Bitwarden Now Supports Passwordless Windows 11 Login via Mobile QR Code Scan

Bitwarden Now Supports Passwordless Windows 11 Login via Mobile QR Code Scan

March 4, 2026 | Cybersecurity & Software

Password manager Bitwarden announced today that users can now log into Windows 11 devices using passkeys stored in their Bitwarden vault — bringing phishing-resistant, passwordless authentication directly to the operating system login screen for the first time from a third-party password manager.

What’s New

The update extends Bitwarden’s existing passkey capabilities beyond browsers and applications into a more fundamental layer: the Windows desktop itself. Previously, users could already store and use passkeys for websites and apps through Bitwarden, but the OS login screen remained dependent on traditional credentials. That gap is now closed.

In practice, the login flow works as follows: at the Windows 11 sign-in screen, users select “Sign-in options” and then choose the security key method. Windows displays a QR code on screen, which the user scans with their mobile device running the Bitwarden app. The app then prompts the user to confirm access to the passkey stored in their encrypted Bitwarden vault — and the desktop login completes, with no password ever typed.

How It Works: The Technology Behind It

Passkeys are based on the FIDO2/WebAuthn standard. Rather than using a shared secret like a password, authentication relies on a cryptographic key pair: a private key held securely by the user and a public key held by the service. Because the private key never leaves the user’s vault and is never transmitted over the network, this approach is inherently resistant to phishing, credential stuffing, and most forms of remote account compromise.

In Bitwarden’s implementation, the password manager acts as the passkey provider. The private key lives in the user’s end-to-end encrypted Bitwarden vault, which is synced across devices. This is a key design advantage over device-bound passkeys: if a user loses their phone, they can still access their passkeys from another trusted device, rather than being locked out.

Microsoft’s Katharine Holdsworth, Partner Group Product Manager, commented on the partnership: “Microsoft is committed to making passwordless authentication practical and secure across Windows to help reduce the risk of phishing and password theft. With the Bitwarden vault integrated into Windows Hello, using passkeys stored in the Bitwarden vault is a fast, smooth, and secure experience across both websites and apps on Windows.”

System Requirements

To use this feature, three conditions must be met:

Microsoft Entra ID enrollment — The Windows device must be joined to a Microsoft Entra ID (formerly Azure Active Directory) environment.
FIDO2 sign-in enabled — The organization must have FIDO2 security key sign-in enabled in their Entra ID configuration.
Passkey registered in Bitwarden vault — The user must have already registered a passkey for their Entra ID profile, with that passkey stored in their Bitwarden vault, and their mobile device logged into Bitwarden.

These requirements currently position the feature primarily for enterprise and organizational users rather than standalone personal accounts. Microsoft has noted that the Windows passkey login rollout will continue throughout March 2026, and exact availability depends on each organization’s Entra ID configuration.

Availability and Pricing

The feature is available on all Bitwarden plans, including the free tier — a notable contrast to some competitors who gate advanced authentication features behind paid subscriptions. Bitwarden is an open-source password and secrets manager serving over 10 million users and 50,000 businesses worldwide.

Broader Context

This announcement builds on groundwork laid in November 2025, when Microsoft released a passkey provider API for Windows 11 that allowed third-party credential managers to register as system-level providers. That update opened the door for Bitwarden — and potentially other managers like 1Password — to bring vault-based passkeys into the OS authentication layer.

By enabling passkey login at the Windows desktop, Bitwarden addresses what security experts have called a critical inconsistency in the passwordless landscape: users could authenticate to websites and apps with passkeys, but still needed a traditional password or PIN to unlock the very device they were using. This integration creates a more unified and consistently secure experience end to end.

Operating system login is considered a high-value target for attackers, since gaining access to a logged-in desktop can immediately expose files, locally stored credentials, and enterprise resources. Passkeys’ cryptographic challenge-response model — where authentication is tied to the user, device, and origin — significantly limits the attack surface that traditional passwords leave open.

Sources: Bitwarden official press release (BusinessWire, March 4, 2026); BleepingComputer; CyberInsider; Thurrott.com; Bitwarden blog

Bitwarden Now Supports Passwordless Windows 11 Login via Mobile QR Code Scan