← All Articles

Self-Hosting Your Password Manager: A Vaultwarden Deep-Dive

Vaultwarden is a self-hosted Bitwarden server that runs on almost nothing. The full setup walkthrough, backup strategy, and honest trade-offs before you trust it with your passwords.

Budget Homelab ·
dockerself-hostingsecurityvaultwarden

Running your own password manager sounds like the kind of thing that only makes sense if you’re also building your own operating system. It’s not. Vaultwarden takes about 20 minutes to set up, runs on almost nothing, and gives you the full Bitwarden client experience (browser extensions, mobile apps, autofill) with your data on your own server.

The trade-off: you’re responsible for backups and uptime. If you can handle that, and it’s not hard, this is one of the best self-hosting projects you can run. This piece covers what Vaultwarden actually is, whether it’s worth the trade-off, and a full walkthrough from empty Docker host to a working, backed-up vault.

Not sure Vaultwarden is the right pick for your situation? The self-hosted password manager comparison covers Vaultwarden, KeePassXC, Passbolt, and official Bitwarden side by side before you commit to a setup.

What Vaultwarden Is

Vaultwarden is an unofficial, open-source implementation of the Bitwarden server API, written in Rust. It’s significantly lighter than the official Bitwarden server, which requires multiple services and real resources, and it runs in a single Docker container with no external database needed. It works with all the official Bitwarden clients: the browser extension, iOS app, Android app, and desktop app all connect to it without modification, because as far as those clients know, they’re talking to Bitwarden.

What you get once it’s running:

The official Bitwarden cloud charges around $19.80/year for Premium, which unlocks TOTP, file attachments, and emergency access. Vaultwarden includes all of that for free, since you’re the one running the server.

Is It Worth Self-Hosting?

Here’s the comparison that matters before you commit any real passwords to this:

FeatureBitwarden FreeBitwarden Premium ($19.80/yr)Vaultwarden Self-Hosted
Passwords, notes, cardsYesYesYes
Browser extensionsYesYesYes
Mobile appsYesYesYes
TOTP generationNoYesYes (free)
File attachmentsNoYes (1GB)Yes
Organizations/sharing2 users freePaidYes (free)
Emergency accessNoYesYes (free)
CostFree$19.80/yearSelf-hosted (hardware cost only)

Vaultwarden gives you everything Bitwarden Premium offers, at the cost of running your own infrastructure. If you already have a homelab server sitting there doing other work, the marginal cost is close to zero. What you’re giving up is the commercial support and uptime guarantee that comes with a paid service. If your server goes down, you don’t have access to your vault until it’s back up. That’s the whole trade-off in one sentence, and it’s why the backup section below isn’t optional reading.

For most homelab users, this is one of those projects where the trade-off is obviously worth it. It’s lightweight, the clients are polished because they’re literally the same Bitwarden clients everyone else uses, and you stop paying a subscription for something you can run yourself on hardware you already own.

Prerequisites

On the SSL requirement: you have two practical options.

  1. Nginx Proxy Manager with Let’s Encrypt, for access via a real domain name. See the NPM setup guide if you don’t have a reverse proxy yet.
  2. Tailscale with a self-signed cert, for access only within your tailnet.

This walkthrough assumes NPM with a domain, since that’s what most people land on. If you’re Tailscale-only, adapt the domain references accordingly. For Docker basics, see Docker Compose for Beginners; this walkthrough assumes Docker and Docker Compose are already installed.

Step 1: Create the Directory

mkdir -p ~/docker/vaultwarden/data

Vaultwarden uses SQLite by default. The entire database lives in data/db.sqlite3. No separate database container required, which is most of why this thing is so light.

Step 2: Write the Docker Compose File

Create ~/docker/vaultwarden/docker-compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    ports:
      - "8543:80"
      - "3012:3012"
    volumes:
      - ./data:/data
    environment:
      TZ: America/New_York
      DOMAIN: https://vault.yourdomain.com
      SIGNUPS_ALLOWED: "true"
      WEBSOCKET_ENABLED: "true"
      ADMIN_TOKEN: ""
      LOG_LEVEL: warn
      EXTENDED_LOGGING: "true"

A few notes on the environment variables that actually matter:

DOMAIN: Set this to your full domain name, including https://. Vaultwarden uses this for HTTPS redirects, invitation links, emergency access URLs, and WebAuthn/passkey functionality. It has to match what your users will actually type. If it’s wrong, some features quietly stop working.

SIGNUPS_ALLOWED: Set this to "true" only long enough to create your account. Once you have accounts set up, set it to "false" and restart. You don’t want open registration sitting on a password manager exposed to the internet.

WEBSOCKET_ENABLED: "true": Enables real-time sync across devices. Vaultwarden uses WebSockets for this, and it’s worth having; without it, clients fall back to polling and sync feels laggy.

ADMIN_TOKEN: Leave blank initially. After setup, generate a secure token to protect the admin panel at /admin. Generate one with openssl rand -base64 48.

Step 3: Start Vaultwarden

cd ~/docker/vaultwarden
docker compose up -d

Check logs:

docker compose logs -f vaultwarden

You should see Vaultwarden start in a few seconds. It’s a small binary; it starts faster than almost any other container you’ll run in your stack.

Step 4: Set Up HTTPS With Nginx Proxy Manager

In NPM, add a new Proxy Host:

The WebSockets toggle in NPM is not optional. Vaultwarden depends on it for real-time sync between devices. After NPM issues the certificate, confirm that https://vault.yourdomain.com loads the Vaultwarden login page and shows the Bitwarden logo.

Step 5: Create Your Account

While SIGNUPS_ALLOWED is still "true", navigate to https://vault.yourdomain.com/#/register and create your admin account.

