Custom field conventions
Keyguard reads these custom-field names as extra item data. Other clients show them as plain custom fields.
Environments
On a Bitwarden server, an Environment item is stored as a secure note with these hidden fields.
| Field | Value |
|---|---|
keyguard.environment.v1.part.1, keyguard.environment.v1.part.2, … | The environment’s variables, split into parts of at most 3,500 bytes |
keyguard.environment.v1.sha256 | Checksum of the joined parts |
GPG keys
On a Bitwarden server, a GPG key item is stored as a secure note with these fields.
| Field | Type | Value |
|---|---|---|
keyguard.gpg.private_key.armored | Hidden | Armored private key, if the item has one |
keyguard.gpg.public_key.armored | Text | Armored public key |
keyguard.gpg.fingerprint | Text | Fingerprint of the primary key |
A key longer than 3,500 bytes is split into numbered fields, such as
keyguard.gpg.public_key.armored.v1.part.1, plus a
keyguard.gpg.public_key.armored.v1.sha256 checksum field.
Item links
Keyguard stores each of an item’s Linked items as a text custom field. KeePass databases store them as entry string fields with the same names.
| Field | Value |
|---|---|
keyguard.link.1, keyguard.link.2, … | keyguard://cipher/<ITEM_ID>, the ID of the linked item in the same account |
Numbers start at 1, without gaps. Keyguard hides these fields from the item’s custom fields. A field with an invalid value stays a regular custom field.
SSH bookmarks
A text field of an SSH Key item is a bookmark when its value starts with
ssh://. Its name doesn’t matter. Keyguard shows bookmarks under
SSH bookmarks instead of the custom fields, and saves a new one in a field
named SSH bookmark. A value without ssh:// gets it on save.
Pin hosts to keys uses bookmarks to offer
each host only its own keys.
| Value | Example |
|---|---|
ssh://<HOST> | ssh://my-alias |
ssh://<USER>@<HOST>:<PORT> | ssh://deploy@build.example.com:2222 |
The host is a host name, an alias from ~/.ssh/config or an IP address, with
IPv6 in brackets. The user and the port are optional; the port isn’t used for
pinning. Keyguard skips values with a path or a pattern, such as *.
SSH certificates
On a Bitwarden server, the certificate of an SSH Key item is stored in a text field.
| Field | Value |
|---|---|
keyguard.ssh.certificate | The OpenSSH certificate line |
A certificate longer than 3,500 bytes is split into numbered fields, such as
keyguard.ssh.certificate.v1.part.1, plus a
keyguard.ssh.certificate.v1.sha256 checksum field.
Tags
In a Bitwarden account, Keyguard stores each tag as a custom field. KeePass databases use KeePass tags instead.
| Field | Value |
|---|---|
Tag | The tag’s name, in a text field |
Keyguard writes tags back in the same format.
Wi-Fi credentials
An item shows a Wi-Fi QR code when it has a network name and at least one of the other two fields. A login’s username then shows as SSID.
| Field | Value |
|---|---|
WiFi SSID or SSID | Network name. A login’s username, if set, takes its place. |
WiFi Authentication Type | WPA, WEP, or nopass for an open network |
WiFi Hidden | true or false |