Security: end-to-end encryption, but master password entered in web form

[sugianto]

@stsc

So you’re saying that with Bitwarden, the master password is not even once sent to the server while registering for an account via website and form, but that the Javascript already uses the KDF and only sends the derived value (and that JavaScript code can obviously be reviewed, and the traffic checked, as Davidz did)?

Yes, the master password never leaves your device, including the registration process.