--- title: "How Bitwarden Encrypts and Decrypts Secrets" url: https://daily.dev/posts/how-bitwarden-encrypts-and-decrypts-secrets-5qzu9h717 source_url: https://blog.miguelgrinberg.com/post/how-bitwarden-encrypts-and-decrypts-secrets type: article source: "Miguel Grinberg" published: 2026-05-03T09:32:37.474Z updated: 2026-05-03T09:33:30.338Z tags: ["python", "cryptography"] reading_time: 20 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How Bitwarden Encrypts and Decrypts Secrets **[Miguel Grinberg](https://daily.dev/sources/miguelgrinberg)** · 20 min read · 0 upvotes · 0 comments ## Summary A deep dive into how Bitwarden and its self-hosted clone Vaultwarden encrypt and decrypt secrets. The post explains the two-layer encryption model: a passphrase-derived key (via PBKDF2 + HKDF) protects the master key, which in turn encrypts all vault secrets using AES-CBC with HMAC-SHA256 integrity checks. Complete working Python code is provided for both decryption and encryption, covering key derivation, MAC verification, and AES operations using the pyaes and hkdf libraries. The author was motivated by a supply chain attack on the official Bitwarden CLI and interest in building a local client that works directly with a Vaultwarden SQLite database. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Similar posts on daily.dev - [How to Implement Secure Local Encryption in Python with PBKDF2 and Fernet](https://daily.dev/posts/how-to-implement-secure-local-encryption-in-python-with-pbkdf2-and-fernet-f8uzf0zoz) · Medium · 0 upvotes · 0 comments - [I Do Not Recommend Bitwarden](https://daily.dev/posts/i-do-not-recommend-bitwarden-qn60otbnd) · Lobsters · 1 upvotes · 0 comments --- Tags: [#python](https://daily.dev/tags/python), [#cryptography](https://daily.dev/tags/cryptography) [View this post on daily.dev](https://daily.dev/posts/how-bitwarden-encrypts-and-decrypts-secrets-5qzu9h717)