A script-based, small (~1mb), Open Source Application written in AutoHotkey that provides keyboard shortcuts to auto-type usernames, passwords and Time-based One-Time Passwords* (TOTP) for applications and websites, it borrows the concepts coined by KeePass but with Bitwarden as "backend".
It does NOT replace Bitwarden application as entries can't be added/edited. They can run side-by-side but is not required.
* Even for the free version, but please support bitwarden development by buying a Premium subscription.
Some people feel uneasy to trust their passwords to 3rd parties, and of course that's the way it should be. Why trust this small application? Because its 100% transparent. Bitwarden itself is the same, relies on being completely transparent and Open Source.
While Open Source is not a silver bullet, allows anyone to audit the code. Granted, not everyone is able to do so but at least the code is here hopefully gaining enough traction to fall into the hands of capable reviewers.
Here are some highlights for the more suspicious/paranoid:
bw.exe
is not bundled, is retrieved from the official distribution.- No telemetry information or usage statics of any kind are ever generated.
- There's no "dial home" as there is no home, only this public code repository.
- When installed the approximate size is about 57mb, above 98% of the size is Bitwarden's own CLI.
- The optional favicon retrieval, grabs a single icon from the sites (same as Bitwarden).
- The optional update check is done by retrieving a small file in the repository (this file).
- Auto-type works fine if offline, blocked via firewall or with the previous options disabled.
- The source code is embedded in the executable, can be read with any text editor (better yet, with Resource Hacker).
- A build script is available in the repo if the pre-built binaries are not trusted (only a double click is needed).
- The source code can be used as a script, thus avoiding the creation of any binary by just using AutoHotkey if installed.
Please note that even if the auto-type application does not need any network connectivity, bw.exe
does for logging and synchronization of the vault.
The application attempts to fullfil the applicable Top-10 user requested features of the community:
- Auto-type/Autofill for logging into other desktop apps.
- 2FA when ‘unlocking’1.
- Auto-logout after X minutes.
- Auto-fill TOTP code.
- Bitwarden Windows App - Add Autorun at System Startup.
- Auto-Sync on all platforms2.
- Support Internet Explorer3.
- Autofill shortcut should open login window when vault is locked
- Improve random password generation.
1 Generates an independent Authenticator Key.
2 The synchronization is done on schedule.
3 IE 11 was tested, older versions might need to use title matching.
Wiki details them:
- Auto-Type: with predefined and per-case sequences.
- Supports multiple accounts and window definitions per site.
- Favicons can be shown to easily distinct between sites.
- Quick custom PIN and Authenticator codes for unlocking.
- Universal Window Platform support (Microsoft Store Apps).
- Browser support: instead of insecure extensions.
- All the major browsers (plus Internet Explorer) are supported.
- TOTP generation: via Clipboard and/or hotkey and/or placeholder.
- Strong Password Generator with entropy indicator.
- Placeholder for smart detection of text input fields.
- Two-Channel Auto-Type Obfuscation: global/per-entry.
Installer:
- Run the setup (application can be found in the Start Menu).
Portable:
- Place Bitwarden CLI (at least version
1.11
) in the same directory.
Both:
- Update the settings accordingly.
Optional:
- Add in Bitwarden login entries "window rules" (see format below).
- Specify custom typing sequence in the
auto-type
sequence field (name can be changed in[ADVANCED]
section of settings file).
- By URL:
http://example.com
https://www.example.com/path/login.html?foo=bar
- It follows the "Match Detection" in use by Bitwarden.
- By executable name:
thunderbird.exe
app://thunderbird.exe
winapp://thunderbird.exe
- By window title (partial match):
Mail Server Password
app://Mail Server Password
winapp://Mail Server Password
- By window title (exact match):
app://?title=Mail Server Password Required
winapp://?title=Mail Server Password Required
- By window class:
app://?class=MozillaDialogClass
winapp://?class=MozillaDialogClass
Why winapp://
or app://
? Both are currently unused. winapp://
is consistent with androidapp://
and iosapp://
which are in use. app://
is OS agnostic (an Auto-Type for MacOS/Linux could make use of it). Protocols can be iconified (for example: app://
, macapp://
, linuxapp://
and winapp://
).
- No x86 version:
bw.exe
is 64 bits only. - TCATO can fail in specific sites/windows.
- Temporarily disable it via tray menu.
- Add an exception in Bitwarden Vault (field
tcato
, valueoff
).
- Some applications might fail to recognize auto-type:
- Use the installer version (recommended).
- Run the portable version as Administrator.
{SmartTab}
doesn't work with Chromium-based applications.- Normal Tab is sent. For more than one Tab use a custom
auto-type
rule.
- Normal Tab is sent. For more than one Tab use a custom
- From October 2021 Bitwarden Server detects plain CLI logins (ie, no Two-Step Login) as a bot login attempt.
- Use the Personal API Key instead of username/password to circumvent the issue.
- Wiki !!!
- UI for settings.
- Global entry selection.
Checkout the Wiki.- In Reddit look for the /r/Bitwarden sub.
- User-to-User support in Community Forums.
- GitHub Issues for app-specific problems/bugs.
THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.