CLI Commands Reference - Bitwarden Clients

This page documents all available commands in the Bitwarden CLI, extracted from the commander configuration in the source code.

Authentication Commands

Log into a user account.

bw login [email] [password]

string

Email address for your Bitwarden account. If omitted, you’ll be prompted.

password

string

Master password. If omitted, you’ll be prompted.

Options

--method

string

Two-step login method (0=Authenticator, 1=Email, 3=YubiKey, etc.)

--code

string

Two-step login code

--sso

string

--apikey

boolean

--passwordenv

string

Environment variable storing your password

--passwordfile

string

Path to file containing your password as the first line

--check

boolean

Check login status without logging in

Examples

# Interactive login
bw login

# Login with credentials
bw login [email protected] myPassword321 --raw

# Login with two-factor authentication
bw login [email protected] myPassword321 --method 1 --code 249213

# SSO login
bw login --sso

# Check if logged in
bw login --check

logout

Log out of the current user account.

bw logout

This command clears all local vault data and session information.

Example

bw logout

unlock

Unlock the vault and return a new session key.

bw unlock [password]

password

string

Master password to unlock the vault. If omitted, you’ll be prompted.

Options

--check

boolean

Check vault lock status without unlocking

--passwordenv

string

Environment variable storing your password

--passwordfile

string

Path to file containing your password as the first line

Examples

# Interactive unlock
bw unlock

# Unlock with password
bw unlock myPassword321

# Get session key only
bw unlock myPassword321 --raw

# Check lock status
bw unlock --check

After unlocking, previous session keys are invalidated. Use --raw to get just the session key and set it:

export BW_SESSION="$(bw unlock --raw)"

lock

Lock the vault and destroy active session keys.

bw lock

Users with Key Connector enabled will be logged out instead of locked.

Example

bw lock

Vault Synchronization

sync

Pull the latest vault data from the server.

bw sync

Options

-f, --force

boolean

Force a full sync instead of incremental

--last

boolean

Display the last sync date

Examples

# Normal sync
bw sync

# Force full sync
bw sync -f

# Check last sync time
bw sync --last

Vault Operations

list

List an array of objects from the vault.

bw list <object>

object

string

required

Type of object to list:

items: Vault items
folders: Folders
collections: Collections
org-collections: Organization collections
org-members: Organization members
organizations: Organizations

Options

--search

string

Search term to filter results

--url

string

Filter login items by URL (URL-match search)

--folderid

string

Filter items by folder ID (use null for items without folder)

--collectionid

string

Filter items by collection ID

--organizationid

string

Filter items or collections by organization ID (use notnull for any organization)

--trash

boolean

Show only items in trash

--archived

boolean

Show only archived items (feature flag required)

Examples

# List all items
bw list items

# Search items
bw list items --search google

# Items in specific folder
bw list items --folderid 60556c31-e649-4b5d-8daf-fc1c391a1bf2

# Items without folder
bw list items --folderid null

# Items in any organization
bw list items --organizationid notnull

# Search with filter (AND operation)
bw list items --search google --folderid 60556c31-e649-4b5d-8daf-fc1c391a1bf2

# Filter by URL
bw list items --url https://google.com

# Items in trash
bw list items --trash

# Organization members
bw list org-members --organizationid 60556c31-e649-4b5d-8daf-fc1c391a1bf2

Combining search with filters performs a logical AND. Combining multiple filters performs a logical OR.

get

Get an object from the vault.

bw get <object> <id>

object

string

required

Type of object to retrieve:

item: Full item details
username: Username field only
password: Password field only
uri: URI field only
totp: TOTP code
notes: Notes field only
exposed: Check if password is exposed in data breaches
attachment: Download attachment
folder: Folder details
collection: Collection details
org-collection: Organization collection
organization: Organization details
template: JSON template for creating objects
fingerprint: Account fingerprint
send: Send details

string

required

Search term or object’s globally unique ID

Options

--itemid

string

Item ID for attachment operations

--output

string

Output directory or filename for attachments

--organizationid

string

Organization ID for organization objects

Examples

# Get full item
bw get item 99ee88d2-6046-4ea7-92c2-acac464b1412

# Get password by search
bw get password https://google.com

# Get TOTP code
bw get totp google.com

# Get notes
bw get notes google.com

# Check if password is exposed
bw get exposed yahoo.com

# Download attachment
bw get attachment b857igwl1dzrs2 --itemid 99ee88d2-6046-4ea7-92c2-acac464b1412 --output ./photo.jpg

# Get attachment to stdout
bw get attachment photo.jpg --itemid 99ee88d2-6046-4ea7-92c2-acac464b1412 --raw

# Get folder
bw get folder email

# Get template
bw get template folder

create

Create an object in the vault.

bw create <object> [encodedJson]

object

string

required

Type of object to create:

item: Vault item
attachment: File attachment
folder: Folder
org-collection: Organization collection

encodedJson

string

Base64-encoded JSON of the object. Can be piped from stdin.

