bitwarden / bitwarden/ios

[PM-39136] Autofill should prompt for PIN instead of master password

Open
#2,795 6 comments 1 reaction 0 assignees View on GitHub
app:password-manager bug
Dominant language
Swift
Stars
684
Forks
154
Avg merge
7d 2h
Merged PRs (30d)
32

Description

### Steps To Reproduce

1. Enable `Unlock with PIN code` & answer Yes to "Do you want to require unlocking with Face ID or your master password when the application is restarted?" (Ensure `Unlock with Face ID` is disabled.)
2. Pick a Bitwarden login with an associated Website (URI) and ensure `Master password re-prompt` is disabled.
3. Navigate to relevant website or app and verify you are logged out.
4. Sign-in to the website or app using Bitwarden's autofill.

### Expected Result

1. If vault is locked (after an initial unlock), user should be prompted for PIN verification to complete autofill.
2. If vault is unlocked, userid and password should autofill without re-verifying PIN/master password (bug [#1167](https://github.com/bitwarden/ios/issues/1167)?).

### Actual Result

1. If vault is locked (after an initial unlock), BW prompts master password to complete autofill.
2. If vault is unlocked, BW prompts master password to complete autofill (bug [#1167](https://github.com/bitwarden/ios/issues/1167)?)

### Screenshots or Videos

_No response_

### Additional Context

This bug was accepted 3 years ago in the archived mobile repository before automatically being closed by closebot last year: https://github.com/bitwarden/mobile/issues/2601

### Build Version

2026.5.1 (3271)

### What server are you connecting to?

US

### Self-host Server Version

_No response_

### Environment Details

iOS 26.5.1

### Issue Tracking Info

- [ ] I understand that work is tracked outside of Github. A PR will be linked to this issue should one be opened to address it, but Bitwarden doesn't use fields like "assigned", "milestone", or "project" to track progress.

Contributor guide

Open the contributing guide

Research direction

Start by reproducing the autofill flow on iOS 26.5.1 with PIN unlock enabled, then trace how autofill handles locked and unlocked vaults. Done means locked vaults prompt for PIN verification and unlocked vaults autofill without an unnecessary PIN or master-password prompt.

Written by the indexing model from the issue text.

Assessment

Tech stack
ios, swift
Domain
authentication, mobile, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
48/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.