How to self-host Vaultwarden (your own Bitwarden server)

A password manager is the one app where "who has my data" is not an idle question. Self-hosting it is how you answer it: your vault lives on a server you control, works with every official Bitwarden app and browser extension, and costs you disk instead of a per-seat subscription. The tool that makes this easy is Vaultwarden.

What is Vaultwarden?

Vaultwarden is a lightweight, open-source re-implementation of the Bitwarden server, written in Rust. The important part: it speaks the Bitwarden protocol, so you use the real Bitwarden clients — the iOS and Android apps, the browser extensions, the desktop apps, the CLI — and just point them at your own server. Nothing about the day-to-day experience changes; only the address the vault syncs to does.

Because it's a fraction of the weight of the official server, it happily runs on a small box and unlocks the paid Bitwarden features (organizations, attachments, 2FA options) for free, since you're hosting it yourself.

Why self-host your password manager?

• You hold the vault. Encrypted at rest and in transit, on infrastructure you chose — not a company that could change hands, pricing or policy.
• No subscription. The features that cost money on the hosted plans are just… on.
• It works with everything. Official Bitwarden clients on every platform. No lock-in to a bespoke app.
• Small and fast. It sips resources; a modest server runs it comfortably.

The security reality — read this part

We host this for people, so we'll say the quiet part out loud: this app holds your passwords. That raises the stakes on three things that are optional for other apps and non-negotiable here.

• TLS is mandatory. The Bitwarden clients refuse to sync to a plain-HTTP server, and rightly so. Your server needs a valid HTTPS certificate, full stop.
• Backups you actually test. If the vault is only in one place and that place dies, so do your passwords. A backup you've never restored is a hope, not a backup.
• Close the door after you're in. Turn off open signups once your accounts exist (see below), so nobody else can register on your server.

None of this is hard. It's just not optional, and anyone who tells you otherwise for a password manager is wrong.

How to deploy it

The moving parts of a proper Vaultwarden install are: the container itself, a persistent volume for the SQLite database and attachments, a domain name, and a TLS certificate in front of it. On your own server that looks roughly like:

• Run the Vaultwarden container with a mounted data volume.
• Put a reverse proxy (Caddy, nginx, Traefik) in front of it to terminate HTTPS with a real certificate.
• Point a domain at the box and open the firewall for 443 only.
• Set the environment so the admin page is protected and, once set up, signups are disabled.

If that reads like a fun afternoon, it is — and it's yours to maintain. If it reads like four ways to accidentally expose a vault, that's the honest reading too, which is exactly why we offer the other path: deploy Vaultwarden in one click and the container, the volume, the domain, the TLS certificate and IPv6 are handled. You get a URL and an empty vault.

First run: set it up right

1. Create your account at your new server's address, then create accounts for anyone else in your household or team.
2. Install the official Bitwarden clients — app, browser extension, desktop — and in each one's settings, set the self-hosted server URL to your address before logging in.
3. Turn off signups. Once everyone who needs an account has one, disable open registration so your server isn't an open door.
4. Turn on two-factor for the vault itself, and confirm your backups are running and restorable.

That's it. A password manager that's genuinely yours, working through the apps you already know — without renting the most sensitive data you own.

Deploy Vaultwarden now → — or see the full catalog of apps you can host with the plumbing handled for you.