Self-hosted password manager: Vaultwarden and Bitwarden setup
Keep the official Bitwarden apps, and run the server they sync with in your own house.
The most practical self-hosted password manager is Vaultwarden: a free, open-source server that works with the official Bitwarden apps and runs in a single container. If you want software from Bitwarden itself, Bitwarden lite is its official single-container option for personal use, and the standard Bitwarden install suits bigger setups. Either way, put HTTPS in front of it, turn off open sign-ups, and back up the database.
Your three options
| Vaultwarden | Bitwarden lite | Bitwarden standard | |
|---|---|---|---|
| Made by | Community project, not affiliated with Bitwarden | Bitwarden, Inc. | Bitwarden, Inc. |
| License | AGPL-3.0 | AGPL-3.0, with some code under the Bitwarden License | AGPL-3.0, with some code under the Bitwarden License |
| Runs as | One container | One container; you pick the database, and SQLite works | Several containers |
| Memory | Built as a lighter option to the official server | At least 200 MB | 2 GB minimum, 4 GB recommended |
| Hardware | Any Docker host | Includes ARM, such as Raspberry Pi and NAS boxes | x64 processor listed |
| Sign-up with Bitwarden needed | No | Yes, an installation ID from Bitwarden | Yes, an installation ID from Bitwarden |
| Premium features | No license file needed; emergency access and organizations are built in | Need a license file from a paid plan | Need a license file from a paid plan |
All three work with the official Bitwarden browser extension, desktop app, and phone apps. Bitwarden says lite is meant for personal use and home labs, not business use. If you only need passwords on one computer and no sync, KeePassXC skips the server entirely and keeps an encrypted file on your disk.
What Vaultwarden is
On StartOS, Vaultwarden installs as one app from the dashboard, and your devices can reach it through Tailscale. The apps that talk to it are Bitwarden's own.
Vaultwarden describes itself as an alternative server implementation of the Bitwarden Client API, written in Rust. It was formerly called Bitwarden_RS. It implements nearly all of the Bitwarden client API: the personal vault, Send, attachments, organizations and sharing, emergency access, and two-factor login with authenticator apps, email, FIDO2 WebAuthn, YubiKey, and Duo.
Vaultwarden asks you to report bugs to its own project and not to Bitwarden's support, even when the bug shows up in a Bitwarden app. Bitwarden does not support it.
Setting up Vaultwarden
On StartOS or umbrelOS, Vaultwarden is a one-click app. On a plain Linux box with Docker, you run it as a container.
- 1Run Vaultwarden in a container with its data stored on the host and your server's address configured. For the current commands, follow Vaultwarden's Docker Compose guide.
- 2Put HTTPS in front of it. The web vault uses the browser's Web Crypto API, which browsers allow only in a secure context, so Vaultwarden requires HTTPS and suggests a reverse proxy for it.
- 3Open the web vault, create your account with a long master password you will remember, and turn on two-step login.
- 4Turn off open registration, as the Vaultwarden wiki explains. Organization owners and admins, and the admin page, can still invite people.
- 5If you want the admin page, protect it with a token stored as an Argon2 hash rather than as plain text.
- 6In each Bitwarden app, choose the self-hosted option on the login screen and enter your server address with https://.
Back up the right files
Your vault is a folder on your server, and Vaultwarden's backup guide sorts its contents as follows.
| File or folder | Back it up? | What it holds |
|---|---|---|
| db.sqlite3 | Required | Almost all of your data |
| attachments/ | Required | Files attached to vault items |
| config.json | Recommended | Settings from the admin page |
| rsa_key files | Recommended | Keys that sign login tokens |
| sends/ | Optional | Temporary Send files |
| icon_cache/ | Optional | Website icons, which download again |
Do not copy the live database file while the server writes to it. Vaultwarden has a built-in backup command, available since version 1.32.1, and the backup guide covers it. Copy the result off the machine, encrypted, on a schedule.
What self-hosting protects, and what it does not
Bitwarden apps encrypt your vault on your device before anything goes to the server, and your master password is never sent to it. Because that encryption happens in the apps, a stolen copy of your Vaultwarden database holds your passwords only in encrypted form.
A forgotten master password has no reset link. Bitwarden's own security paper says forgetting it locks you out, unless you set up emergency access or account recovery beforehand. Write it down and store it like you would a seed phrase backup.
The bigger risk is how you run the server. An unpatched one open to the internet is a target, so keep it private behind a VPN such as Tailscale, update it, and do not forward ports for it.
Where your seed phrase fits
A password manager guards the accounts around your bitcoin: the exchange login, the email that resets it, and the 2FA codes for both. It is still the wrong place for a seed phrase, because anything typed into an internet-connected device can leak, and a self-hosted vault sits on a networked computer too. Keep the words on paper or metal, as my seed phrase guide explains, and lock the exchange account with a hardware security key from my YubiKey guide.
Frequently asked questions
Is Vaultwarden safe?
The encryption runs in the official Bitwarden apps, so the server only stores encrypted vaults. The risk is in how you run it: use HTTPS, turn off open sign-ups, keep it behind a VPN instead of the open internet, update it, and back it up. Vaultwarden is a community project and Bitwarden does not support it.
Can you self-host Bitwarden for free?
Yes. Bitwarden says it is free to host on your own, with unlimited logins on unlimited devices. You request an installation ID from Bitwarden with an email address. Premium features need a license file from a paid plan. Premium costs $19.80 a year, billed annually.
Vaultwarden vs Bitwarden: what is the difference?
Bitwarden is the company and its official server. Vaultwarden is an independent server written in Rust that speaks the same API, so the official Bitwarden apps work with it. Vaultwarden needs no installation ID and no license file, while Bitwarden's own server is the one Bitwarden supports.
Can I run a self-hosted password manager on a Raspberry Pi?
Bitwarden lite officially runs on ARM hardware such as Raspberry Pi and needs at least 200 MB of RAM. The standard Bitwarden install lists an x64 processor in its requirements, so use lite or Vaultwarden on a Pi.
What is the best self-hosted password manager?
For one person or a family, pick Vaultwarden: it is light and works with Bitwarden's polished apps. A business that needs vendor support should run official Bitwarden, and KeePassXC fits if you want no server and no sync at all.