Vaultwarden: Self-Hosted Bitwarden-Compatible Password Manager

Why Vaultwarden?

Cloud password managers are convenient but you’re trusting a third party with your most sensitive data. Vaultwarden keeps it under your control:

Full Bitwarden compatibility — All official clients work out of the box.
50 MB RAM — Runs on a Raspberry Pi or any tiny VPS.
End-to-end encryption — AES-256 client-side; server never sees decrypted data.
Organizations & sharing — Share passwords securely with family or team.
Free premium features — TOTP, file attachments, emergency access.

Prerequisites

Docker on any Linux server.
A domain with HTTPS (required for browser extensions).
A reverse proxy (Nginx, Caddy, or Traefik).

Step 1: Deploy with Docker

docker run -d \
  --name vaultwarden \
  --restart=always \
  -v /vw-data/:/data/ \
  -p 8080:80 \
  -e DOMAIN=https://vault.example.com \
  -e SIGNUPS_ALLOWED=true \
  -e SMTP_HOST=smtp.gmail.com \
  -e SMTP_PORT=587 \
  -e SMTP_SECURITY=starttls \
  -e SMTP_USERNAME=your@gmail.com \
  -e SMTP_PASSWORD=app-password \
  -e SMTP_FROM=your@gmail.com \
  vaultwarden/server:latest

Step 2: Essential Environment Variables

Variable	Purpose
`DOMAIN`	Your full HTTPS URL (required for clients)
`SIGNUPS_ALLOWED`	Set to `false` after creating your accounts
`SMTP_*`	Email config for password resets and 2FA
`ADMIN_TOKEN`	Secret token to access `/admin` panel
`WEBSOCKET_ENABLED`	Set to `true` for real-time sync

Step 3: Secure the Admin Panel

Generate a secure admin token:

openssl rand -base64 48

Add to your Docker env:

-e ADMIN_TOKEN=your-generated-token

Access at https://vault.example.com/admin. From here you can manage users, view diagnostics, and configure settings.

Step 4: Backup Strategy

#!/bin/bash
# /usr/local/bin/backup-vaultwarden.sh
BACKUP_DIR=/backup/vaultwarden/$(date +%Y-%m-%d)
mkdir -p $BACKUP_DIR
sqlite3 /vw-data/db.sqlite3 ".backup '$BACKUP_DIR/db.sqlite3'"
cp -r /vw-data/attachments $BACKUP_DIR/
cp /vw-data/rsa_key* $BACKUP_DIR/

Schedule daily: 0 3 * * * /usr/local/bin/backup-vaultwarden.sh

Vaultwarden vs Bitwarden Official

Feature	Vaultwarden	Bitwarden (self-hosted)
RAM usage	50-100 MB	2+ GB
Database	SQLite	MSSQL
Docker images	1 container	10+ containers
Premium features	All free	$10/year or self-hosted
Maintenance	Minimal	Complex
Best for	Homelabs, small teams	Enterprise

Troubleshooting

Problem	Solution
Browser extension can’t connect	HTTPS is required; configure a reverse proxy with SSL
”Invalid credentials” after migration	Clear browser extension cache; re-enter server URL
2FA codes not sending via email	Verify SMTP_* environment variables; test with `/admin` diagnostics
Mobile app not syncing	Check server URL includes `https://`; verify port is accessible
Admin panel shows blank page	Regenerate ADMIN_TOKEN; clear browser cookies for the domain

Summary

One Docker container replaces a cloud subscription.
All Bitwarden clients work natively — browser, mobile, desktop, CLI.
End-to-end encrypted — server never sees your passwords.
Disable SIGNUPS_ALLOWED after setup and back up daily.

Frequently Asked Questions

What is Vaultwarden and how does it differ from Bitwarden?

Vaultwarden is an unofficial, lightweight Bitwarden-compatible server written in Rust. It implements the Bitwarden API, so all official Bitwarden clients (browser extensions, mobile apps, desktop apps, CLI) work with it. Unlike the official Bitwarden server (which needs MSSQL and 2+ GB RAM), Vaultwarden runs on SQLite with only 50-100 MB RAM, making it perfect for homelabs and small teams.

Is Vaultwarden secure enough for production use?

Yes. Vaultwarden uses the same end-to-end encryption as Bitwarden — your vault is encrypted with AES-256 on the client side before being sent to the server. The server never sees your master password or decrypted data. For production, ensure you use HTTPS, enable 2FA, and keep Vaultwarden updated.

Can I import passwords from other password managers?

Yes. All Bitwarden clients support importing from LastPass, 1Password, KeePass, Dashlane, Chrome, Firefox, and 40+ other sources. Export from your current manager, then import via the Bitwarden web vault or browser extension.

What happens if my Vaultwarden server goes down?

Bitwarden clients cache your vault locally (encrypted). You can still access all your passwords offline. When the server comes back online, the clients sync automatically. To prevent data loss, back up the SQLite database and attachments regularly.