CLI Commands Reference - Bitwarden Clients

This page documents all available commands in the Bitwarden CLI, extracted from the commander configuration in the source code.

Authentication Commands

Log into a user account.

bw login [email] [password]

string

Email address for your Bitwarden account. If omitted, you’ll be prompted.

string

Master password. If omitted, you’ll be prompted.

Options

string

Two-step login method (0=Authenticator, 1=Email, 3=YubiKey, etc.)

string

Two-step login code

string

boolean

string

Environment variable storing your password

string

Path to file containing your password as the first line

boolean

Check login status without logging in

Examples

# Interactive login
bw login

# Login with credentials
bw login john@example.com myPassword321 --raw

# Login with two-factor authentication
bw login john@example.com myPassword321 --method 1 --code 249213

# SSO login
bw login --sso

# Check if logged in
bw login --check

logout

Log out of the current user account.

bw logout

This command clears all local vault data and session information.

Example

bw logout

unlock

Unlock the vault and return a new session key.

bw unlock [password]

string

Master password to unlock the vault. If omitted, you’ll be prompted.

Options

boolean

Check vault lock status without unlocking

string

Environment variable storing your password

string

Path to file containing your password as the first line

Examples

# Interactive unlock
bw unlock

# Unlock with password
bw unlock myPassword321

# Get session key only
bw unlock myPassword321 --raw

# Check lock status
bw unlock --check

After unlocking, previous session keys are invalidated. Use --raw to get just the session key and set it:

export BW_SESSION="$(bw unlock --raw)"

lock

Lock the vault and destroy active session keys.

bw lock

Users with Key Connector enabled will be logged out instead of locked.

Example

bw lock

Vault Synchronization

sync

Pull the latest vault data from the server.

bw sync

Options

boolean

Force a full sync instead of incremental

boolean

Display the last sync date

Examples

# Normal sync
bw sync

# Force full sync
bw sync -f

# Check last sync time
bw sync --last

Vault Operations

list

List an array of objects from the vault.

bw list <object>

string

required

Type of object to list:

items: Vault items
folders: Folders
collections: Collections
org-collections: Organization collections
org-members: Organization members
organizations: Organizations

Options

string

Search term to filter results

string

Filter login items by URL (URL-match search)

string

Filter items by folder ID (use null for items without folder)

string

Filter items by collection ID

string

Filter items or collections by organization ID (use notnull for any organization)

boolean

Show only items in trash

boolean

Show only archived items (feature flag required)

Examples

# List all items
bw list items

# Search items
bw list items --search google

# Items in specific folder
bw list items --folderid 60556c31-e649-4b5d-8daf-fc1c391a1bf2

# Items without folder
bw list items --folderid null

# Items in any organization
bw list items --organizationid notnull

# Search with filter (AND operation)
bw list items --search google --folderid 60556c31-e649-4b5d-8daf-fc1c391a1bf2

# Filter by URL
bw list items --url https://google.com

# Items in trash
bw list items --trash

# Organization members
bw list org-members --organizationid 60556c31-e649-4b5d-8daf-fc1c391a1bf2

Combining search with filters performs a logical AND. Combining multiple filters performs a logical OR.

get

Get an object from the vault.

bw get <object> <id>

string

required

Type of object to retrieve:

item: Full item details
username: Username field only
password: Password field only
uri: URI field only
totp: TOTP code
notes: Notes field only
exposed: Check if password is exposed in data breaches
attachment: Download attachment
folder: Folder details
collection: Collection details
org-collection: Organization collection
organization: Organization details
template: JSON template for creating objects
fingerprint: Account fingerprint
send: Send details

string

required

Search term or object’s globally unique ID

Options

string

Item ID for attachment operations

string

Output directory or filename for attachments

string

Organization ID for organization objects

Examples

# Get full item
bw get item 99ee88d2-6046-4ea7-92c2-acac464b1412

# Get password by search
bw get password https://google.com

# Get TOTP code
bw get totp google.com

# Get notes
bw get notes google.com

# Check if password is exposed
bw get exposed yahoo.com

# Download attachment
bw get attachment b857igwl1dzrs2 --itemid 99ee88d2-6046-4ea7-92c2-acac464b1412 --output ./photo.jpg

# Get attachment to stdout
bw get attachment photo.jpg --itemid 99ee88d2-6046-4ea7-92c2-acac464b1412 --raw

# Get folder
bw get folder email

# Get template
bw get template folder

create

Create an object in the vault.

bw create <object> [encodedJson]

string

required

Type of object to create:

item: Vault item
attachment: File attachment
folder: Folder
org-collection: Organization collection

string

Base64-encoded JSON of the object. Can be piped from stdin.