Options

--file

string

Path to file for attachment creation

--itemid

string

Item ID when creating an attachment

--organizationid

string

Organization ID for organization objects

Examples

# Create folder from encoded JSON
bw create folder eyJuYW1lIjoiTXkgRm9sZGVyIn0K

# Create from piped input
echo 'eyJuYW1lIjoiTXkgRm9sZGVyIn0K' | bw create folder

# Create attachment
bw create attachment --file ./myfile.csv --itemid 16b15b89-65b3-4639-ad2a-95052a6d8f66

# Encode and create in one step
echo '{"name":"My Folder"}' | bw encode | bw create folder

edit

Edit an object in the vault.

bw edit <object> <id> [encodedJson]

object

string

required

Type of object to edit:

item: Vault item
item-collections: Item’s collection assignments
folder: Folder
org-collection: Organization collection

string

required

Object’s globally unique ID

encodedJson

string

Base64-encoded JSON with updates. Can be piped from stdin.

Options

--organizationid

string

Organization ID for organization objects

Examples

# Edit folder
bw edit folder 5cdfbd80-d99f-409b-915b-f4c5d0241b02 eyJuYW1lIjoiTXkgRm9sZGVyMiJ9Cg==

# Edit from piped input
echo 'eyJuYW1lIjoiTXkgRm9sZGVyMiJ9Cg==' | bw edit folder 5cdfbd80-d99f-409b-915b-f4c5d0241b02

# Edit item collections
bw edit item-collections 78307355-fd25-416b-88b8-b33fd0e88c82 WyI5NzQwNTNkMC0zYjMzLTRiOTgtODg2ZS1mZWNmNWM4ZGJhOTYiXQ==

delete

Delete an object from the vault.

bw delete <object> <id>

object

string

required

Type of object to delete:

item: Vault item (soft delete to trash)
attachment: Attachment
folder: Folder
org-collection: Organization collection

string

required

Object’s globally unique ID

Options

--itemid

string

Item ID when deleting an attachment

--organizationid

string

Organization ID for organization objects

-p, --permanent

boolean

Permanently delete item (skip trash)

Examples

# Soft delete item (to trash)
bw delete item 7063feab-4b10-472e-b64c-785e2b870b92

# Permanently delete item
bw delete item 89c21cd2-fab0-4f69-8c6e-ab8a0168f69a --permanent

# Delete folder
bw delete folder 5cdfbd80-d99f-409b-915b-f4c5d0241b02

# Delete attachment
bw delete attachment b857igwl1dzrs2 --itemid 310d5ffd-e9a2-4451-af87-ea054dce0f78

restore

Restore an object from trash or archive.

bw restore <object> <id>

object

string

required

Type of object to restore (currently only item)

string

required

Object’s globally unique ID

Example

bw restore item 7063feab-4b10-472e-b64c-785e2b870b92

Organization Commands

move

Move an item to an organization (share with organization).

bw move <id> <organizationId> [encodedJson]

string

required

Item’s globally unique ID

organizationId

string

required

Organization’s globally unique ID

encodedJson

string

Base64-encoded JSON array of collection IDs. Can be piped from stdin.

Examples

# Move item to organization
bw move 4af958ce-96a7-45d9-beed-1e70fabaa27a 6d82949b-b44d-468a-adae-3f3bacb0ea32 WyI5NzQwNTNkMC0zYjMzLTRiOTgtODg2ZS1mZWNmNWM4ZGJhOTYiXQ==

# With piped collection IDs
echo '["974053d0-3b33-4b98-886e-fecf5c8dba96"]' | bw encode | bw move 4af958ce-96a7-45d9-beed-1e70fabaa27a 6d82949b-b44d-468a-adae-3f3bacb0ea32

confirm

Confirm an organization member.

bw confirm <object> <id>

object

string

required

Type of object (currently only org-member)

string

required

Member’s globally unique ID

Options

--organizationid

string

required

Organization’s globally unique ID

Example

bw confirm org-member 7063feab-4b10-472e-b64c-785e2b870b92 --organizationid 310d5ffd-e9a2-4451-af87-ea054dce0f78

