Add an option for an item to require the master password to be entered again before it can be viewed/used.
GitHub issues:
One of the things for paranoid people. It rarely happens that I leave any device with bitwarden unlocked, but mistake can happen. I certainly would enable this option for some critical passwords.
On mobile devices, an additional option to require ‘fingerprint unlock’ would be nice, allowing user can choose if only master password is a must, or a fingerprint will do.
22 Likes
Good points, @eskela. I tend to set to re-prompt the master password for items with sensitive (banking/financing) data, for example. Credit cards, bank accounts and so on.
It’s also a good idea to re-prompt the master password with a fingerprint reader anywhere (desktop/mobile/browser).
Optionally to just ask for the fingerprint instead of the master password. (Which is a feature I’ll ask for very soon, attaching to this answer, probably. If it’s not already possible, of course.)
My votes are over (not sure if I’ll be able to vote again tomorrow), so it is a must for me. +1 for this.
EDIT: I’ve just read the pinned post on the main page. I’ll try to make better use of my votes next time.
EDIT2: Here’s the discussion I talked about unlocking the vault/items with the fingerprint.
3 Likes
A PIN could also be an option (on mobile the app locking PIN/fingerprint would also do the trick). My master password is so long that I would hate to input that for some login but I would be fine with a shorter PIN or just giving it the finger.
14 Likes
this is a must for me!
currently still using lastpass and would love to move to bitwarden due to security reasons
re-prompting is very important to me due to some times letting someone else use my browser etc at work/home with friends. really sensitive information needs to be prompted for a password again
5 Likes
+1 I’d really like this feature please
2 Likes
any news on this?
1 Like
This is the only missing feature that prevents me from switching to Bitwarden
9 Likes
Agreed, retyping the password to view it (as opposed to automatic login for web sites which can be transparent) is an essential security feature that Chrome password management does by default.
this is literally the only feature that prevents me from switching to Bitwarden
i just tried to use it again, everything is so much better than competitors, but…no prompt made me purge my vault right away
7 Likes
I moved over to Bitwarden from LastPass, and I like so many things about Bitwarden , but this is something I miss.
Hopefully this will be added soon.
2 Likes
As a few others have said, this is basically what is preventing me from moving over to Bitwarden from LastPass.
5 Likes
Hello, do we have any updates on this critical feature request? I feel like this is a major glaring problem that needs to be addressed before people can confidently move from lastpass or other competing tools.
Thank you!
6 Likes
I would like to vote on this feature. It something that gives additional feeling of safety for more critical or sensitive data.
1 I’d really like this feature please 
TIL LastPass doesn’t actually further encrypt the items, and a hacker who knew how LastPass works could get the item contents from memory. Their feature only protects from an attacker using mouse to try and open the item.
If Bitwarden were to implement it, we’d want the extra layer of encryption, so here’s an idea:
- During item creation / item editing, have a checkbox that says “Require Master Password to open”
- When you click that checkbox, a box popup asking for master password appears.
- Once given the master password, iterate the hashes to reconstruct the key and keyHash. Compare with the one in cryptoService and if not the same, show an error, and drop them back into the edit/create screen with the checkbox unchecked. (They could have made other changes they haven’t saved yet, so don’t kick them out)
- However, if it matches, then perform the same iterations and algorithm on the master password again, only this time add the item’s unique identifier in front of the email and the master password before passing them to the hash iterations.
- Use this key to encrypt the item, and then encrypt it with the normal key (the contents of the Protected key)… two layers of decryption needed to access.
So even if the decryption key to decrypt the protected key is in memory (aka someone left it unlocked) those items are encrypted by a key generated in the same way as the decryption key but instead with the item UUID appended so as to make the key unique to the item and dependent on the master password and email similar to the way the key material for the first layer is dependent.
Password change process would require some extra work to decrypt/re-encrypt all the “protected” items though…
Or maybe it would be easier to just make a second protected key encrypted with some extra data mixed in the iterative hashes. (ie. “SecondLayerProtect” appended or something…) and never store that second key anywhere, always discard it after decrypting the item.
5 Likes
Someone using the mouse is precisely the type of attack I am worried about the most, though. Even if it’s just “security by obscurity” it will protect against the by far biggest risk - someone forgetting to lock their computer when going to the bathroom or intentionally lend their computer to someone who “just wants to check their email”, not remembering that their credit card details are just a couple of clicks away behind the Bitwarden icon.
Maybe the card thief hadn’t even intended to steal it, they just stumbled upon the CC details after clicking the Bitwarden icon on a friend’s or relative’s computer and took the opportunity because it was just sitting there in front of their eyes in clear text and no one was watching.
It would be stupid to hold off on preventing 99+% of the real world attacks just to protect against that hypothetical professional hacker who specifically targeted someone’s Bitwarden. Not saying that that isn’t also important to prevent, though, just that the hunt for perfect protection shouldn’t block the implementation of a much simpler “enter password to reveal”.
7 Likes
I need this too.
I use Bitwarden on a familly shared computer and when safebox is lock, I can’t use it.
When it’s unlock, all my familly can see all my passwords. 
2 Likes
I just voted for this feature too. Currently using Lastpass and I am sick of their stupid bugs they never fix. This is one of the nice features they have and I am looking to switch my personal and our Enterprise accounts to Bitwarden. So far Bitwarden is looking very promising and you guys are are way above the competition!! Looking forward to new features!
5 Likes
Why not use your own account on the computer?
1 Like