The short decision
Before you leave a device, decide whether the vault should stay on that device at all. Lock is a short pause; Log Out is a removal of the local vault copy. The choice is not about which button is safer in general — it is about who will physically hold the device next.
| Situation | Practical choice | Why |
|---|---|---|
| Your own phone or laptop, stepping away for minutes | Lock | The vault stays put; you unlock when you return |
| Your own device, leaving it unattended for a long period | Consider Log Out | The local vault data is removed, not just hidden behind a lock |
| A shared, borrowed or public device | Log Out before handing it over | You do not leave vault data on hardware you do not control |
| A device you will not use again | Log Out | Unlocking later would need online authentication |
| A device with no reliable connection | Check your configuration first | Trusted-device unlocking and login require internet |
This matrix is editorial guidance, not a product rule. Bitwarden does not choose for you.
What each option actually does
Bitwarden session timeout and timeout action are configured per account and available choices vary by application or organization policy. Source
Because the available choices can differ by application or organization policy, do not assume the option you used on one device exists in the same form on another. Check the actual settings screen in front of you before relying on a particular behavior.
Lock retains vault data on the device for unlocking; log out removes the vault’s local data and requires online authentication to log in again. Source
The practical difference is where the vault data lives after the action. Lock leaves it on the device; Log Out removes the local copy. That is the distinction that matters for a shared-device handoff.
Trusted-device unlocking and login require an internet connection, so the general offline-unlock description has an exception. Source
So “I can always unlock offline” is not a safe assumption. If you log out on a shared device, you will need connectivity and your authentication details to get back in. If you are about to travel or lose signal, that is a reason to plan the logout timing rather than do it at the last minute.
Before you log out: an access-readiness check
Logging out is easy. Getting back in is the part people forget to prepare. Run this check before you leave a shared device, and before you leave your own device for a long period.
- Confirm you know your master password. Do not rely on a browser or device keychain that may not follow you to the next device.
- Confirm you can receive your second factor. If your two-step login depends on a phone, an authenticator app or a hardware key, make sure that method is with you and working.
- Confirm you will have an internet connection when you next need the vault. Trusted-device unlocking and login need connectivity. A dead zone or a flight is a bad place to discover this.
- Check whether your organization enforces a policy. If you use a work account, the timeout action and available choices may be set by policy rather than by you.
- Decide what “done” means for this device. Logging out removes the vault’s local data. It does not mean the device is wiped, and it does not mean browser history or files elsewhere on the machine are gone.
If any item fails, fix it before you log out — or choose Lock if the device will remain in your control and the pause is short.
Failure paths to plan for
- You logged out and now have no signal. You will not be able to authenticate until you are online again. Treat this as a planning error, not a bug.
- You logged out on a borrowed device and the owner expects it to work offline. The next person may hit an online-authentication prompt. Tell them, or avoid leaving the vault there at all.
- You assumed a device-wide cleanup. Log Out is a vault action. It is not a promise that the device is clean of everything else.
- You cannot find the timeout option you expected. Choices vary by application and organization policy. Check the actual settings rather than repeating a step from another device.
- You are handing over a device mid-session. Lock protects the vault from casual use; it does not remove the vault data. If the handoff is not brief and trusted, Log Out is the cleaner choice.
A short handoff checklist
Use this immediately before you pass a device to someone else or walk away:
- Decide: is this device mine, and will I be back shortly?
- If shared or not returning: Log Out, not Lock.
- Master password known and not stored only on this device.
- Second factor available and working.
- Internet access confirmed for the next login.
- Any organization policy on timeout action checked.
- Expectations set with the next person using the device.
Where this fits next
If the reason you are cleaning up a device is that you are reviewing accounts you no longer use, the same “leave no lingering access” logic applies to those accounts. A practical next step is our guide to finding forgotten online accounts, which covers the review side rather than the device side.
A username search can surface public profiles that hint at old accounts, but a public match is a lead, not proof of ownership, and it is not a complete account inventory. Treat it as a starting point for your own review, not as confirmation.
What this guide does not claim
This is an editorial decision aid based on the documented Lock and Log Out behavior. It is not a test of any device, app or configuration, and it does not promise that either action erases anything beyond the vault’s local data. Menu locations, exact wording and available options can differ by application and by organization policy, so verify them on the device in front of you.