Is BitMerger safe? How it handles your vault

A tool that sees your whole password vault has to earn trust. This page explains exactly what BitMerger does with your data, what it stores and where its limits are. Everything here can be checked in the source code on GitHub.

The short version

• BitMerger is one program on your computer. No server, no account, no telemetry.
• Your master password goes straight to the official Bitwarden CLI. BitMerger does not store it and sends it nowhere else.
• Passwords are never written to disk by BitMerger. The scan result stays in memory.
• On quit, BitMerger logs out and deletes the CLI's local copy of your entries.

How the parts fit together

1. BitMerger starts a small web interface that listens on 127.0.0.1 only, so it can't be reached from your network.
2. Your browser shows that interface. Access needs a random token from the start link (turned into a cookie), a custom header and the exact host name. That locks out other websites and DNS rebinding attacks.
3. The Bitwarden CLI (bw) does the actual work with your vault: logging in, reading, writing. It is Bitwarden's official command line client.

The Bitwarden CLI: official and checked

On first start BitMerger downloads the Bitwarden CLI (about 45 MB) from Bitwarden's GitHub releases, checks it against a pinned SHA-256 checksum and keeps it in BitMerger's own cache folder. Nothing is installed system-wide, and an existing Bitwarden CLI setup on your computer is not touched.

The CLI runs with its own throwaway data folder. Quitting BitMerger logs out and deletes that folder. The same happens after 20 minutes without any browser activity.

What is stored, and what never is

Kept for next time in BitMerger's cache folder:

• the server (bitwarden.com, bitwarden.eu or your own),
• your email or API client ID,
• the CLI's device ID, so the server does not report a new device on every start,
• your folder selection.

Never stored: master password, API secret, two-step codes, and none of your passwords.

During a session the Bitwarden CLI keeps an encrypted copy of your entries in its throwaway folder, the same way any Bitwarden client does. It is deleted on quit.

Safe merging

• Dry run first. It checks the plan against the current vault and shows every change before anything is written.
• Write, verify, then delete. The entry that stays is written and verified before the duplicates are moved to the trash.
• Trash, not deletion. Duplicates can be restored from the Bitwarden trash for 30 days.
• No lost passwords. Old passwords go into the password history. If they would not fit (Bitwarden keeps five), the group is skipped.
• No surprises across organizations. Groups spanning several organizations are never merged automatically.

Known limits

For speed, BitMerger uses bw serve, the CLI's local API, bound to 127.0.0.1 with Bitwarden's origin protection. While it runs, other programs on your computer could talk to it, exactly as they could use an unlocked bw session. That is why:

• don't run BitMerger on a shared or untrusted computer,
• quit BitMerger when you are done.

Check your download

Every release publishes a SHA256SUMS file. Compare the checksum of your download with it:

# macOS
shasum -a 256 bitmerger-macos-apple-silicon

# Linux
sha256sum bitmerger-linux-x64

# Windows (PowerShell)
Get-FileHash bitmerger-windows-x64.exe -Algorithm SHA256

The files are not code-signed yet. That is why macOS and Windows warn once when you start BitMerger.

Open source

BitMerger is MIT-licensed. You can read the code, build it yourself (go test ./..., ./scripts/build.sh) and report problems on GitHub. BitMerger is an independent project and not affiliated with Bitwarden, Inc.