Use a strong master password. This is the password that encrypts everything in your vault. If you lose it, there is no recovery; Bitwarden’s encryption model means even you can’t get back in without it. Write it down. Put it in a physical safe. Store it somewhere it will survive your house burning down. That sounds dramatic, but this is the one password where losing it is genuinely catastrophic.

After creating your account, log in and confirm everything works before you move real passwords into it.

Step 6: Disable Signups

Set SIGNUPS_ALLOWED: "false" in your Compose file and restart:

docker compose up -d

Now only existing accounts can log in. If you want to add family members later, either create accounts for them from the admin panel (once ADMIN_TOKEN is set) or temporarily flip signups back on, have them register, then disable it again.

Step 7: Configure Browser Extensions

Install the official Bitwarden browser extension for Chrome, Firefox, Safari, or Edge. Open it, click the gear icon, and change the “Server URL” to https://vault.yourdomain.com. Log in with your email and master password. The extension connects to your Vaultwarden instance instead of Bitwarden’s cloud servers, and everything else works identically.

Step 8: Configure Mobile Apps

Install the official Bitwarden app on iOS or Android. On the login screen, tap the region selector and choose “Self-hosted,” then enter your server URL. Log in with your credentials, and enable biometric unlock after the first login; it’s dramatically more convenient than typing a master password on a phone keyboard.

Step 9: Enable the Admin Panel

Generate a secure admin token:

openssl rand -base64 48

Add the output to your Compose file’s ADMIN_TOKEN value and restart:

docker compose up -d

The admin panel lives at https://vault.yourdomain.com/admin. Enter the token to access it. From there you can invite users directly (bypassing the public registration flow), see all registered accounts, configure global settings, and run diagnostics.

Backups: This Is the Important Part

Your Vaultwarden data lives entirely in ~/docker/vaultwarden/data/, and the critical file inside it is db.sqlite3. That’s your whole password database. If you lose it without a backup, you lose your passwords.

Back this up. Every day. To somewhere off the server.

A simple cron-based approach:

# Run daily at 3am
0 3 * * * cp ~/docker/vaultwarden/data/db.sqlite3 ~/backups/vaultwarden-$(date +\%Y\%m\%d).sqlite3

# Keep 30 days of backups
0 4 * * * find ~/backups -name "vaultwarden-*.sqlite3" -mtime +30 -delete

Keep at least 7 days of backups at minimum so you can roll back if something goes wrong with a sync or an update. The database file itself is small, usually under a few MB, so retention isn’t a storage problem.

Local backups aren’t enough on their own. Copy them to a second location: another machine, a cloud storage bucket via rclone, or an external drive. Syncthing works well for this; see the Syncthing setup guide to mirror ~/docker/vaultwarden/data/ to another machine automatically.

Bitwarden also has a built-in export feature in the web vault. Periodically export an encrypted backup and store it somewhere separate from your regular file backups. An encrypted export is a format you can import into any Bitwarden-compatible client, which makes it a good last-resort recovery path.

Updating Vaultwarden

Updates are generally safe and quick:

cd ~/docker/vaultwarden
docker compose pull
docker compose up -d

Check the Vaultwarden releases page for breaking changes before major version updates. The project maintains a changelog with migration notes when something requires manual action.

Two-Factor Authentication

Enable 2FA on your Vaultwarden account before you move real passwords in. Go to Settings > Two-step Login in the web vault. TOTP (authenticator app style) is the easiest option to set up, and you scan a QR code to enable it.

You can use Vaultwarden itself as your TOTP generator, since Premium features (free here) let you store TOTP seeds alongside login credentials. Storing your vault’s own 2FA inside the vault is fine for most personal setups. If you want stricter security segmentation, keep TOTP in a separate authenticator app instead.

Emergency Access

Vaultwarden supports Bitwarden’s Emergency Access feature. You can designate a trusted contact who can request access to your vault in an emergency, which matters if you’re the only person in your household who manages the passwords. Configure it under Settings > Emergency Access in the web vault.

FAQ

Is Vaultwarden compatible with the official Bitwarden apps? Yes. Vaultwarden implements the Bitwarden server API, so all official Bitwarden browser extensions and mobile apps connect to it with no modification beyond pointing the server URL at your self-hosted instance.

Do I need a Bitwarden Premium subscription to use Vaultwarden? No. Vaultwarden gives you all Bitwarden Premium features (TOTP, file attachments, emergency access, organizations) for free when self-hosted.

What are the backup requirements for Vaultwarden? Back up the data directory mapped to /data inside the container. It contains the SQLite database with all your vault data. Daily backups copied off-server, not just onto the same disk, are strongly recommended.

What am I giving up compared to Bitwarden’s official server? Mainly commercial support and, on some client versions, hardware key (FIDO2/WebAuthn) support, which leans on the official server. For personal and family use, Vaultwarden covers everything else Bitwarden Premium offers.

What You’re Actually Getting

Switching from a paid password manager to Vaultwarden means no subscription fees, all of Bitwarden’s premium features, your data staying on hardware you control instead of a third-party server, and full client compatibility across every platform Bitwarden supports.

What you’re trading for that is the commercial support and uptime guarantee of a paid service. If your server goes down, your vault goes down with it. That’s exactly why the backup routine above isn’t a nice-to-have. Keep your server on a UPS if password access is critical infrastructure for you, and treat the backup cron job as part of the install, not an afterthought.

The combination of Vaultwarden, a reverse proxy, and a real backup habit makes for a genuinely secure, fully functional password manager that doesn’t rely on anyone else’s servers, at a cost of roughly zero if you already have somewhere to run it. Still weighing Vaultwarden against KeePassXC or Passbolt? The self-hosted password manager comparison puts all four options side by side, including who each one actually fits. For adding single sign-on across your broader homelab once this is running, see the Authelia SSO setup guide.