Best Self-Hosted Password Managers

Self-hosted password managers keep your vault on a server you own — but the picks below split first on whether they hold your passwords at all. Five of them are servers: they store your encrypted vault and you back it up, patch it, and keep it reachable. KeeWeb is the exception — a client for KeePass kdbx files you store somewhere else, which makes it the only one here that stores nothing at all and also the one that solves a different problem. Among the servers, the next question is clients: Vaultwarden and Bitwarden speak the same protocol, so the official Bitwarden browser extensions and mobile apps work against them unmodified, while Passbolt, Psono, and TeamPass each bring their own. Then it is personal versus team. Vaultwarden is the sweet spot for one person or a household — 256 MB, one container. Passbolt and TeamPass are built around shared team credentials with folder-level permissions and audit trails, and they cost more to run and administer for it. Finally, read the licence line twice: Passbolt and Psono are open-core, and single sign-on, provisioning, and policy enforcement sit behind their paid tiers rather than in the free edition you self-host.

Password manager

Bitwarden

The official self-hostable Bitwarden server — full vendor support and enterprise SSO. Heavier than Vaultwarden, but the right pick when you need a supported, on-prem deployment.

C#SQL Server

moderateRead guide →

Password manager

KeeWeb

A self-hostable web and desktop client for KeePass kdbx vault files — not a sync server. You host a single-page app behind your own domain and point it at a vault stored on local disk, WebDAV, or a cloud drive, so there is no database and no account system to run.

JavaScript

easyRead guide →

Password manager

Passbolt

A team password manager built on OpenPGP — every secret is encrypted to each user's own key and shared through folder-level permissions, so the server only ever holds ciphertext. The community edition is free to self-host; SSO, LDAP provisioning, audit logs, and password policies are pro-only.

PHPCakePHPMariaDB

moderateRead guide →

Ps

Password manager

Psono

An end-to-end encrypted password manager aimed at IT teams, pairing a Django/PostgreSQL server with browser extensions and a built-in admin portal. The community edition has no user cap; SSO, audit logging, and policy enforcement live in the enterprise build.

PythonDjangoPostgreSQL

hardRead guide →

Te

Password manager

TeamPass

A shared credential vault built for IT teams rather than individuals, organised as a folder tree with per-folder access rules, per-user encryption keys, and a full audit trail. One of the longest-running projects in this category, and it runs on the boring, familiar PHP plus MariaDB stack.

PHPMariaDB

easyRead guide →

Password manager

Vaultwarden

Lightweight Rust reimplementation of the Bitwarden server that runs in 256 MB and works with every official Bitwarden client. The easiest way to self-host your passwords.

Rust

easyRead guide →

Head-to-heads in this category

Password managerAug 2026

Passbolt

vs

PPsono

Two team vaults, two very different licences.

Read the verdict →

Password managerSep 2026

Vaultwarden

vs

Bitwarden

The same clients, a fraction of the RAM.

Read the verdict →

Password managerSep 2026

Vaultwarden

vs

Passbolt

A personal vault vs. a team credential system.

Read the verdict →

Password managerSep 2026

Vaultwarden

vs

PPsono

A single-container, 256 MB Bitwarden-compatible vault vs. a Django/PostgreSQL password manager built for IT teams with an admin portal and unlimited users in its community edition.

Read the verdict →