Options

string

Path to file for attachment creation

string

Item ID when creating an attachment

string

Organization ID for organization objects

Examples

# Create folder from encoded JSON
bw create folder eyJuYW1lIjoiTXkgRm9sZGVyIn0K

# Create from piped input
echo 'eyJuYW1lIjoiTXkgRm9sZGVyIn0K' | bw create folder

# Create attachment
bw create attachment --file ./myfile.csv --itemid 16b15b89-65b3-4639-ad2a-95052a6d8f66

# Encode and create in one step
echo '{"name":"My Folder"}' | bw encode | bw create folder

edit

Edit an object in the vault.

bw edit <object> <id> [encodedJson]

string

required

Type of object to edit:

item: Vault item
item-collections: Item’s collection assignments
folder: Folder
org-collection: Organization collection

string

required

Object’s globally unique ID

string

Base64-encoded JSON with updates. Can be piped from stdin.

Options

string

Organization ID for organization objects

Examples

# Edit folder
bw edit folder 5cdfbd80-d99f-409b-915b-f4c5d0241b02 eyJuYW1lIjoiTXkgRm9sZGVyMiJ9Cg==

# Edit from piped input
echo 'eyJuYW1lIjoiTXkgRm9sZGVyMiJ9Cg==' | bw edit folder 5cdfbd80-d99f-409b-915b-f4c5d0241b02

# Edit item collections
bw edit item-collections 78307355-fd25-416b-88b8-b33fd0e88c82 WyI5NzQwNTNkMC0zYjMzLTRiOTgtODg2ZS1mZWNmNWM4ZGJhOTYiXQ==

delete

Delete an object from the vault.

bw delete <object> <id>

string

required

Type of object to delete:

item: Vault item (soft delete to trash)
attachment: Attachment
folder: Folder
org-collection: Organization collection

string

required

Object’s globally unique ID

Options

string

Item ID when deleting an attachment

string

Organization ID for organization objects

boolean

Permanently delete item (skip trash)

Examples

# Soft delete item (to trash)
bw delete item 7063feab-4b10-472e-b64c-785e2b870b92

# Permanently delete item
bw delete item 89c21cd2-fab0-4f69-8c6e-ab8a0168f69a --permanent

# Delete folder
bw delete folder 5cdfbd80-d99f-409b-915b-f4c5d0241b02

# Delete attachment
bw delete attachment b857igwl1dzrs2 --itemid 310d5ffd-e9a2-4451-af87-ea054dce0f78

restore

Restore an object from trash or archive.

bw restore <object> <id>

string

required

Type of object to restore (currently only item)

string

required

Object’s globally unique ID

Example

bw restore item 7063feab-4b10-472e-b64c-785e2b870b92

Organization Commands

move

Move an item to an organization (share with organization).

bw move <id> <organizationId> [encodedJson]

string

required

Item’s globally unique ID

string

required

Organization’s globally unique ID

string

Base64-encoded JSON array of collection IDs. Can be piped from stdin.

Examples

# Move item to organization
bw move 4af958ce-96a7-45d9-beed-1e70fabaa27a 6d82949b-b44d-468a-adae-3f3bacb0ea32 WyI5NzQwNTNkMC0zYjMzLTRiOTgtODg2ZS1mZWNmNWM4ZGJhOTYiXQ==

# With piped collection IDs
echo '["974053d0-3b33-4b98-886e-fecf5c8dba96"]' | bw encode | bw move 4af958ce-96a7-45d9-beed-1e70fabaa27a 6d82949b-b44d-468a-adae-3f3bacb0ea32

confirm

Confirm an organization member.

bw confirm <object> <id>

string

required

Type of object (currently only org-member)

string

required

Member’s globally unique ID

Options

string

required

Organization’s globally unique ID

Example

bw confirm org-member 7063feab-4b10-472e-b64c-785e2b870b92 --organizationid 310d5ffd-e9a2-4451-af87-ea054dce0f78

