Password denied (wasn't wrong); Authenticator App choice not given

suddenly web version rejects password, saying it’s wrong. It’s not, I copied and pasted from desktop doc. Unable to access through mobile, same error.

then suddenly I am able to access with Authenticator app (Android) so I set a passcode. Now doesn’t give me option of authenticator app or passcode.

Nothing changed on my end.

Your post is very difficult to decipher, so you will have to provide additional clarification.

Are you referring to the Bitwarden Password Manager Web app (“web vault”)? If so, did you access it via vault.bitwarden.com or vault.bitwarden.eu?

Are you referring to the Bitwarden Password Manager Android app? If so, did you correctly select the server (bitwarden.com or bitwarden.eu) on the login screen (see screenshot below)?

 

What were you able to access using your authenticator app? Authenticator apps only provide TOTP verification codes to be used after you have entered a correct username and password, so no authenticator app will help you log in to a Bitwarden Password Manager app if you do not have the correct password (or server region).

What do you mean by “passcode”? Did you enable “Unlock with PIN” in the Bitwarden app? Please clarify.

What doesn’t give you those options? At what part of the authentication process were you expecting to see those options?

Thank you for your polite response. I was attempting to not ramble, and instead I used too few words.

My answers:
I use to access through Bitwarden Password Manager Web app (“web vault”) via vault.bitwarden. com Even though I copied and pasted the same password I copy and pasted previously, now I get the error message: Invalid master password. Confirm your email is correct and your account was created on vault. bitwarden. com. (I’ve added spaces because it keeps making these hyperlinks*)*

On the Bitwarden Password Manager Android app, I verified that Bitwarden .com is selected.

Last week, when logging into the app, it gave me a prompt to check the authenticator app. So if what you are saying is true ”Authenticator apps only provide TOTP verification codes to be used after you have entered a correct username and password”, then last week the app accepted my password and asked for a TOTP.

I enabled “Unlock with Pin” in the app and have been able to use that pin until tonight.

Now the vault and Android app are both rejecting my password and the app no longer offers me the “log in with pin” option.

Thanks for the additional information, which clarifies a few things, although some details remain unclear for me.

If I have understood the timeline correctly, the sequence of events would have been something like this (please confirm!):

  • Last week, you successfully logged in to “the app” (by which I assume you mean the Android app; please correct if I am wrong), by first entering your username, then copying and pasting your master password, and finally entering a TOTP verification code that you obtained from your authenticator.
  • At that time (last week), after successfully logging in, you enabled “Unlock with PIN” for the Android app.
  • You were able to unlock the Android app using your PIN until tonight.
  • Since then, you are unable to log in to your Bitwarden account on the Android app.
  • You are also unable to log in to your Bitwarden account on the Web Vault, but it is unclear when that problem started relative to the events described above.

Please confirm that the above is an accurate summary, and correct any details that need correcting.


Some additional questions I have are:

  • On what device are you accessing the Web Vault? Also on your Android device?
  • Where are you copying the login password from? Do you have a copy stored on your Android device (and also on any other device where you are accessing the Web Vault)?
  • Does your password contain any special characters that are quotation marks or non-ASCII Unicode characters (e.g., emojis or non-latin characters such as pictograms)?
  • Did you ever register a Bitwarden account on the EU server (bitwarden.eu)?
  • Do you have more than one email account, or do you ever use email addresses with “plus addressing” (e.g., myaccount+extratext@gmail.com)

es, timeline is correct. I lost the ability to log into the Web Vault 2 weeks ago and was using only the android app.

Additional answers:
Accessing web vault on desktop PC and through app on Android.

I have my password stored on a doc in Notepad on my desktop/cloud which can also be accessed by my Android (through the cloud)

Only one common special character; no emojis or non-ASCII etc.

Never used EU server. Tested that as well to make sure.

Only one email account, although I have an emergency email contact in the vault, but can’t access with that either.