Import/Export

import

Import vault data from a file.

bw import [format] [input]

format

string

Format of the import file (e.g., bitwardencsv, keepass2xml, lastpasscsv)

input

string

File path to the data to import

Options

--formats

boolean

List all supported import formats

--organizationid

string

Import to a specific organization

Examples

# List available formats
bw import --formats

# Import from CSV
bw import bitwardencsv ./from/source.csv

# Import KeePass XML
bw import keepass2xml keepass_backup.xml

# Import to organization
bw import --organizationid cf14adc3-aca5-4573-890a-f6fa231436d9 keepass2xml keepass_backup.xml

export

Export vault data to a file.

bw export

Options

--output

string

Output directory or filename

--format

string

Export format: csv (default), json, encrypted_json, or zip

--password

string

Password to encrypt export (only for encrypted_json format)

--organizationid

string

Export specific organization vault

Examples

# Export to CSV
bw export

# Export to stdout
bw --raw export

# Export to JSON
bw export --format json

# Export with custom output
bw export --output ./exp/bw.csv

# Export encrypted JSON
bw export --format encrypted_json --password myPassword321 --output bw.json

# Export organization vault
bw export --organizationid 7063feab-4b10-472e-b64c-785e2b870b92

Exports contain sensitive vault data. Ensure exported files are stored securely.

Send Commands

send

Quickly create and share a Bitwarden Send.

bw send <data>

data

string

required

Text or file path to send

Options

-f, --file

boolean

Treat <data> as a file path

-d, --deleteInDays

number

Days until deletion (default: 7)

--password

string

Password to access the Send

--emails

string

Comma-separated email addresses that can access the Send (requires feature flag)

-a, --maxAccessCount

number

Maximum number of accesses allowed

--hidden

boolean

Hide text content by default in web vault

-n, --name

string

Name for the Send (defaults to GUID for text, filename for files)

--notes

string

Notes to add to the Send

--fullObject

boolean

Return full Send object instead of just the access URL

Examples

# Send text
bw send "secret message"

# Send from stdin
echo "text to send" | bw send

# Send file
bw send -f ./file.ext

# Send with options
bw send "message" --deleteInDays 14 --maxAccessCount 5

# Send with password
bw send -f ./secret.pdf --password myPassword123

send create

Create a Send with full control.

bw send create [encodedJson]

encodedJson

string

Base64-encoded Send JSON. Can be piped from stdin.

Options

--file

string

File path for file Send

--text

string

Text content for text Send

--hidden

boolean

Hide text by default (only with --text)

Example

# Create from template
bw send template send.text | bw encode | bw send create

send list

List all Sends owned by you.

bw send list

Example

bw send list

send get

Get a Send by ID or search term.

bw send get <id>

string

required

Send ID or search term

Options

--output

string

Output directory or filename for file Sends

--text

boolean

Return only the text content

Examples

# Get Send details
bw send get searchText

# Get by ID
bw send get id

# Get text content only
bw send get searchText --text

# Download file Send
bw send get searchText --output ../Photos/photo.jpg

# Output file to stdout
bw send get searchText --file --raw

send edit

Edit a Send.

bw send edit [encodedJson]

encodedJson

string

Base64-encoded updated Send JSON. Can be piped from stdin.

Options

--itemid

string

Override the item ID in the JSON

You cannot update a file Send’s file content. Delete and recreate instead.

send delete

Delete a Send.

bw send delete <id>

string

required

Send ID to delete

Example

bw send delete 7063feab-4b10-472e-b64c-785e2b870b92

send remove-password

Remove password protection from a Send.

bw send remove-password <id>

string

required

Send ID to modify

Example

bw send remove-password 7063feab-4b10-472e-b64c-785e2b870b92

receive

Access a Send from a URL.

bw receive <url>

url

string

required

Bitwarden Send URL

Options

--password

string

Password to access the Send

--passwordenv

string

Environment variable storing the password

--passwordfile

string

File containing the password as the first line

--obj

boolean

Return Send JSON object instead of content

--output

string

File path to save file-type Send

Example

bw receive https://vault.bitwarden.com/#/send/rg3iuoS_Akm2gqy6ADRHmg/Ht7dYjsqjmgqUM3rjzZDSQ

Utility Commands

generate

Generate a password or passphrase.

bw generate

Options

-u, --uppercase

boolean

Include uppercase characters

-l, --lowercase

boolean

Include lowercase characters

-n, --number

boolean

Include numbers

-s, --special

boolean

Include special characters

-p, --passphrase

boolean

Generate a passphrase instead of password

--length

number

Password length (minimum 5, default 14)

