email and vault eu/com you think you used. If you guess right, it will fail saying “already exists”.

Maybe press “capslock” to see if you actually set your password to the “opposite” of what you think it is. Maybe substitute ones with ells, zeros with ohs, etc. to see if maybe you wrote it down unclearly. Try also capitalizing the letter after a case-transition. (e.g Password1 vs PAssword1) to see if it was typed incorrectly in the first place.

Do you have MFA set up? Is it blowing up on the password or the MFA?

It might be helpful to post a screenshot of the page immediately before the error and also the error itself, of course blurring any identifiable information. Maybe someone will notice a pesky detail.

Did you set up emergency access? If so, that could be your white knight.

You might try uninstalling one of the local apps/extensions, removing any local storage, rebooting and reinstalling the app to see if there is some sort of corruption (this would not explain a web-vault issue, though).

Have you ever backed-up/exported and maybe stashed a copy somewhere?

When you migrated to Bitwarden, did you keep the exports from the predecessor, or do you maybe still have the predecessor laying around awaiting a fresh export?

I hesitate to throw up artificial blinders when troubleshooting. Additional admittedly rare possibilities:

  1. IP being blacklisted on the Bitwarden side (support can check) or firewalling on corporate devices.
  2. Someone could have gotten access to the registered email and deleted the vault without ever knowing vault creds.
  3. Some sort of version mis-match problem, like we often see when Vaultwarden (a 3rd party thing) is involved.

In a way, the crowd-strike issue of a few months back was an example. Have there been large scale instances of it with Bitwarden? I do not believe so, given that they would have lit-up both this community and reddit with questions/complaints.

Yup, I validated that I have a BW welcome email on the email account I’m using to log in.


screen before the issue occurs on the password


Error message

Additional to all other answers: the most simple explanation would be that indeed either the username or password really are incorrect. Since you seem to have verified the email address (and obviously then didn’t change that either), I would take a look at your master password again.

I would check again if there are any ambiguous characters in your master password on your emergency sheet, like the usual

  • l (small “L”) and I (big “i”)
  • ’ ` ´ are not the same
  • I personally often can’t distinguish ; (semicolon) and i (small letter) in my own handwriting
  • same as above goes for my ( (round bracket) and C (letter)
  • 0 (zero) and O (big letter “o”)
  • personally, because I don’t use them that often on my keyboard, I usually never know if I write > or < (same key on my German keyboard, one with pressing shift, one without pressing shift) when I can’t see it immediately
  • s (letter) and 5 (number)
  • etc

… and try all possible combinations…

Of course, if you have a passphrase = words (with separators), this might unfortunately not be a helpful suggestion at all.

OMG… I’m an idiot… I had spaces between all of the words in my password… I’m BACK IN!!! THANK YOU SO MUCH FOR ALL OF YOUR HELP!!!

I’m going to go create a backup export vault next…

3 Likes

Glad to hear that you figured out the mistake you were making.

In addition to creating a password-protected JSON export as a backup, please create an Emergency Sheet that contains the following:

In addition, you might consider using a word separator other than a space character, if you can’t tell from your written-down master password that there were spaces between the words.

To create a password-protected JSON export (as a backup for your vault contents), go to Tools > Export Vault , select .json (Encrypted) for the file format, select Password-Protected for the export type, enter or generate a file password, click Confirm Format, enter your master password and click Export Vault. If your vault contains any file attachments, then these would have to be individually downloaded (file attachments are not included in the export).

1 Like

… I guess a note behind the master password (like spaces as separators!) would also do the trick. :wink:

1 Like

Thanks for letting us know you figured it out. Always like it when there is good news to share!

Nothing wrong with spaces especially for us touch-typists, but yea, they can be invisible. It’s not the most popular opinion, but the “master copy” of my Emergency sheet is electronic (kept on my off-line USB) with things like emails and passwords copy-pasted in a monospace font so that I am sure there are no typos or unclear handwriting. I then keep an up-to-date printed copy just incase I somehow get locked out of the USB.

One (small) thing to celebrate here is that you have learned to appreciate backups, which generally takes experiencing data loss, without actually losing anything. I’m jealous in that respect.

1 Like