Comment by jchw

From this PR:

> A master password is still required and not controlled by the SSO

From the Bitwarden documentation[1]:

> Locking your vault will maintain vault data on the device, so unlocking your vault can be done offline. You will be required to enter your master password or PIN, or use biometrics, but won't need to use any active two-step login methods.

That really ought to quell the majority of the concerns IMO. Though for personal usage I use KeepassXC, because not having any remote authentication at all is even simpler than SSO.

[1]: https://bitwarden.com/help/vault-timeout/#vault-timeout-acti...