SaaS & Software·May 21, 2026

Get your passwords out of Bitwarden while you still can

Article URL: Comments URL: Points: 13 # Comments: 2

Hacker News2 min readSingle source
Get your passwords out of Bitwarden while you still can
Image · Hacker News
The gist
5-point summary · 1 min

Article URL: Comments URL: Points: 13 # Comments: 2

  • It seems I was accidentally on time, as it’s come out over the last few days that Bitwarden is probably going down the drain soon.
  • In February, the company got a new CEO, and in March, it doubled its Premium price, announcing the hike deep in a feature announcement.The new CEO seems to be a bellwether for what’s to come for Bitwarden.
  • He’s a merger and acquisitions guy, with a history of gutting companies and selling them for parts, and changes to Bitwarden’s website also indicate where it’s headed.The phrase “Always free” disappeared from the personal password manager page in mid-April.
  • GRIT now stands for Gratitude, Responsibility, Innovation, and Trust.Inclusion and Transparency are out.
  • This way your passwords are truly yours, and not dependent on someone’s continued commitment to free plans or proprietary services that can unexpectedly change hands.

I was a long-time Bitwarden user, until a year or so ago when I started migrating my passwords first to Firefox/LibreWolf, and recently from there to a KeePass database I can transfer and use with whatever password manager application is compatible with KeePass’ file format. It seems I was accidentally on time, as it’s come out over the last few days that Bitwarden is probably going down the drain soon. In February, the company got a new CEO, and in March, it doubled its Premium price, announcing the hike deep in a feature announcement.The new CEO seems to be a bellwether for what’s to come for Bitwarden. He’s a merger and acquisitions guy, with a history of gutting companies and selling them for parts, and changes to Bitwarden’s website also indicate where it’s headed.The phrase “Always free” disappeared from the personal password manager page in mid-April. It used to sit prominently under the plan selector. The free plan still exists — for now — but the commitment language is gone.And then there’s the values rewrite.Bitwarden used to define its culture with the acronym GRIT: Gratitude, Responsibility, Inclusion, and Transparency. After May 4th, that changed. GRIT now stands for Gratitude, Responsibility, Innovation, and Trust.Inclusion and Transparency are out. Innovation and Trust are in. ↫ Patrick BoydThe “Always free” motto quietly reappeared on the site after its removal was uncovered and went viral on Fedi.The change in CEO, the changes in values, and the removal (and reappearance) of Bitwarden’s well-known and oft-repeated commitment to its free plan have all been quiet. No announcements, no blog posts, no posts on social media – but they did change a four-year old blog post by Bitwarden’s former CEO to change that GRIT acronym. You don’t need to be an honors student to figure out where this is going, and what the new CEO’s plans are for Bitwarden.Do as I did, and get your passwords out of BitWarden. I strongly suggest using an open format that can be used by any compatible password manager, with KeePass’ formats being the obvious choice. This way your passwords are truly yours, and not dependent on someone’s continued commitment to free plans or proprietary services that can unexpectedly change hands. Bitwarden is licensed under the Apache 2.0 license, but with all of the above, one has to wonder how long that’s going to remain a thing.About The Author Thom HolwerdaFollow me on Mastodon @[email protected]

Integrity note  ·  Xela does not rewrite or paraphrase article content. The excerpt above is the source publication's own words, sanitized for display. For the full piece — including any quotes, charts, or images — read it at Hacker News. Xela's rewritten version is off for this story, so there's no editorial angle attached — you're getting the source's reporting unfiltered. When the rewrite is on, we add a What this means block underneath with the operator/trader takeaway.

What people are saying

Discussion

Hot takes

0/280

Loading takes…

Comments

Discussion · 0

Sign in to comment, like, and save articles.

Sign in

Loading comments…

Keep readingSaaS & Software desk
See all in SaaS
Show HN: Draco – A single-binary, self-hostable Firecrawl alternative in Rust
·

Show HN: Draco – A single-binary, self-hostable Firecrawl alternative in Rust

Scraping modern websites has become a massive headache. You basically have two choices: pay for an expensive API like Firecrawl/Browserbase, or run a fleet of headless Chrome instances that eat 1GB of RAM per page and still get blocked by Cloudflare. I built Draco to fix this. It’s a fast, single-binary web scraper written in Rust. You point it at a URL, and it spits out perfectly clean Markdown or structured JSON for LLMs. The secret sauce is that it doesn't just boot a browser for every request. It uses a tiered escalation engine: Tier 1 (Stealth Fetch): Draco uses a custom TLS/JA4 fingerprint to perfectly mimic a real browser's network signature at the packet level. It turns out a lot of anti-bot walls will let you right through if your handshake looks correct. In my benchmarks against sites like Cloudflare and Target, Playwright ate ~500MB of RAM and timed out. Draco bypassed them in under a second using just 20MB of RAM. Tier 2 (V8 Isolate): If it hits a React/Next.js SPA that needs rendering, Draco boots an in-process V8 engine in single-digit milliseconds. It hydrates the DOM and intercepts the hidden JSON APIs the page is calling—giving you the raw data without the overhead of a graphical browser. Tier 3 (Real Browser): If it hits an absolute wall, it seamlessly falls back to detecting and driving a real browser on your machine. I also built in all the tooling to make it a complete drop-in replacement for the hosted services: Daemon Mode: Run draco serve and you get a persistent HTTP server with a Firecrawl-compatible REST API. You can swap out your API keys and self-host immediately. Built-in MCP Server: It natively exposes a Model Context Protocol server so you can plug it directly into Claude Desktop or your AI agents. Web Search: Built-in parallel multi-engine web search (bypassing the need for a Google Search API key). Interact Mode: Drive a page statefully like a devtools console, persisting cookies across navigations(for LLM's mainly). It’s completely open source (MIT/Apache-2.0). I just wanted to put this out there for anyone tired of fighting headless Chromium or paying per-page scraping costs. Grab the binary and throw a difficult URL at it. Note that it's still a WIP so there might be some unexpected breakages of uncommon sites but for the most part its quite capable, it can handle cf-protected sites and heavy SPA's while everything else fails partially or completely while taking longer or more resources. (tested on example.com, hackernews, cloudflare, glassdoor, bluff.com, target.com, stake.com and thrill.com) ┏━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┓ ┃ Rank ┃ Tool ┃ Score ┃ Pass ┃ Avg Time ┃ Avg RAM ┃ ┡━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━╇━━━━━━━━━━╇━━━━━━━━━┩ │ #1 │ Draco │ 769.7 │ 8/8 │ 3.45 │ 216.50 │ │ #2 │ Obscura │ 384.5 │ 4/8 │ 2.68 │ 87.59 │ │ #3 │ BrowserOxide │ 373.4 │ 4/8 │ 6.42 │ 105.95 │ │ #4 │ Playwright │ 342.2 │ 4/8 │ 1.71 │ 535.07 │ │ #5 │ Bouncy │ 196.6 │ 2/8 │ 0.59 │ 19.38 │ └──────┴────────────────┴───────┴──────┴──────────┴─────────┘ Repo: Comments URL: Points: 8 # Comments: 1

Hacker NewsSingle source
Newsletter

Track saas & software every morning.

Daily digest tuned to this beat. The 5 stories most worth your time. Unsubscribe anytime.