Bitwarden removes MFA security from the password manager and launches an authenticator app. The app creates a unique and temporary login key for web services that support MFA.

MFA functionalities were already available for paying users of the password manager. Bitwarden believes that everyone should have access to MFA security and is now providing these features in a separate application. Bitwarden Authenticator has been available for Android and iOS since May 1st.

Unique and temporary keys

Bitwarden’s authentication app works more or less like alternatives from Google and Microsoft. You add online accounts you want to protect with MFA manually in the application or by scanning a QR code in Settings. This is only possible for sites that support MFA, although many sites do this these days.

The next time you log in, you can use the app to create a login key. This is unique for each login attempt and is only valid temporarily. The login key is saved on your device and must be entered manually on the login page. Codes cannot be intercepted this way the man in the middle-attack. According to Bitwarden, this method eliminates the key limitations of classic MFA enforcement.

Bitwarden will gradually add more functionality to the authentication app. In the announcement blog it also reveals a roadmap for the further development of the application.

MFA serves as a supplement to a password, but in the long term Bitwarden wants to make passwords completely unnecessary. For your own password manager, it already offers the option of logging in with a passkey instead of a password.