OK, so you were logging in to the Web Vault from your desktop PC (by copy/pasting the master password, and then entering a TOTP verification code from your Authenticator app) until 2 weeks ago, and then a week later (“last week” you did the same on your Android app (logging in to the app by copy/pasting the master password, and then entering a TOTP verification code from your Authenticator app). And then, after another week (tonight), you were no longer able to log in on either the Android app or the desktop PC Web Vault.

When you say that you “lost the ability to log into the Web Vault 2 weeks ago”, were you seeing the error message “ⓧ Invalid master password. Confirm your email is correct and your account was created on vault.bitwarden.com” at that time, or was there a different problem (for example, the authenticator verification was not accepted)?

It does not seem possible that you would get an “invalid master password” error in the Web Vault and subsequently completed a successful login on the Android app using the same password (copy/pasted from the exact same cloud document). The only way this would be possible would be if you entered the wrong username and/or selected the wrong server (.com/.eu) on the Web Vault login form.

What do you mean by “can’t access with that either”? What steps did you take to attempt access, and what happened?

Finally, it appears that you have two separate Bitwarden accounts — your main account, as well as a second account used as an Emergency Access contact for the first account. Is it possible that you mixed up the master passwords for the two accounts?

es, I’ve been seeing that error message right after changing the master password. I was able to see the password in Bitwardend and verify before I closed my computer. Afterwards Bitwarden doesn’t accept my old or new password.

I followed this article when I had access: Log In With Emergency Access | Bitwarden but no help. I have attempted all passwords.

Regardless of why I can’t log in with my known password, it doesn’t make sense why I was able to use the pin until tonight and why it doesn’t even provide me with that login page.

Thanks for all your help I just requested to delete the account. If my account was someone hacked, they can’t download the hundreds of passwords without the master password, and since I can’t access it at all anymore, it has no value.

@merlin23 OK, if I had known before that the problems started right after you did a master password change, that would certainly have helped with troubleshooting (although it still doesn’t seem possible that you would be unable to access your web vault, but still be able to use one of the master passwords to successfully log in to your Android app one week later). But this is all water under the bridge now…

You should be aware that there is an important distinction between “unlocking” your vault and “logging in” (and likewise, between “locking” and “logging out”). Typically, the mobile apps, desktop apps, and browser extensions remain logged in when you close and restart the app (or browser) — unless you have configured the “Vault Timeout Action” to be “Log out” (instead of “Lock”) in the app/extension Settings. You would then access your vault by unlocking it, which only requires the entry of either a PIN (if you enabled “Unlock with PIN”), or fingerprint/face scan (if you enabled “Unlock with biometrics”), or master password — for unlocking, you never need to enter your email address or provide two-factor authentication (such as TOTP codes generated by an authenticator). The browser extensions and mobile or desktop apps can remain in this logged in state for years (until you deliberately choose to log out the account instead of locking it or simply closing the app or browser), so there is a real risk of forgetting one’s master password, especially if using PIN or biometric unlock, or if unlocking with master password only at infrequent intervals. On the other hand it is also possible for these apps and extensions to become spontaneously logged out without warning under various circumstances.

In contrast to what I’ve described above, the Web Vault will always become logged out (not just locked) when you restart the browser; this is true even if the “Vault Timeout Action” has been set to “Lock” in the Web Vault Settings. Thus, when you restart a browser and try to access the Web Vault, you will typically need to enter your username, master password and two-factor authentication (such as TOTP codes generated by an authenticator).

It seems that one of the things that started the problems for you is the fact that when you change your master password, all of your previously logged-in apps and browser extensions are forcibly logged out. When this happens, any PINs/passcodes that you may have set up previously for unlocking will immediately stop working, and you will need to use the (new) master password and two-factor authentication to log back in. It is possible for things to go wrong at this stage (for example, you may have transcribed the new master password incorrectly; alternatively, on rare occasions, a technical glitch may cause your new master password to immediately stop working). For this reason, it is advisable to create a vault export as a backup before changing your master password.