If you have ever paid for a password manager subscription and then wondered where exactly your encrypted vault lives, Vaultwarden is the answer to that question. It is a self-hosted server that speaks the Bitwarden protocol, which means every official Bitwarden app on iOS, Android, Chrome, Firefox, and the desktop connects to your own server instead of Bitwarden's. You get the same polished apps, the same browser extension autofill, the same mobile unlock experience. The only difference is where the data lives: on a machine you control. The project started in 2018, originally named bitwarden_rs, and now has more than 64,000 GitHub stars from a community with one shared preference: they would rather manage a server than trust a third party with their passwords.
| Fact | Value |
|---|---|
| What it is | Self-hosted password manager server compatible with all official Bitwarden apps |
| Built by | dani-garcia and community contributors |
| License | AGPL-3.0 (open-source license that requires sharing any modifications you distribute) |
| Platforms | Linux, macOS, Windows via Docker; native ARM for Raspberry Pi |
| Requires | Docker (a tool that packages software into a container you can run on any server) |
| Install method | One docker run command or a Docker Compose file |
| Verdict | Best option for anyone who wants full Bitwarden functionality without the subscription or third-party data custody |
What Vaultwarden actually is
Bitwarden, the company, publishes a commercial password manager at bitwarden.com. The company also publishes all of its client apps as open source: the browser extension, the mobile apps, the desktop app. What is not open source is the official server. Vaultwarden fills that gap by reimplementing the server in Rust, a programming language known for low memory usage and high reliability. The result is a server that the official Bitwarden clients talk to without modification.
The distinction matters because Bitwarden's official self-hosted option requires Docker, a database server, a mail server, and enough RAM to run seven separate containers simultaneously. Vaultwarden runs as a single container and is small enough to run on a machine with 512 MB of RAM, including the cheapest virtual private servers (VPS, a rented Linux machine in the cloud) available from providers like Hetzner or DigitalOcean.
Vaultwarden is not affiliated with Bitwarden, Inc. One of its active maintainers happens to be a Bitwarden employee who contributes on their own time, but the project is independent and community-driven.
What you get after installing it
Vaultwarden supports nearly every feature the official Bitwarden clients expose. Practically speaking, that means:
The core vault. Logins, credit cards, secure notes, and identities all sync across every device using AES-256 (a widely used encryption standard) encryption. Passwords are encrypted on the client before they leave the device, so the server never sees your plaintext credentials.
Two-factor authentication. TOTP (time-based one-time passwords, the 6-digit codes generated by apps like Google Authenticator), email codes, YubiKey, and FIDO2/WebAuthn (hardware security key support via devices like a YubiKey or Google Titan) are all supported.
Organizations and sharing. You can create organizations, group passwords into collections, and share them with other users you invite. Roles and access controls work the same way they do in the commercial product.
Bitwarden Send. A feature that lets you share a piece of text or a file via a temporary link with a configurable expiry and optional password. Useful for sharing a password with someone who does not have a Bitwarden account.
Emergency Access. A mechanism that lets you designate a trusted contact who can request access to your vault if you are incapacitated.
The web vault. Vaultwarden ships a bundled copy of the Bitwarden web interface, accessible at your server's URL. You get a full browser-based vault manager without installing anything extra.
Admin panel. A backend administration page where you can manage users, invite policies, two-factor enforcement, and server settings through a browser interface.
What Vaultwarden does not support: the Bitwarden business plans' enterprise SSO (single sign-on) features that require Bitwarden's commercial infrastructure. If your organization needs centralized SSO via a corporate identity provider, you would need the official Bitwarden self-hosted edition. For individuals, families, and small teams, the gap is irrelevant.
The install experience
The fastest path from zero to running vault is two commands. If you are using an AI agent like Cowork or Claude Code, you can paste these directly into the chat and ask it to run them for you:
docker pull vaultwarden/server:latest
docker run --detach --name vaultwarden \
--env DOMAIN="https://vw.yourdomain.com" \
--volume /vw-data/:/data/ \
--restart unless-stopped \
--publish 127.0.0.1:8000:80 \
vaultwarden/server:latest
That starts the server, persists data to /vw-data/ on your host machine, and binds the container port to localhost port 8000. You still need a reverse proxy (a web server like Nginx or Caddy that sits in front of Vaultwarden and adds HTTPS support) because Bitwarden clients require HTTPS and will not connect to a plain HTTP server.
