Skip to main content

How to self-host a password manager with Vaultwarden (in under an hour)

A password manager is one of the highest-value services you can self-host: it removes a per-seat bill, keeps every credential on your own hardware, and — because the official Bitwarden clients work with it — you give up nothing in usability. Vaultwarden is the server that makes it practical, because it is tiny.

Why Vaultwarden

  • It speaks the Bitwarden protocol. You keep using the real Bitwarden apps (browser, desktop, mobile); they just connect to your server.

  • It is extremely light. Written in Rust, it runs comfortably in 256–512 MB of RAM. A small VPS is plenty for a family or a small team.

  • Organisations and sharing are included. Features that required a paid Bitwarden plan work in Vaultwarden at no cost.

  • Extras: TOTP generation (so it can also be your 2FA codes), passkeys, file attachments, and expiring "Send" links for sharing secrets.

What you need

  • A small VPS (1 vCPU / 1 GB is fine for personal use; 2 GB for a team).

  • A domain — e.g. vault.example.com.

  • A TLS certificate — non-negotiable, because the Bitwarden clients refuse plaintext HTTP.

The setup

  1. Provision the VPS, point your domain's DNS at it, and obtain a TLS certificate.

  2. Deploy Vaultwarden — the official Docker image is the easiest route, with a persistent volume for its data.

  3. Put a reverse proxy (Nginx/Caddy/Traefik) in front for HTTPS.

  4. Register your account immediately on first boot, then disable further signups in the settings, so nobody else can create an account on your instance.

  5. Point the Bitwarden apps at your domain. On mobile, choose "self-hosted environment" and enter the server URL.

The security habits that matter

  • Back up the Vaultwarden data directory and database on a schedule, to somewhere off the server, and test a restore. A vault you cannot restore is worse than no vault.

  • Keep an emergency copy of your master password (and any 2FA recovery codes) somewhere safe and offline. If you lose both, nobody — including you — can decrypt the vault.

  • Keep Vaultwarden and your reverse proxy updated; you are running the one service whose compromise would be most damaging.

  • Use a strong master password — a four-word passphrase — and enable 2FA on the vault itself.

Is it right for you?

If you want a password manager you control, without maintaining a large server and without changing which apps you use, Vaultwarden is close to ideal. If you want a vendor contract and support behind your vault, stay with Bitwarden's hosted service — Vaultwarden is community maintained, and that is a real trade.

More detail in the knowledge base: Vaultwarden: what it is, and the spec sheet at /app-hosting/vaultwarden. Vaultwarden is AGPL-3.0.

← Back to all posts