Vaultwarden Database Decrypt

Vaultwarden Database Decrypt is a simple tool that allows you to decrypt the db.sqlite3 file generated by Vaultwarden, using the master password of the target account. The output is a JSON file containing all the decrypted ciphers for the specified user. The Bitwarden encryption process is documented here, but to fully implement the decryption logic, I also referred to the official Bitwarden client source code for the necessary technical details.

Usage

Just download the latest release and run the executable from the command line. For example, on a Linux machine:

./vaultwarden-database-decrypt

The tool accepts the following parameters, which can either be passed as command-line arguments or entered interactively if omitted:

• --email: the email address of the account to decrypt;
• --password: the master password of the account;
• --dbPath: the path to the database file;
• --outputFile: the name of the output file (it will be in JSON format).

For example:

./vaultwarden-database-decrypt --email "[email protected]" --dbPath "db.sqlite3"

Known limitations

I realized this tool in my spare time because I wanted to be able to decrypt the Vaultwarden database without relying on a working Bitwarden client; in the end, it turned out to be a fun and educational project too! While it's currently tailored to my specific use case, it could be extended and made more general-purpose with relatively little effort.

Here are some known (not necessarily exhaustive) limitations:

• only works with a SQLite3 database;
• only supports the PBKDF2 SHA-256 KDF algorithm;
• decryption of organizations ciphers have not been tested.