Import/Export

import

Import vault data from a file.

bw import [format] [input]

string

Format of the import file (e.g., bitwardencsv, keepass2xml, lastpasscsv)

string

File path to the data to import

Options

boolean

List all supported import formats

string

Import to a specific organization

Examples

# List available formats
bw import --formats

# Import from CSV
bw import bitwardencsv ./from/source.csv

# Import KeePass XML
bw import keepass2xml keepass_backup.xml

# Import to organization
bw import --organizationid cf14adc3-aca5-4573-890a-f6fa231436d9 keepass2xml keepass_backup.xml

export

Export vault data to a file.

bw export

Options

string

Output directory or filename

string

Export format: csv (default), json, encrypted_json, or zip

string

Password to encrypt export (only for encrypted_json format)

string

Export specific organization vault

Examples

# Export to CSV
bw export

# Export to stdout
bw --raw export

# Export to JSON
bw export --format json

# Export with custom output
bw export --output ./exp/bw.csv

# Export encrypted JSON
bw export --format encrypted_json --password myPassword321 --output bw.json

# Export organization vault
bw export --organizationid 7063feab-4b10-472e-b64c-785e2b870b92

Exports contain sensitive vault data. Ensure exported files are stored securely.

Send Commands

send

Quickly create and share a Bitwarden Send.

bw send <data>

string

required

Text or file path to send

Options

boolean

Treat <data> as a file path

number

Days until deletion (default: 7)

string

Password to access the Send

string

Comma-separated email addresses that can access the Send (requires feature flag)

number

Maximum number of accesses allowed

boolean

Hide text content by default in web vault

string

Name for the Send (defaults to GUID for text, filename for files)

string

Notes to add to the Send

boolean

Return full Send object instead of just the access URL

Examples

# Send text
bw send "secret message"

# Send from stdin
echo "text to send" | bw send

# Send file
bw send -f ./file.ext

# Send with options
bw send "message" --deleteInDays 14 --maxAccessCount 5

# Send with password
bw send -f ./secret.pdf --password myPassword123

send create

Create a Send with full control.

bw send create [encodedJson]

string

Base64-encoded Send JSON. Can be piped from stdin.

Options

string

File path for file Send

string

Text content for text Send

boolean

Hide text by default (only with --text)

Example

# Create from template
bw send template send.text | bw encode | bw send create

send list

List all Sends owned by you.

bw send list

Example

bw send list

send get

Get a Send by ID or search term.

bw send get <id>

string

required

Send ID or search term

Options

string

Output directory or filename for file Sends

boolean

Return only the text content

Examples

# Get Send details
bw send get searchText

# Get by ID
bw send get id

# Get text content only
bw send get searchText --text

# Download file Send
bw send get searchText --output ../Photos/photo.jpg

# Output file to stdout
bw send get searchText --file --raw

send edit

Edit a Send.

bw send edit [encodedJson]

string

Base64-encoded updated Send JSON. Can be piped from stdin.

Options

string

Override the item ID in the JSON

You cannot update a file Send’s file content. Delete and recreate instead.

send delete

Delete a Send.

bw send delete <id>

string

required

Send ID to delete

Example

bw send delete 7063feab-4b10-472e-b64c-785e2b870b92

send remove-password

Remove password protection from a Send.

bw send remove-password <id>

string

required

Send ID to modify

Example

bw send remove-password 7063feab-4b10-472e-b64c-785e2b870b92

receive

Access a Send from a URL.

bw receive <url>

string

required

Bitwarden Send URL

Options

string

Password to access the Send

string

Environment variable storing the password

string

File containing the password as the first line

boolean

Return Send JSON object instead of content

string

File path to save file-type Send

Example

bw receive https://vault.bitwarden.com/#/send/rg3iuoS_Akm2gqy6ADRHmg/Ht7dYjsqjmgqUM3rjzZDSQ

Utility Commands

generate

Generate a password or passphrase.

