Open Source Can Cost Money. What Matters Is the License.

Key takeaways

• Publicly readable code does not automatically come with permission to modify or redistribute it.
• GPLv3 allows commercial use, so charging for software does not contradict open source.
• Dual licensing requires the rights or permissions needed to offer code under different terms.
• Trust in a password manager depends partly on explaining how its public code relates to the app users install.

A password manager asks for a lot of trust. When evaluating a product like Bitwarden, “open source” can help make the case—but you still need to know what that label means for the app on your device.

A public repository answers only the first question

Can you read the code? Good. Now ask what you can do with it.

A public repository lets people inspect how software works and look for suspicious behavior. Visibility alone does not grant permission to modify that code or distribute a version of your own. Those rights come from the license.

That distinction separates open-source software from code that is merely available to read. Open source involves permissions to use, modify, and redistribute software, subject to the applicable terms.

There is another distinction hiding behind the download button. The app you install is a compiled package, potentially including additional libraries and components. Understanding its terms means checking how the repository’s license applies to that package and what conditions cover the other pieces.

For Bitwarden, as for any product, “the code is public” is the beginning of that inquiry.

Commercial is not the opposite of open source

“GPLv3 code in a commercial app” can sound like a contradiction. It isn’t necessarily one.

GPLv3 permits commercial use. Selling GPLv3 software or charging for related support does not, by itself, conflict with the license. Open source is not a promise that nobody will send you an invoice.

The reverse holds too. An app can cost nothing while restricting modification and redistribution. A free download tells you the price, not your rights.

The word “commercial” therefore needs unpacking. Does it mean the vendor charges money? Or does it mean the software is offered under separate proprietary terms? Those are different questions.

When choosing an app, asking whether it is free or paid gets you only so far. Asking which rights accompany your copy gets closer to the issue.

Dual licensing depends on who holds the rights

Dual licensing means offering the same code under two licenses. A party with the necessary copyrights or permissions can, for example, provide code under GPLv3 and also offer it under separate commercial terms.

That does not give everyone who downloads GPLv3 code permission to replace its license.

Someone distributing code under GPLv3 must meet its requirements, including applicable obligations to provide corresponding source code. Outside contributions and bundled libraries also matter: the distributor needs sufficient rights for the terms they offer.

An app store does not make those obligations disappear. The distribution channel and the distributor’s licensing rights are separate issues.

For a particular Bitwarden release, the useful documents are the license covering that release and its component notices. A repository-level label alone cannot establish the terms for every distributed package.

Transparency needs to reach the installed app

Most people will never fork their password manager. They still have a reason to care about these distinctions.

If openness helped persuade you to trust a product, you should be able to understand what is open. Which components have public source code? What does the distributed app contain? Which terms apply to each part?

There is also a difference between inspecting published code and verifying that the installed app was built from it. One does not automatically establish the other.

Public code does not guarantee security. It creates an opportunity for outside scrutiny. Clear explanations of scope, licensing, and distribution help users understand what that opportunity actually covers.

When assessing Bitwarden, look at both the published code and the terms accompanying the release you use. The strongest basis for trust is a clear match between the rights users expect and the rights they receive.