CheatPress

Bitwarden CLI Vault from the shell

Version docs 2026-10 · source

Bitwarden CLI, Postcard, light preview Light · Postcard 102 × 152 mm · PDF Bitwarden CLI, Postcard, dark preview Dark · Postcard 102 × 152 mm · PDF Bitwarden CLI, Postcard, ink saver preview Ink saver · Postcard 102 × 152 mm · PDF
Bitwarden CLI, A5, light preview Light · A5 148 × 210 mm · PDF Bitwarden CLI, A5, dark preview Dark · A5 148 × 210 mm · PDF Bitwarden CLI, A5, ink saver preview Ink saver · A5 148 × 210 mm · PDF
Bitwarden CLI, A4, light preview Light · A4 210 × 297 mm · PDF Bitwarden CLI, A4, dark preview Dark · A4 210 × 297 mm · PDF Bitwarden CLI, A4, ink saver preview Ink saver · A4 210 × 297 mm · PDF
Bitwarden CLI, A4 landscape, light preview Light · A4 landscape 297 × 210 mm · PDF Bitwarden CLI, A4 landscape, dark preview Dark · A4 landscape 297 × 210 mm · PDF Bitwarden CLI, A4 landscape, ink saver preview Ink saver · A4 landscape 297 × 210 mm · PDF
Bitwarden CLI, A3, light preview Light · A3 297 × 420 mm · PDF Bitwarden CLI, A3, dark preview Dark · A3 297 × 420 mm · PDF Bitwarden CLI, A3, ink saver preview Ink saver · A3 297 × 420 mm · PDF
Bitwarden CLI, A3 landscape, light preview Light · A3 landscape 420 × 297 mm · PDF Bitwarden CLI, A3 landscape, dark preview Dark · A3 landscape 420 × 297 mm · PDF Bitwarden CLI, A3 landscape, ink saver preview Ink saver · A3 landscape 420 × 297 mm · PDF
Bitwarden CLI, Letter, light preview Light · Letter 8.5 × 11 in · PDF Bitwarden CLI, Letter, dark preview Dark · Letter 8.5 × 11 in · PDF Bitwarden CLI, Letter, ink saver preview Ink saver · Letter 8.5 × 11 in · PDF
Bitwarden CLI, Tabloid, light preview Light · Tabloid 11 × 17 in · PDF Bitwarden CLI, Tabloid, dark preview Dark · Tabloid 11 × 17 in · PDF Bitwarden CLI, Tabloid, ink saver preview Ink saver · Tabloid 11 × 17 in · PDF

Start here

bw login
Sign in (asks for password)
bw unlock --raw
Print a session key
export BW_SESSION="<key>"
Use the key in this shell
bw list items --search <text>
Find entries
bw get password <name>
Print one password
bw generate -uln --length 20
Make a password
bw sync
Pull the latest vault
bw lock
End the session

Concepts

  1. Logged out no account
  2. Locked data encrypted
  3. Unlocked BW_SESSION set
  4. Locked key destroyed

Sign in

bw login
Sign in with email and password
bw login --apikey
Sign in with an API key
Prompts for client_id and client_secret; BW_CLIENTID and BW_CLIENTSECRET skip the prompt. Run bw unlock afterwards.
bw login --sso
Sign in through your SSO provider
bw unlock
Unlock the vault
bw unlock --raw
Print only the session key
bw unlock --passwordenv <VAR>
Read master password from an env var
bw unlock --passwordfile <file>
Read master password from a file
Takes the first line; keep the file readable only by you.
bw lock
Lock the vault, destroy the key
bw logout
Sign out of the account
bw status
Show login, lock and sync state
bw config server <url>
Point at a self-hosted server
bw --session <key> <command>
Pass the session key per command

Find and read

bw list items
List all vault items as JSON
bw list items --search <text>
Search items
bw list items --folderid <id>
Items in one folder
bw list items --url <url>
Items matching a URL
bw list folders
List folders
bw get item <name|id>
Show one full item
A search string works instead of an id, but several matches give an error; use the id.
bw get password <name|id>
Print the password
bw get username <name|id>
Print the username
bw get totp <name|id>
Print the current 2FA code
bw get notes <name|id>
Print the notes
bw get attachment <file> --itemid <id>
Download an attachment
With --output, a directory path must end in a slash.

Create and change

bw get template item
Print an item JSON template
bw encode
Base64-encode JSON from stdin
bw create item <encodedJson>
Create an item
bw create folder <encodedJson>
Create a folder
bw edit item <id> <encodedJson>
Replace an item
Replaces the whole object, so edit the output of bw get item.
bw edit folder <id> <encodedJson>
Rename a folder
bw delete item <id>
Move an item to the trash
bw delete item <id> --permanent
Delete an item for good
bw restore item <id>
Restore from the trash
bw create attachment --file <path> --itemid <id>
Attach a file to an item
bw get template folder
Print the folder template

Generate and sync

bw generate
Make a password (14 chars default)
bw generate -uln --length 24
Letters and digits, 24 long
bw generate -ulns --length 24
Add special characters
bw generate --passphrase --words 5
Make a passphrase
bw generate -p --separator - -c
Title-case words joined by -
bw generate --ambiguous
Avoid look-alike characters
bw sync
Pull the latest vault data
bw sync --force
Force a full sync
bw sync --last
Show the last sync time

Send

bw send -n "<name>" -d <days> --hidden "<text>"
Send text, hidden by default
bw send -n "<name>" -d <days> -f <path>
Send a file
bw send list
List your Sends
bw send delete <id>
Delete a Send
bw send receive <url>
Open a Send by URL
bw send receive --password <pw> <url>
Open a protected Send
bw send --help
Show all Send subcommands
Documents remove-password, which the web page does not cover.

Backup and options

bw export
Export the vault as CSV
bw export --format json --output <dir>/
Export as JSON to a folder
bw export --format encrypted_json --password
Password-encrypted export
Without --password, the export is tied to your account key.
bw import --formats
List supported import formats
bw import <format> <path>
Import a file into the vault
bw --pretty
Indent JSON output
bw --raw
Return plain values, not messages
bw --nointeraction
Never prompt
bw --help
Show all commands
bw <command> --help
Help for one command

Recipes

Unlock in the current shell
export BW_SESSION="$(bw unlock --raw)"bw syncbw get password <name>
Change an item's password
bw get item <id> \  | jq '.login.password="<new>"' \  | bw encode | bw edit item <id>
Create a folder
bw get template folder \  | jq '.name="<name>"' \  | bw encode | bw create folder
Backup, then clear the file
bw syncbw export --format encrypted_json \  --password --output <dir>/