Self-Hosted Password Manager: Vaultwarden vs Bitwarden in 2026

Vaultwarden is the self-hosted password manager most of the homelab crowd actually runs: a lightweight, unofficial server that speaks Bitwarden’s own protocol, so the official Bitwarden apps and browser extensions connect to it like it’s the real thing. Bitwarden also publishes its own official self-hosted release if you’d rather run the vendor’s code directly, and KeePassXC stays fully offline if you’d rather skip a server altogether.

What does “self-hosting a password manager” actually mean?

With a cloud password manager, Bitwarden’s own hosted plan, 1Password, Proton Pass, whichever one, your encrypted vault lives on somebody else’s server. You still hold the only key, encryption happens on your device before anything gets uploaded, but the ciphertext itself sits on infrastructure you don’t control. Self-hosting flips that: you run the server software yourself, on a VPS, a mini PC, or whatever box is already handling Jellyfin or Immich, and the encrypted vault never leaves hardware you own. The client-side encryption model doesn’t change either way. What changes is who’s responsible for keeping the server patched, backed up, and actually reachable when you need it.

Why homelabbers self-host their password manager

The reasoning tracks almost exactly with why people move from Plex to Jellyfin: subscriptions creep, and once you’re already running a homelab, one more self-hosted service costs you disk space and RAM instead of a monthly fee. Bitwarden’s free tier is already generous, so cost usually isn’t the main driver here. It’s more that a password vault is exactly the kind of thing people want to fully control once they’ve gotten comfortable running everything else themselves. Self-hosting it also means your login patterns and vault-access history aren’t sitting in a third party’s database at all, not even in encrypted form.

• Full control over where your vault data physically lives
• No per-seat subscription for personal or family use
• Works with every official Bitwarden client: mobile, desktop, browser extension
• Nothing about your vault-access habits sits in a vendor’s analytics

Is it actually safe to self-host your password manager?

Before the case for it, the honest costs, since a password vault isn’t a place to only hear the upside:

• You are the one who patches it, backs it up, and keeps the TLS certificate valid
• If your server or backup disappears, so does every password you own
• No official 24/7 support line to call when something breaks
• Needs a working reverse proxy or VPN before it’s safe to reach from outside your home

It’s a fair question, and there’s a real school of thought that says no, don’t do it. A password vault is a uniquely bad place to cut corners. If your Jellyfin box goes down for the weekend, you just don’t get to watch a movie. If your password server goes down and you didn’t plan for that, you can end up locked out of your own accounts. The critics get one thing right: security here rests entirely on how carefully you run your own server, not on Bitwarden’s, Vaultwarden’s, or Proton’s security team. Skip HTTPS, reuse a weak admin token, never touch your backups, and you’ve built something less safe than any mainstream hosted option. That’s a real cost, not a hypothetical one, and I don’t think it’s fair to wave it away.

The counter-argument, and the reason so many homelabbers do this anyway, is that the encryption model doesn’t actually change. Your vault is end-to-end encrypted on your device before it ever reaches the server, whether that server is Vaultwarden running in your garage or Bitwarden’s own cloud. Self-hosting mostly moves the trust boundary from a company’s infrastructure to your own infrastructure and your own habits. If you already run a tight homelab, patch things promptly, and keep backups you’ve actually tested, that’s a trade worth making. If you know you won’t keep up with updates, a hosted password manager is the safer default, and there’s no shame in picking that instead.

Vaultwarden vs Bitwarden: what’s actually different?

Both speak the same client-facing protocol, so the confusion is understandable, but they’re built by entirely different teams for different jobs.

Vaultwarden, maintained by dani-garcia, is a from-scratch reimplementation of Bitwarden’s server API written in Rust. Its GitHub page says plainly that “this project is not associated with Bitwarden or Bitwarden, Inc.,” and it used to be called bitwarden_rs before it was renamed specifically to avoid trademark confusion. One of its maintainers happens to work at Bitwarden and contributes in a personal capacity, but the project itself runs independently. What makes it the default pick for homelabbers is size: it ships as a single small binary that talks to any official Bitwarden client, built, in the project’s own words, for “self-hosted deployment where running the official resource-heavy service might not be ideal.”

