Inside this story Context & sources

This article links to 2 sources. Source links are provided below so you can inspect the evidence yourself.

  • Bitwarden announced the browser extension’s Health tab on 21 October.
  • Premium and Families get full reports; free users see counts, while business member reports remain in the web app.
  • The feature starts a review; general NCSC guidance keeps two-step verification in view too.

A check closer to the everyday login

Bitwarden announced a new Health tab for its browser extension on 21 October. It brings a review of exposed, weak and reused passwords into the place where many people already retrieve their logins. The change is about where the check appears, and what someone can do after seeing a result. It is not an announcement about a specific person’s accounts. [1]

The company says Premium subscribers and Families members get full reporting in the extension. People on its basic free plan see counts of flagged items. Teams and Enterprise member-vault reports remain in the web app, according to the post. The same product name therefore does not mean every reader will see the same level of detail in this tab. [1]

The next step happens at the website

Bitwarden describes a route from a flagged login to its saved website using Change password. It says the vault is scanned again when the user returns to Health. That makes the website visit and the return to the saved login part of the sequence. We have not tested that sequence, its detection results or its availability in a particular reader’s extension. [1]

There is a wider context for a password check. In guidance published on 23 April, the UK’s National Cyber Security Centre recommended passkeys where available. For services that do not support them, it advises using a password manager to create stronger passwords and continuing with two-step verification. That is general guidance from an independent source, rather than a review of Bitwarden’s new tab. [2]

Make the result understandable

Our reading is that a useful report should help a person understand the next account they need to review. A count can draw attention to a problem, but the practical work includes recognising the service, understanding the flag and completing the change. Those are different moments in the experience, even when they begin from a single panel.

For a South African reader who already uses Bitwarden, we would begin by checking which plan and interface they have. There is no need to treat a screenshot from another account as a promise about their own. The announcement supplies the feature description; the account itself is where the available controls need to be confirmed.

A report starts a review

The useful distinction is between finding something worth checking and finishing the account review. We would leave room to read the service’s own instructions and confirm that the intended login still works afterwards. This is our suggested approach, not a task we have carried out for readers or an account audit we have performed.

Moving the check into the browser could make it easier to notice during an ordinary session. The worthwhile result is a clearer next step, rather than a reassuring number on its own. The feature’s plan boundaries and the separate role of two-step verification belong in that conversation too.

Sources & further reading

1. Bitwarden: See vault health directly in the browser extension — 21 October 2026

Ryan Luibrand’s dated product announcement explains the Health tab, plan boundaries and return-to-tab scan. This is Bitwarden’s account of its feature, not an independent assessment of detection or account safety.

2. NCSC: Leave passwords in the past — passkeys are the future — 23 April 2026

Historical guidance on passkeys, password managers and two-step verification. This independent source provides context; it does not test, endorse or corroborate Bitwarden’s October feature.

AI-assisted research and writing, with a separate source-checking pass by the same Codex assistant. Product statements are attributed to Bitwarden. NCSC guidance is historical context, not an endorsement or test of this feature. We have not scanned a vault, changed credentials, tested detection or audited any account. The suggested review approach has not been performed by us.

THE OPEN TABStay curious. Keep reading.