Self-hosted LastPass alternative: own your password vault with Vaultwarden

Your password manager holds the keys to your entire life -- bank logins, work systems, your email, the recovery codes for everything else. It is the single most sensitive database you own, which makes it strange how casually most of us hand it to whichever cloud is cheapest this year. LastPass has been breached more than once, and encrypted vaults were among the things that walked out the door. 1Password is genuinely excellent and bills you per person, forever. Vaultwarden is the third option: a vault you actually own, running on hardware you control.

What Vaultwarden is

Vaultwarden is a lightweight, open-source implementation of the Bitwarden server, written in Rust. The important word is *compatible*: the official Bitwarden apps and browser extensions talk to it directly, because it speaks the same API. You are not installing a fork or a knockoff -- you get the real Bitwarden clients, pointed at a server that happens to be yours.

It is also full-featured rather than a stripped-down toy. Several things Bitwarden reserves for its paid tiers -- organizations for sharing, storing two-factor codes, file attachments, emergency access -- are simply present here, with no upsell. And it is genuinely small: a single container that runs happily on a Raspberry Pi, so it costs almost nothing to keep online. What you give up is the convenience of someone else's servers; what you get back is a vault whose ciphertext never leaves a machine you chose.

The features that actually matter

Feature lists blur together, so here is what actually earns its place once the vault is part of your day.

• Works with the official Bitwarden apps. Desktop, iOS, Android, the Chrome/Firefox/Safari/Edge extensions, the CLI, and the web vault all connect straight to your server. You set one URL and log in -- no second-rate companion app.
• Organizations and collections. Share logins with your family or team through role-based collections instead of texting passwords around. In Bitwarden this lives behind a paid plan; here it is just part of the product.
• Built-in TOTP authenticator. Store two-factor codes next to the logins they protect and let the extension autofill them. Storing TOTP seeds is a Premium feature upstream.
• Two-step login with hardware keys. Protect your own account with an authenticator app, email codes, FIDO2/WebAuthn security keys like a YubiKey, or Duo.
• Attachments, notes, cards, and identities. Keep recovery kits, license files, secure notes, payment cards, and identities in the vault, all end-to-end encrypted alongside your passwords.
• Bitwarden Send. Hand someone a password or a file through an expiring, encrypted link instead of dropping it into Slack or email where it lives forever.
• Emergency access. Grant a trusted person time-delayed access to your vault in case something happens to you -- another feature Bitwarden keeps for Premium and Families plans.
• Password generator and vault health reports. Generate strong passwords and run the web-vault reports that flag weak, reused, or breach-exposed credentials, so you actually rotate them.

Why self-host it instead of the hosted version

Your data stops being someone else's liability. Bitwarden's design is end-to-end encrypted, so a server only ever sees ciphertext -- but when you self-host, even that ciphertext and its metadata sit on your box rather than in one cloud holding millions of vaults. A breach of your own box exposes one vault; a breach of a password giant exposes everyone's at once, which is exactly why the giants are the target and you aren't.

The cost doesn't scale per seat. 1Password and Bitwarden's paid plans bill per user, per month, forever. Vaultwarden is one small container with unlimited users. A family of five and a twenty-person team cost the same to run -- roughly the price of the compute, and nothing more per person.

You hold the controls. It lives on your domain, backs up on your schedule, and answers to your rules. An admin panel lets you invite users, manage accounts, and lock registration down. Nobody changes the terms, sunsets a feature, or moves it behind a new tier without asking you.

Who it's for

Families who share streaming logins, the wifi password, and bank access, and would rather have one vault than pay per head for the privilege. Small teams and startups that need shared credentials and secure notes but wince at per-user pricing that grows every time they hire. Privacy-minded individuals who left LastPass after one breach too many and want to own the vault outright instead of renting it -- while still using the polished official apps every day.

The honest setup notes

Run this yourself and there are real chores. Backups are non-negotiable. The vault -- a small database and its attachments -- is the crown jewels, and losing it means losing every password at once. You need a backup that runs automatically and a restore you have actually tested. SMTP matters more than you'd think. Invitations, email-based two-factor, and password-hint mail all need a working mail server; without one, inviting family into an organization turns into a manual chore. And it moves fast. Vaultwarden tracks upstream closely, so you pull new images, restart, and occasionally read a release note. The official clients also refuse to talk to a server without valid HTTPS, so a self-signed certificate on the kitchen NAS won't cut it. And there is the small, sharp detail of closing open registration so a stranger can't create an account on your server.

None of it is hard. It is just steady, and the failure modes are unforgiving for something this important. Or let us run it.

Deploy it in one click

Rolling your own means standing up a reverse proxy with real TLS, wiring a persistent data volume, configuring SMTP, setting an admin token, disabling open signups, and building the backups you'll be very glad you built -- before you store a single password. On Caliber Node, you deploy Vaultwarden in one click and skip all of it. HTTPS is handled, the data volume is provisioned and backed up, and the app comes up on your own subdomain ready to accept the official Bitwarden clients. You still get real logs, SFTP into the container, and an export whenever you want one. The difference is that the boring, security-critical plumbing is done for you instead of being one forgotten step away from a bad day.

First run

1. Deploy Vaultwarden from the catalog and open the URL. Create your account -- the first one you make is the owner of the server.
2. Turn off open registration on the Environment tab (or confirm we've already closed it) so nobody else can sign up on your instance.
3. Install the Bitwarden extension or app, open its settings, set the self-hosted server URL to your Caliber Node domain, and log in.
4. Import your existing vault from the web vault under Tools -> Import Data, using an export from LastPass, 1Password, or your browser.
5. Create an Organization, add a collection, and invite your family or team so everyone shares the credentials that should be shared -- and nothing else.

The bigger picture

A password vault is the one tool where "who holds this?" is the whole question. It is the master key to everything else you do online, and renting that key back from a company whose incentives are to grow your bill and keep your data is a strange bargain once you look at it directly. Self-hosting flips it: the official apps you already trust, connected to a vault that lives where you decide, exportable the moment you want to leave. You keep the polish and you keep the keys.

Deploy Vaultwarden in a few minutes -> https://calibernode.com/cloud-apps, or browse the full app catalog.

One-click self-hosted apps, managed for you -- real logs, SFTP, and your data always exportable. Never a black box.