Your passwords are the keys to your entire digital life — and right now, they probably live on someone else’s server. Vaultwarden changes that: it lets you self-host a full password manager on hardware you control, using the same apps and browser extensions as Bitwarden.

Here’s how to set it up, why it’s one of the best first self-hosting projects you can do, and how to keep your vault safe once it’s running.

What is Vaultwarden, exactly?

Vaultwarden is a lightweight, open-source reimplementation of the Bitwarden server, written in Rust. You get the full Bitwarden experience — vaults, autofill, sharing — but hosted on your own machine instead of Bitwarden’s cloud.

The key difference from running the official Bitwarden server is resource usage: Vaultwarden runs comfortably in about 50 MB of RAM, where the official server wants a gigabyte or more. That makes it a perfect fit for a Raspberry Pi or a budget mini PC.

Vaultwarden vs Bitwarden cloud

Wondering whether to just use Bitwarden’s free cloud instead? Here’s the honest tradeoff:

Vaultwarden (self-hosted) Bitwarden cloud
Cost Free (your hardware) Free tier / $10/yr premium
Control Full None
Premium features All unlocked Paid
Uptime responsibility You Bitwarden
Setup effort ~30 minutes None

The cloud is genuinely excellent and I recommend it to non-technical friends. But if you’re already running a homelab, self-hosting gives you the same features for free, plus full ownership of your vault.

Why self-host your password manager?

  • You own your vault. Your encrypted passwords never leave your network.
  • Free premium features. Vaultwarden unlocks features Bitwarden charges for — like unlimited collections, file attachments, and emergency access.
  • Tiny footprint. About 50 MB of RAM means it runs happily alongside everything else.
  • No subscription. Host it once, use it forever, pay only for electricity.

Requirements

  • Docker and Docker Compose. Installed and running on your server.
  • A domain with HTTPS. This is non-negotiable: password managers rely on WebAuthn and the Web Crypto API, which browsers only enable on secure (HTTPS) origins. Without HTTPS, autofill and passkeys simply won’t work.

Step 1: The Docker Compose file

Create a docker-compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      DOMAIN: "https://vault.example.com"
    volumes:
      - ./vw-data:/data
    ports:
      - "8080:80"

A few notes:

  • The DOMAIN variable should match the public URL you’ll use — Vaultwarden uses it for links and passkeys.
  • The ./vw-data volume is where your encrypted vault lives. Protect it.

Step 2: Start it and enable HTTPS

docker compose up -d

Then put it behind a reverse proxy with HTTPS. With Caddy, it’s three lines:

vault.example.com {
    reverse_proxy localhost:8080
}

Caddy issues and renews the TLS certificate automatically, so you never have to think about it again.

Step 3: Connect your devices

Open your domain in a browser, create your master account, then install the Bitwarden app (or browser extension) on every device and point it at your self-hosted server. Your passwords sync instantly — and stay on your hardware.

Passkeys and 2FA

Once you’re set up, harden the account:

  • Enable two-factor authentication (TOTP or a security key). Your master password is the last line of defense — 2FA adds a second one.
  • Set up passkeys if your devices support them. Vaultwarden supports WebAuthn, which means passwordless, phishing-resistant login.
  • Generate a recovery code and store it somewhere safe, in case you lose your 2FA device.

Migrating from another password manager

Vaultwarden imports from most major managers. Export your vault as a CSV or JSON from your current tool (LastPass, 1Password, KeePass, Chrome, etc.), then use Bitwarden’s import feature inside the Vaultwarden web vault. It takes about five minutes, and you can delete the plaintext export file afterward.

Security tips (don’t skip these)

  • Use a strong master password. It’s the single key to everything — make it long, unique, and memorable. Enable 2FA on top of it.
  • Back up the vw-data folder. It holds your encrypted vault. Lose it and you lose every password. Schedule regular backups.
  • Keep Vaultwarden updated. Security fixes ship regularly; don’t let it drift for months. A docker compose pull && docker compose up -d does it.
  • Disable open sign-ups. After you’ve created your account, block new registrations so only you can add users.

Common mistakes to avoid

  • Skipping HTTPS. Without it, browsers block the crypto APIs and nothing works — autofill, passkeys, everything.
  • Forgetting backups. A password vault you can’t restore is worse than no vault at all.
  • Exposing the raw port. Always go through your reverse proxy; never forward 8080 straight to the internet.

FAQ

Is Vaultwarden safe to self-host?

Yes — it’s a widely used, actively audited open-source project. Your vault is encrypted client-side, so even if someone reads the database, they can’t read your passwords without your master password.

How much does it cost to run Vaultwarden?

Essentially nothing beyond your server’s existing power draw. It adds negligible load to a homelab you’re already running.

Do I need a domain for Vaultwarden?

Yes, for HTTPS — which is required for it to work at all. A cheap domain ($10/year) is all you need.

FAQ

Can Vaultwarden replace my company’s password manager?

For a small team, yes — Vaultwarden supports organizations, collections, and per-user permissions. For larger enterprises with strict compliance requirements, a managed commercial solution may be a better fit.

Bottom line

Vaultwarden is the single best “first self-hosted app” for security-minded people. It’s cheap to run, surprisingly easy to set up, and it gives you full ownership of your passwords. Pair it with a solid homelab foundation and you’re set.