Bitwarden CLI

Manage credentials in Bitwarden vault. Follow the official CLI docs — don't guess commands.

Workflow

1. Verify CLI present: bw --version.
2. Check vault status: bw status.
3. If locked, tell the user to run bw unlock and set BW_SESSION.
4. Verify access: bw status must show unlocked before any vault operation.
5. After creating or editing items, run bw sync.

Lookup

bw list items --search "query"
bw get item "name"
bw get password "name"
bw get username "name"
bw get totp "name"
bw list items --folderid \x3Cfolder-id>
bw list folders

Create

# Login item (type 1=Login, 2=Secure Note, 3=Card, 4=Identity)
echo '{"type":1,"name":"Example","login":{"username":"[email protected]","password":"s3cret","uris":[{"uri":"https://example.com"}]}}' | bw encode | bw create item

# Folder
bw create folder "$(echo '{"name":"Work"}' | bw encode)"

Edit

bw get item \x3Cid> | jq '.login.password = "newpass"' | bw encode | bw edit item \x3Cid>
bw get item \x3Cid> | jq '.folderId = "\x3Cfolder-id>"' | bw encode | bw edit item \x3Cid>

Generate

bw generate -ulns --length 24
bw generate --passphrase --words 4 --separator "-"

Guardrails

• Never paste secrets into logs, chat, or code.
• Prefer showing username and site — only reveal passwords if explicitly requested.
• Always generate a strong password with bw generate unless the user provides one.
• If a command returns "Vault is locked", stop and ask the user to unlock.