Security

Setting Up a Self-Hosted Password Manager with Vaultwarden

2026-06-15 · 12 min read · views

Note: This article was updated on 2026-06-16 to reflect the latest Vaultwarden 1.32.x release (based on upstream Bitwarden 2024.12.x compatibility) and new security recommendations from the 2024 Verizon Data Breach Investigations Report. Some configuration paths and feature names were updated for alignment with the current version.

What You'll Learn

1. Why Vaultwarden Instead of Bitwarden?

Bitwarden is excellent — it is open source, independently audited, and widely trusted. But the official self-hosted Bitwarden server (the bitwarden/server Docker image) has several practical limitations for homelab users:

In short: Vaultwarden is the Bitwarden server, reimplemented in Rust, stripped of enterprise bloat, and optimized for self-hosters. It is fully API-compatible with every Bitwarden client — desktop, mobile, browser extension, and CLI. You manage it the same way, sync the same way, and use every premium feature the same way, without paying a dime.

I've been running Vaultwarden on my Dell server since 2023, replacing the free Bitwarden cloud service. The Docker container uses less than 50MB of RAM and stores everything in a single SQLite file that I back up daily. I set the server URL to https://vaultwarden.fulankizao.com and it's been stable for over a year.

For more details on the compatibility guarantees, see the Vaultwarden GitHub repository. The project has over 40,000 stars and is actively maintained with releases roughly every 4-6 weeks, tracking upstream Bitwarden API changes.

2. Prerequisites

You do not need a dedicated VPS. Vaultwarden runs comfortably on a Raspberry Pi 4 or a low-tier cloud VM (e.g., a $5/month Linode or DigitalOcean droplet). Its minimal resource footprint means you can even run it alongside other services on the same machine.

3. Deploying Vaultwarden with Docker Compose

The cleanest way to run Vaultwarden is with Docker Compose. Create a directory for the project and add the following docker-compose.yml:

mkdir -p ~/vaultwarden
cd ~/vaultwarden
nano docker-compose.yml
# docker-compose.yml
version: '3.8'

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    volumes:
      - ./vw-data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=false
      - INVITATIONS_ALLOWED=true
      - ADMIN_TOKEN=your_strong_admin_token_here
      - SMTP_HOST=smtp.yourprovider.com
      - SMTP_FROM=vaultwarden@yourdomain.com
      - SMTP_SECURITY=starttls
      - SMTP_PORT=587
      - SMTP_USERNAME=your_smtp_user
      - SMTP_PASSWORD=your_smtp_password
    ports:
      - "127.0.0.1:8080:80"
    networks:
      - proxy

networks:
  proxy:
    external: true

Key configuration notes:

The networks: proxy: external: true line assumes you already have a reverse proxy container running on a shared Docker network named proxy. If you do not have one yet, you can either create the network first (docker network create proxy) or skip the network binding and expose Vaultwarden directly with Let's Encrypt via the Vaultwarden built-in ACME support.

4. Setting Up the Reverse Proxy

Vaultwarden must be served over HTTPS. Here is a quick Traefik configuration example (add a dynamic config file or router rule in your Traefik setup):

# Traefik dynamic config (YAML)
# Save as /etc/traefik/dynamic/vaultwarden.yml or add to your config provider
http:
  routers:
    vaultwarden:
      rule: "Host(`vault.yourdomain.com`)"
      service: vaultwarden
      tls:
        certResolver: letsencrypt
      middlewares:
        - secHeaders

  services:
    vaultwarden:
      loadBalancer:
        servers:
          - url: "http://vaultwarden:80"

If you use Nginx instead, here is a complete server block. See our Nginx reverse proxy guide for a detailed walkthrough of each directive:

# /etc/nginx/sites-available/vaultwarden
server {
    listen 80;
    server_name vault.yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

# Then run certbot to enable HTTPS:
# sudo certbot --nginx -d vault.yourdomain.com

After configuring the proxy, enable the site and test:

sudo ln -s /etc/nginx/sites-available/vaultwarden /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

5. Initial Setup and User Management

With the reverse proxy in place and HTTPS active, visit https://vault.yourdomain.com. You will see the Vaultwarden login page. Navigate to /admin and enter the ADMIN_TOKEN you configured. You will see the admin dashboard with:

🛡️ Security: Admin Token

Change your admin password immediately after first login. The ADMIN_TOKEN environment variable is only used for initial authentication — after first successful login, Vaultwarden hashes it and stores it in the database. You can then remove the ADMIN_TOKEN env var from docker-compose.yml to eliminate the plaintext secret.

To invite a user, go to the admin panel, click "Users" → "Invite User", enter their email, and click send. The user will receive an email with a link to create their master password and install a client. After the user registers, you can approve or deny access from the admin panel.

