CLI Overview

Command-line interface for Bitwarden vault management

The Bitwarden CLI is a powerful, full-featured command-line interface tool to access and manage a Bitwarden vault. Built with TypeScript and Node.js, the CLI runs on Windows, macOS, and Linux distributions.

Use Cases

The CLI is designed for:

• DevOps and CI/CD: Integrate vault access into automated workflows and deployment pipelines
• Scripting: Automate password management and secret retrieval in scripts
• Server Management: Access credentials on headless servers and remote systems
• Power Users: Manage vault items efficiently from the terminal
• API Mode: Run as a RESTful API server for programmatic access

Installation

NPM

If you have Node.js installed, NPM is the recommended installation method:

npm install -g @bitwarden/cli

Verify installation:

bw --version
# 2026.2.0

Native Executables

Natively packaged versions are available with no Node.js runtime requirement. Download from the official downloads page.

Package Managers

Chocolatey (Windows)

choco install bitwarden-cli

Homebrew (macOS)

brew install bitwarden-cli

The Homebrew version uses the GPL build and does not include device approval commands for Enterprise SSO customers.

Snap (Linux)

sudo snap install bw

Quick Start

Login and Unlock

# Log in to your account
bw login

# Unlock your vault
bw unlock

# Set session key (from unlock output)
export BW_SESSION="your-session-key"

Basic Operations

# Sync vault data
bw sync

# List all items
bw list items

# Search for items
bw list items --search google

# Get a password
bw get password google.com

# Generate a password
bw generate -lusn --length 18

Global Options

All commands support these global options:

--pretty · boolean

Format JSON output with two-space indentation

--raw · boolean

Return raw output instead of descriptive messages

--response · boolean

Return JSON-formatted response output

--quiet · boolean

Suppress all output to stdout

--nointeraction · boolean

Disable interactive prompts for user input

--session · string

Pass session key instead of reading from environment

--cleanexit · boolean

Exit with code 0 even on errors (useful for scripting)

Environment Variables

The CLI respects several environment variables for configuration:

BW_SESSION · string

Session key for vault operations. Set after unlocking:

export BW_SESSION="$(bw unlock --raw)"

BW_RESPONSE · boolean

When set to "true", all output is structured JSON. Equivalent to --response flag.

Always output structured Response objects when this is enabled. Never use free-form text that would break JSON parsing.

BW_QUIET · boolean

When set to "true", suppresses all stdout output. Equivalent to --quiet flag.

BW_CLEANEXIT · boolean

When set to "true", exits with code 0 even on errors. Required for some scripting environments.

BW_PRETTY · boolean

Format JSON output with indentation when set to "true".

BW_RAW · boolean

Return raw output instead of descriptive messages when set to "true".

BW_NOINTERACTION · boolean

Disable interactive prompts when set to "true".

BW_SERVE · boolean

Automatically set to "true" when running in serve mode.

Help System

The CLI is self-documented with comprehensive help:

# Global help
bw --help

# Command-specific help
bw list --help
bw create --help
bw generate --help

Architecture

The CLI is structured with modular programs:

• Program (src/program.ts): Core commands (login, logout, lock, unlock, sync, generate, encode, config, update, status)
• VaultProgram (src/vault.program.ts): Vault operations (list, get, create, edit, delete, archive, restore, share, confirm, import, export)
• SendProgram (src/tools/send/send.program.ts): Send operations (create, list, get, edit, delete, receive)
• ServeProgram (src/serve.program.ts): RESTful API server mode

Next Steps

Commands Reference

Complete reference for all CLI commands

Building from Source

Build and package the CLI yourself

Serve Mode

Run CLI as a RESTful API server