--words

number

Number of words in passphrase (minimum 3)

--minNumber

number

Minimum number of numeric characters

--minSpecial

number

Minimum number of special characters

--separator

string

Word separator for passphrases

-c, --capitalize

boolean

Capitalize passphrase words

--includeNumber

boolean

Include number in passphrase

--ambiguous

boolean

Avoid ambiguous characters

Examples

# Default password (uppercase, lowercase, numbers, length 14)
bw generate

# Custom password
bw generate -u -l --length 18
bw generate -ulns --length 25
bw generate -ul

# Passphrase
bw generate -p --separator _
bw generate -p --words 5 --separator space
bw generate -p --words 5 --separator empty

encode

Base64 encode stdin for use with create/edit commands.

echo '{"name":"My Folder"}' | bw encode

Output can be piped to create or edit commands.

Example

echo '{"name":"My Folder"}' | bw encode
# eyJuYW1lIjoiTXkgRm9sZGVyIn0K

config

Configure CLI settings.

bw config <setting> [value]

setting

string

required

Setting to configure (currently only server)

value

string

Value to set. Omit to display current value.

Options

--web-vault

string

Custom web vault URL

--api

string

Custom API URL

--identity

string

Custom identity URL

--icons

string

Custom icons service URL

--notifications

string

Custom notifications URL

--events

string

Custom events URL

--key-connector

string

Key Connector server URL

Examples

# View current server
bw config server

# Set server
bw config server https://bw.company.com
bw config server bitwarden.com

# Set individual endpoints
bw config server --api http://localhost:4000 --identity http://localhost:33656

status

Show server, last sync, user info, and vault status.

bw status

Output

Returns JSON with:

{
  "serverUrl": "https://bitwarden.example.com",
  "lastSync": "2020-06-16T06:33:51.419Z",
  "userEmail": "[email protected]",
  "userId": "00000000-0000-0000-0000-000000000000",
  "status": "unlocked"
}

Status values:

unauthenticated: Not logged in
locked: Logged in, vault locked
unlocked: Logged in, vault unlocked

Example

bw status

update

Check for CLI updates.

bw update

Returns the download URL for the latest version if an update is available.

Examples

# Check for updates
bw update

# Get download URL only
bw update --raw

completion

Generate shell completions.

bw completion --shell <shell>

--shell

string

required

Shell to generate completions for (currently only zsh)

Example

bw completion --shell zsh

sdk-version

Print the SDK version.

bw sdk-version

Template Command

Get JSON templates for creating objects.

bw get template <object>

For Send templates:

bw send template <object>

object

string

required

Template type: item, folder, collection, send.text, send.file, etc.

Examples

# Get folder template
bw get template folder

# Get item template
bw get template item

# Get Send templates
bw send template send.text
bw send template send.file

Browser Extension

Desktop

Web Vault

CLI

​Authentication Commands

​login

​Options

​Examples

​logout

​Example

​unlock

​Options

​Examples

​lock

​Example

​Vault Synchronization

​sync

​Options

​Examples

​Vault Operations

​list

​Options

​Examples

​get

​Options

​Examples

​create

​Options

​Examples

​edit

​Options

​Examples

​delete

​Options

​Examples

​restore

​Example

​archive

​Example

​Organization Commands

​move

​Examples

​confirm

​Options

​Example

​Import/Export

​import

​Options

​Examples

​export

​Options

​Examples

​Send Commands

​send

​Options

​Examples

​send create

​Options

​Example

​send list

​Example

​send get

​Options

​Examples

​send edit

​Options

​send delete

​Example

​send remove-password

​Example

​receive

​Options

​Example

​Utility Commands

​generate

​Options

​Examples

​encode

​Example

​config

Authentication Commands

login

Options

Examples

logout

Example

unlock

Options

Examples

lock

Example

Vault Synchronization

sync

Options

Examples

Vault Operations

list

Options

Examples

get

Options

Examples

create

Options

Examples

edit

Options

Examples

delete

Options

Examples

restore

Example

archive

Example

Organization Commands

move

Examples

confirm

Options

Example

Import/Export

import

Options

Examples

export

Options

Examples

Send Commands

send

Options

Examples

send create

Options

Example

send list

Example

send get

Options

Examples

send edit

Options

send delete

Example

send remove-password

Example

receive

Options

Example

Utility Commands

generate

Options

Examples

encode

Example

config

Options

Examples

status

Output