Vault flagging 12-char random password as "Vulnerable" – Manual HIBP API check is clean

Bitwarden uses the zxcvbn algorithm to rate password strength. The algorithm looks for common words and passwords, as well as known patterns and transformations (“l337” substitutions, keyboard walks, etc.). When it cannot identify a dictionary word or pattern, it makes the very conservative estimate that a brute-force guessing scheme would only need to test a pool of 10 characters, which for true random passwords will significantly underestimate the strength. For example, the zxcvbn algorithm will consider the passwords a#*Sk3,hTI%x and 676493826432 to have equal strength.

It is also possible that your randomly generate password by coincidence includes some known common password pattern (e.g., a number sequency that looks like a year, a repeated sequence, a keyboard walk, etc.).

In the end, it is likely that this is a false positive, which could only be addressed by (unnecessarily) changing the password, or by voting for the following feature request:

 

If you do decide to change the password (just to get rid of the annoying warning banner), then you could share the old password here, for further post mortem analysis.