If you prefer a configuration file over typing commands, Docker Compose (a tool for defining how a container should run, written as a simple text file) works cleanly:
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
DOMAIN: "https://vw.yourdomain.com"
volumes:
- ./vw-data/:/data/
ports:
- 127.0.0.1:8000:80
The wiki covers reverse proxy configuration for Nginx, Caddy, Apache, Traefik, and HAProxy. Caddy is the most beginner-friendly choice because it handles free TLS (the encryption layer that makes HTTPS work) certificate setup automatically. The full setup, including pointing your domain name (DNS, the system that maps domain names to server addresses) to your server and configuring the reverse proxy, takes roughly 30 to 60 minutes the first time.
After the server is running, you point an existing Bitwarden client at your server URL in the app settings. On mobile, this is under Settings > Server URL. In the browser extension, it is the gear icon on the login screen. Your existing Bitwarden account migrates by exporting from Bitwarden's servers and importing into your self-hosted instance.
One aspect of the install that catches new users: the database lives inside the Docker volume as a SQLite file by default. SQLite (a lightweight database that runs as a single file) is appropriate for individuals and small teams. Vaultwarden also supports PostgreSQL and MariaDB if you expect heavy concurrent usage or want to run the database separately.
Where it fits and what to compare it to
If you are currently on LastPass, the migration is straightforward: export your vault as CSV from LastPass, import it into Vaultwarden via the web vault interface.
If you are on 1Password, the comparison is more direct. 1Password's current pricing is $3/month for individuals and $5/month per user for teams. Vaultwarden's running cost is whatever your server costs, which can be as low as $4/month for a small VPS. The tradeoff is maintenance: 1Password handles upgrades, backups, and uptime automatically. Vaultwarden does not. You own the database backup schedule, the Docker update cadence, and the monitoring.
For teams already paying Bitwarden's commercial plans ($4/month per user for Teams), Vaultwarden is a direct feature-for-feature comparison at the cost of infrastructure instead of per-seat licensing. At 10 users, that is $40/month versus the cost of a single server.
The realistic alternative within the self-hosted ecosystem is the official Bitwarden self-hosted edition. It is free for up to 2 users with a self-host license, but it requires significantly more infrastructure: the official stack uses Docker Compose with multiple containers and needs at least 2 GB of RAM. Vaultwarden runs in one container with roughly 10 MB of RAM in steady state. For anyone running on a small VPS or a home server with limited resources, Vaultwarden is the practical choice.
Passbolt is another self-hosted password manager worth knowing about, focused specifically on teams. It has a stronger organizational structure and audit logging, and is a better fit if your primary use case is team credential management with compliance requirements. For general personal and small-team use, Vaultwarden's Bitwarden compatibility gives it a more polished client experience.
Verdict
Vaultwarden is the right choice if you meet this profile: you want the Bitwarden app experience on every device, you are not willing to store your credentials on someone else's server, and you are comfortable running a Docker container and setting up HTTPS.
The install takes longer than signing up for a commercial service. But once it is running, the day-to-day experience is identical to paid Bitwarden. The apps are the same. The autofill works the same. The mobile unlock works the same. The only things you trade for this are an afternoon of setup and the ongoing responsibility of backups and updates.
The AGPL license means you can run it for your household or your small business without any licensing cost. The Rust implementation means the server uses minimal resources and has a strong track record on stability. The project is actively maintained, shipping version 1.37.0 as of July 2026, with a community spanning Matrix, Discourse, and GitHub Discussions.
For anyone leaving LastPass after its acquisition history, anyone canceling a 1Password subscription to reduce recurring costs, or anyone building a home lab and wanting proper credential management, Vaultwarden is the first thing to install.