Skip to content

Self-host Vaultwarden

updated Aug 2026prices checked · Jul 2026Install verified on Ubuntu 26.04 · Aug 2026 · how we test
We earn commissions when you shop through the links below. Full disclosure →

Lightweight Rust reimplementation of the Bitwarden server that runs in 256 MB and works with every official Bitwarden client. The easiest way to self-host your passwords.

Key facts

CategoryPassword manager
LicenseAGPL-3.0
StackRust
Min RAM256 MB
Official imageyes
Measured idle RAM7 MB
Difficulty
Sourcegithub.com/dani-garcia/vaultwarden (opens in new tab)
Our recommendation

Pick Vaultwarden when you want Bitwarden — the same official browser, desktop and mobile clients — against a server that idled at 7 MB on our test box: it is an AGPL-3.0 alternative server implementation of the Bitwarden client API in Rust, and its feature list includes organisations, collections, groups, policies, emergency access and 2FA by authenticator, email, FIDO2 WebAuthn, YubiKey and Duo. It is the obvious pick for a household or small team; the honest caveat is that it is unofficial, and it must live behind HTTPS.

Follow the Vaultwarden deploy guide →

What you need

  • Any VPS with at least 256 MB of RAM
  • A domain you control — most self-hosted setups need HTTPS in front of them
  • Under an hour if you've used Docker before
Where to host itaffiliate disclosure
Hetzner Cloudrun it on
From $23.59/mo · 2 vCPU / 4 GB / 80 GB · EU + US
Get Hetzner Cloud (opens in new tab)
Kamaterafree trial
From $4/mo · 1 vCPU / 1 GB / 20 GB · US + EU + Asia
Start free on Kamatera → (opens in new tab)
DigitalOceanalso works on
From $6/mo · 1 vCPU / 1 GB / 25 GB · US + EU + Asia
Deploy on DigitalOcean → (opens in new tab)

Paid link — we earn a commission if you shop through it.

Install

Run these commands on your server:

# Vaultwarden — single container (put it behind HTTPS)
docker run -d --name vaultwarden \
  -e DOMAIN=https://vault.example.com \
  -v vw-data:/data \
  -p 8080:80 vaultwarden/server:latest
# WebAuthn/passkeys need TLS — front with Caddy or Nginx
deploy guideHow to Deploy Vaultwarden on a VPSvps picksBest VPS for self-hostingbenchmarked quarterly · re-priced monthly

What you take on

Vaultwarden is mature and widely used, but its README and wiki are careful about what it is and is not:

non-negotiable"This project is not associated with Bitwarden or Bitwarden, Inc." Bugs go to the Vaultwarden tracker, not Bitwarden support, and the README states it cannot be held liable for data loss — take the backup section seriously.
non-negotiableHTTPS is not optional: the web vault uses Web Crypto APIs that browsers only expose in secure contexts, so it "will only work if you enable HTTPS". The wiki recommends a reverse proxy (Caddy for its automatic certificates) and calls the built-in Rocket TLS "relatively immature and limited".
non-negotiableThe admin page is off until you set ADMIN_TOKEN; the wiki says to store it as an Argon2 hash rather than plain text, and warns that changing the token does not log out already-authenticated admin sessions.
non-negotiableBack up db.sqlite3 with sqlite3 ... .backup (the online-backup API, not a file copy) plus the attachments directory as required, and rsa_key* and config.json as recommended; sends and icon_cache are optional.

An alternative to

1Password →

Head-to-head

Password managerSep 2026
Vaultwarden
vs
Bitwarden

The same clients, a fraction of the RAM.

Read the verdict →
Password managerSep 2026
Vaultwarden
vs
Passbolt

A personal vault vs. a team credential system.

Read the verdict →
Password managerSep 2026
Vaultwarden
vs
Psono

A single-container, 256 MB Bitwarden-compatible vault vs. a Django/PostgreSQL password manager built for IT teams with an admin portal and unlimited users in its community edition.

Read the verdict →

More in Password manager

Password manager

Bitwarden

The official self-hostable Bitwarden server — full vendor support and enterprise SSO. Heavier than Vaultwarden, but the right pick when you need a supported, on-prem deployment.
C#SQL Server
moderateRead guide →
Password manager

KeeWeb

A self-hostable web and desktop client for KeePass kdbx vault files — not a sync server. You host a single-page app behind your own domain and point it at a vault stored on local disk, WebDAV, or a cloud drive, so there is no database and no account system to run.
JavaScript
easyRead guide →
Password manager

Passbolt

A team password manager built on OpenPGP — every secret is encrypted to each user's own key and shared through folder-level permissions, so the server only ever holds ciphertext. The community edition is free to self-host; SSO, LDAP provisioning, audit logs, and password policies are pro-only.
PHPCakePHPMariaDB
moderateRead guide →
Password manager

Psono

An end-to-end encrypted password manager aimed at IT teams, pairing a Django/PostgreSQL server with browser extensions and a built-in admin portal. The community edition has no user cap; SSO, audit logging, and policy enforcement live in the enterprise build.
PythonDjangoPostgreSQL
hardRead guide →

Common questions

How much RAM does Vaultwarden need?

Vaultwarden is designed to run in as little as 256 MB of RAM, making it one of the lightest self-hosted services around — a small, cheap VPS is plenty.

Can I self-host Vaultwarden with Docker?

Yes — it ships as a single container. Run docker run with your DOMAIN set to an HTTPS URL and a data volume mounted, and it's ready behind a reverse proxy like Caddy or Nginx.

Is Vaultwarden compatible with the Bitwarden apps?

Yes — Vaultwarden is a from-scratch Rust reimplementation of the Bitwarden server API, so every official Bitwarden client (browser extension, mobile, desktop) works against it unmodified.

Is Vaultwarden hard to set up?

It's rated the easiest difficulty tier of any self-hosted app here — a single Docker command gets it running, though you do need HTTPS in front of it for WebAuthn and passkey support.

We use analytics cookies (Google Analytics, PostHog) to see which guides are useful. No ad networks, no cross-site tracking. See our privacy policy.