6. Backing Up Your Vault

Your vault data is stored in the ./vw-data directory (or wherever you mapped the volume in docker-compose.yml). The critical files are:

A simple backup script:

#!/bin/bash
# backup-vaultwarden.sh
BACKUP_DIR="/path/to/backup"
DATE=$(date +%Y%m%d_%H%M)
docker stop vaultwarden
cp -a ~/vaultwarden/vw-data "$BACKUP_DIR/vw-data-$DATE"
docker start vaultwarden
echo "Backup completed: $BACKUP_DIR/vw-data-$DATE"

💡 Best Practice: Backup Strategy

Refer to our Backup Strategies for Self-Hosted Services guide for a comprehensive discussion of backup rotation, encryption, and off-site storage methods.

7. Connecting Clients

One of Vaultwarden's greatest strengths is that it works with every official Bitwarden client without modification. Here is how to connect each one:

Browser Extensions

Install the Bitwarden extension for Chrome, Firefox, or Edge. Open extension settings, click "Self-hosted" or "Server URL", and enter https://vault.yourdomain.com. The extension will connect to your server.

Mobile Apps

Install Bitwarden from the Google Play Store or Apple App Store. Tap the settings gear icon, scroll to "Self-hosted Environment", and enter your server URL.

Desktop App

Download the Bitwarden desktop app from bitwarden.com/download. Open Settings → Account → Server URL → Self-hosted.

CLI

npm install -g @bitwarden/cli
bw config server https://vault.yourdomain.com
bw login
bw sync

8. Performance and Resource Usage

Vaultwarden is designed to be lightweight. Here are the real-world resource numbers from a production homelab deployment:

For comparison, the official Bitwarden server requires 2 GB RAM, a SQL Server container, and at least 10 GB of disk. Vaultwarden achieves this efficiency through its Rust implementation: no garbage collector, no virtual machine overhead, and a single binary that handles everything.

9. Security Best Practices

10. Advanced Configuration

For the complete list of configuration options, see the Vaultwarden Wiki on GitHub.

FAQ

Can I migrate from another password manager to Vaultwarden?

Yes. Vaultwarden supports importing data from over 40 different password managers and formats, including Bitwarden (JSON/CSV), LastPass, 1Password, Dashlane, KeePass, and Chrome/Firefox/Safari built-in password managers. Go to the web vault, navigate to Tools > Import Data, select your source format, and upload the exported file. Most imports preserve folders, notes, and custom fields.

What happens if Vaultwarden goes down — do I lose access to my passwords?

No. The Bitwarden clients cache your vault locally. All passwords, autofill, and basic functionality work offline — you only need the server to sync changes across devices. When the server comes back online, changes sync automatically. Your master password is never sent to the server; it is derived client-side.

Can I run Vaultwarden without Docker?

Yes. Pre-compiled binaries are available for Linux, macOS, and Windows on the releases page. However, Docker is strongly recommended for easy updates, consistent environment, and the ability to run alongside other services. Running without Docker requires manual management of the SQLite database, attachments directory, and process supervision.

Does Vaultwarden support SSO / SAML / OAuth?

Not natively, but you can achieve this by placing Vaultwarden behind an authentication proxy like Authelia or OAuth2 Proxy. These tools can add OIDC/SAML/OAuth authentication in front of any HTTP service, including Vaultwarden. Users authenticate through the proxy, and the proxy forwards the authenticated session to Vaultwarden.

How do I update Vaultwarden without downtime?

Vaultwarden updates are fast with Docker. Pull the new image (docker compose pull) and restart (docker compose up -d). The restart typically takes under 2 seconds. For zero-downtime updates, run two Vaultwarden instances behind a load balancer — Vaultwarden's stateless API design makes this straightforward.

Summary

Vaultwarden is the easiest way to self-host a production-grade password manager. It is lightweight (10 MB RAM), API-compatible with all Bitwarden clients, and includes every premium feature for free. With Docker Compose, a reverse proxy, and automated backups, you can deploy and maintain it with minimal effort.

🔐 The Bigger Picture

According to the 2024 Verizon Data Breach Investigations Report, credential theft was a factor in 31% of all breaches — the #1 attack vector. Using a password manager with unique, complex passwords for every site is the single most effective security measure you can take. Self-hosting that password manager with Vaultwarden means that your secrets never touch a third-party server.

← Back to Home

Related Articles

References: 2024 Verizon Data Breach Investigations Report — credential theft cited as a factor in 31% of breaches. Vaultwarden GitHub Repository — official project source code and documentation. Resource usage benchmarks are from community testing on Ubuntu 22.04 LTS with Docker 24.x; individual results may vary.

About the Author

Frankie is a self-hosting enthusiast and DevOps practitioner with over 8 years of experience deploying and maintaining production Linux servers, Docker environments, and homelab infrastructure. He writes practical, hands-on guides to help others take control of their own infrastructure.