Vaultwarden: Self-Hosted Password Manager Server
/vaultwarden
Vaultwarden is worth running the moment you already self-host other services and don't want to pay Bitwarden's hosting fee for a small household or team. It reimplements the Bitwarden Client API in Rust instead of wrapping the official .NET server, trading that server's resource footprint for a lighter one. The catch: it's unofficial, so bugs go to the Vaultwarden maintainers, not Bitwarden's support.
What is Vaultwarden?
Vaultwarden is an unofficial server that reimplements the Bitwarden Client API in Rust, letting the official Bitwarden apps and browser extensions talk to a self-hosted backend instead of Bitwarden's cloud. It was previously called bitwarden_rs and was renamed to avoid trademark confusion with Bitwarden, Inc. It ships as a Docker container built on the Rocket web framework.
What Vaultwarden supports
- ✓Personal vaults, Send, attachments, and website icons — the everyday Bitwarden features work as-is against Vaultwarden's API.
- ✓Organizations support collections, password sharing, member roles, groups, event logs, admin password reset, and policies, not just personal vaults.
- ✓Two-factor login covers TOTP authenticator apps, email codes, FIDO2 WebAuthn, YubiKey, and Duo.
- ✓Emergency Access lets a trusted contact request entry to your vault if you're unreachable.
- ✓A separate Vaultwarden Admin Backend page manages the instance itself, invites, and diagnostics — distinct from the regular Bitwarden web vault.
- ✓Ships with a modified build of the official web vault client bundled straight into the container image.
When Vaultwarden makes sense
- •A family or small team that wants one shared vault without paying per-seat for Bitwarden's cloud.
- •Homelab operators who already run a reverse proxy and Docker host and want the vault to live next to their other self-hosted services.
- •Anyone who needs Organizations features (shared collections, groups, policies) but doesn't want the overhead of the official server.
- •Privacy-conscious users who want vault data to never leave hardware they control.
Running Vaultwarden with Docker
The README's recommended path is the official container image, published to ghcr.io, docker.io, and quay.io. Pull it and run it with a persistent volume: ``` docker pull vaultwarden/server:latest docker run --detach --name vaultwarden \ --env DOMAIN="https://vw.domain.tld" \ --volume /vw-data/:/data/ \ --restart unless-stopped \ --publish 127.0.0.1:8000:80 \ vaultwarden/server:latest ``` That binds the container to localhost only, so you still need a reverse proxy in front of it — the web vault requires HTTPS because it depends on the browser's Web Crypto API, which refuses to run outside a secure context. Vaultwarden is built on the Rocket web framework, which has its own built-in TLS support, but the README's own recommendation is to put a reverse proxy in front anyway. Building from source is also documented in the project's wiki for anyone who doesn't want to run the container image.
Why developers choose Vaultwarden
- ✓A single native Rust binary instead of the official server's full stack, so it needs meaningfully less memory to run — the whole reason the README gives for using it over the official service.
- ✓Feature parity is close: Organizations, Send, attachments, emergency access, and multiple 2FA methods (TOTP, email, FIDO2 WebAuthn, YubiKey, Duo) all work, not just the personal vault basics.
- ✓Talks to the same official Bitwarden apps — desktop, mobile, browser extension, CLI — so nobody on the team has to learn a different client.
- ✓Ships as a container with the web vault already bundled in, so there's no separate front-end to build or host.
- ✓Active support channels: Matrix chat, GitHub Discussions, and a Discourse forum, separate from Bitwarden's own support so issues don't get lost there.
What Vaultwarden does not cover
- △It's unofficial. Vaultwarden is not affiliated with Bitwarden, Inc., so bugs and edge cases in client compatibility are the Vaultwarden maintainers' problem to chase down, not Bitwarden's support team's.
- △HTTPS is mandatory for the web vault to work at all, since the Web Crypto API refuses to run outside a secure context — that means a reverse proxy and a real certificate before you can log in through the browser.
- △Community-packaged builds (outside the official container images) can lag behind the latest release or configure things differently, per the project's own wiki warning.
- △There's no official migration or support guarantee if you lose data — the README puts the burden of backups on you and says it can't be held liable for data loss.
Other self-hosted password manager options
Frequently asked questions
Vaultwarden implements the same Bitwarden Client API, so yes — the official desktop app, mobile apps, browser extensions, and CLI all connect to it exactly as they would to Bitwarden's own cloud, just pointed at your own domain instead.
Vaultwarden is free and open source, released under the AGPL-3.0 license with its full source on GitHub. There's no paid tier or subscription for the server itself — you provide your own hosting instead of paying Bitwarden for theirs.
Vaultwarden is an unofficial, community-built reimplementation of the same Client API in Rust, not Bitwarden's own code — it was previously named bitwarden_rs. It targets the same features but is maintained separately from Bitwarden, Inc., and one active maintainer happens to work at Bitwarden on their own time.
Vaultwarden runs as a single Rust binary rather than the official server's full stack, so it's built to need meaningfully less memory — that's the resource-heaviness the README cites as the reason to use Vaultwarden. No specific benchmark numbers are published, so treat any exact figure you see elsewhere with caution.
Vaultwarden supports authenticator app TOTP codes, email codes, FIDO2 WebAuthn, YubiKey, and Duo for two-factor login, matching the methods the official Bitwarden clients expose in their settings.
Vaultwarden's web vault won't work without HTTPS, because the browser's Web Crypto API refuses to run outside a secure context. The README's suggested path is a reverse proxy handling TLS in front of the container; Vaultwarden's own wiki has an HTTPS setup guide and reverse proxy examples for common setups.
The problem it solves
The official Bitwarden server is resource-heavy, and its own maintainers describe it as not the best fit for self-hosted deployment, per Vaultwarden's README. Vaultwarden fills that gap with a from-scratch Rust reimplementation of the same Client API, built for the individuals, families, and small organizations its maintainers say they're targeting — not enterprises already paying for the official service.
Who should try it — and who should skip
Try Vaultwarden if you already run Docker somewhere, don't mind being the one who reads the wiki when something breaks, and want Organizations-level sharing for a family or a small team without a subscription. Skip it if you need Bitwarden's own support contract, can't commit to setting up HTTPS and backups yourself, or your team is big enough that the official server's overhead stops mattering.
Related repositories
Still deciding about vaultwarden?
One click hands the question to an AI along with this page — see what it says about vaultwarden.