bw generate

Options

boolean

Include uppercase characters

boolean

Include lowercase characters

boolean

Include numbers

boolean

Include special characters

boolean

Generate a passphrase instead of password

number

Password length (minimum 5, default 14)

number

Number of words in passphrase (minimum 3)

number

Minimum number of numeric characters

number

Minimum number of special characters

string

Word separator for passphrases

boolean

Capitalize passphrase words

boolean

Include number in passphrase

boolean

Avoid ambiguous characters

Examples

# Default password (uppercase, lowercase, numbers, length 14)
bw generate

# Custom password
bw generate -u -l --length 18
bw generate -ulns --length 25
bw generate -ul

# Passphrase
bw generate -p --separator _
bw generate -p --words 5 --separator space
bw generate -p --words 5 --separator empty

encode

Base64 encode stdin for use with create/edit commands.

echo '{"name":"My Folder"}' | bw encode

Output can be piped to create or edit commands.

Example

echo '{"name":"My Folder"}' | bw encode
# eyJuYW1lIjoiTXkgRm9sZGVyIn0K

config

Configure CLI settings.

bw config <setting> [value]

string

required

Setting to configure (currently only server)

string

Value to set. Omit to display current value.

Options

string

Custom web vault URL

string

Custom API URL

string

Custom identity URL

string

Custom icons service URL

string

Custom notifications URL

string

Custom events URL

string

Key Connector server URL

Examples

# View current server
bw config server

# Set server
bw config server https://bw.company.com
bw config server bitwarden.com

# Set individual endpoints
bw config server --api http://localhost:4000 --identity http://localhost:33656

status

Show server, last sync, user info, and vault status.

bw status

Output

Returns JSON with:

{
  "serverUrl": "https://bitwarden.example.com",
  "lastSync": "2020-06-16T06:33:51.419Z",
  "userEmail": "user@example.com",
  "userId": "00000000-0000-0000-0000-000000000000",
  "status": "unlocked"
}

Status values:

unauthenticated: Not logged in
locked: Logged in, vault locked
unlocked: Logged in, vault unlocked

Example

bw status

update

Check for CLI updates.

bw update

Returns the download URL for the latest version if an update is available.

Examples

# Check for updates
bw update

# Get download URL only
bw update --raw

completion

Generate shell completions.

bw completion --shell <shell>

string

required

Shell to generate completions for (currently only zsh)

Example

bw completion --shell zsh

sdk-version

Print the SDK version.

bw sdk-version

Template Command

Get JSON templates for creating objects.

bw get template <object>

For Send templates:

bw send template <object>

string

required

Template type: item, folder, collection, send.text, send.file, etc.

Examples

# Get folder template
bw get template folder

# Get item template
bw get template item

# Get Send templates
bw send template send.text
bw send template send.file

​Authentication Commands

​login

​Options

​Examples

​logout

​Example

​unlock

​Options

​Examples

​lock

​Example

​Vault Synchronization

​sync

​Options

​Examples

​Vault Operations

​list

​Options

​Examples

​get

​Options

​Examples

​create

​Options

​Examples

​edit

​Options

​Examples

​delete

​Options

​Examples

​restore

​Example

​archive

​Example

​Organization Commands

​move

​Examples

​confirm

​Options

​Example

​Import/Export

​import

​Options

​Examples

​export

​Options

​Examples

​Send Commands

​send

​Options

​Examples

​send create

​Options

​Example

​send list

​Example

​send get

​Options

​Examples

​send edit

​Options

​send delete

​Example

​send remove-password

​Example

​receive

​Options

​Example

​Utility Commands

​generate

​Options

​Examples

​encode

​Example

​config

​Options

​Examples

​status

​Output

Authentication Commands

login

Options

Examples

logout

Example

unlock

Options

Examples

lock

Example

Vault Synchronization

sync

Options

Examples

Vault Operations

list

Options

Examples

get

Options

Examples

create

Options

Examples

edit

Options

Examples

delete

Options

Examples

restore

Example

archive

Example

Organization Commands

move

Examples

confirm

Options

Example

Import/Export

import

Options

Examples

export

Options

Examples

Send Commands

send

Options

Examples

send create

Options

Example

send list

Example

send get

Options

Examples

send edit

Options

send delete

Example

send remove-password

Example

receive

Options

Example

Utility Commands

generate

Options

Examples

encode

Example

config

Options

Examples

status

Output