Bitwarden’s own official self-hosted release is the vendor’s actual code, not a reimplementation, and it now comes in two shapes. The original “standard” deployment runs eleven separate Docker containers behind a Microsoft SQL Server database, aimed at organizations that need the full compliance and audit stack. A newer “lite” deployment collapses that down to a single container and adds support for SQLite, MySQL, and PostgreSQL alongside MSSQL, plus ARM support for anyone running it on a Raspberry Pi-class board. That’s a real narrowing of the gap with Vaultwarden, though Vaultwarden is still the lighter, more established option if you’re the only one using it.

The best self-hosted password managers at a glance

Four options cover almost every self-hosted, or self-hosted-adjacent, need in this space.

	Vaultwarden	Bitwarden (self-hosted)	KeePassXC	Proton Pass
License	AGPL-3.0, unofficial	Official Bitwarden code, open source	GPLv3, official	Proprietary, cloud-only
Deployment	Single lightweight Docker container	1 container (Lite) or 11 containers via Compose/Kubernetes (Standard)	No server; local encrypted file	No deployment; fully hosted by Proton
Works with official Bitwarden apps	Yes	Yes, it is Bitwarden	No, own apps only	No, own apps only
Typical footprint	Single small Rust binary	Heavier; Standard needs MSSQL, Lite is much lighter	Minimal desktop app, no server at all	N/A, nothing to run
Team & sharing features	Organizations, collections, groups	Full org support, SSO, SCIM (Enterprise)	None built in, manual file sharing only	Sharing on Business plans
Cost	Free	Free to self-host; some org features need a paid license	Free	Free tier; paid plans for extras
Best for	Homelabbers wanting the smallest footprint	Organizations needing vendor-supported, compliant code	Anyone wanting zero server exposure	Anyone who wants E2EE with no maintenance at all

How to self-host Vaultwarden with Docker

Vaultwarden’s own documentation points to its official container images, published to GitHub Container Registry, Docker Hub, and Quay.io. Here’s the minimal setup, straight from the project’s README:

docker run --detach --name vaultwarden \
  --env DOMAIN="https://vw.yourdomain.tld" \
  --volume /vw-data/:/data/ \
  --restart unless-stopped \
  --publish 127.0.0.1:8000:80 \
  vaultwarden/server:latest

Anything you plan to keep running long-term is better off in a Compose file:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vw.yourdomain.tld"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 127.0.0.1:8000:80

1. Pull and start the container with docker compose up -d, bound to localhost only for now.
2. Put a reverse proxy in front of it, Caddy, Nginx Proxy Manager, or Traefik, with a real TLS certificate. Vaultwarden’s web vault needs HTTPS because the browser’s Web Crypto API refuses to run without a secure context.
3. Set an ADMIN_TOKEN environment variable so the /admin backend, where you manage users and settings, isn’t wide open to anyone who stumbles onto the URL.
4. Point the official Bitwarden apps and browser extension at your own domain instead of bitwarden.com, from the app’s settings screen, before you log in.
5. Set up a scheduled backup of the /data volume. That’s your entire vault, and Vaultwarden’s own maintainers say plainly that they can’t recover it for you if it’s gone.

What about KeePassXC and Proton Pass?

Vaultwarden and Bitwarden both need a server running somewhere, which is exactly what KeePassXC skips. It’s a fully offline, cross-platform password manager that stores everything in a single encrypted .kdbx file on your own device, no server, no built-in sync. Want it on more than one device? You sync the file yourself, through your own Nextcloud, Syncthing, or a cloud drive, which arguably makes it the simplest self-hosted setup of the bunch, since there’s no server to secure in the first place. It’s held up to outside scrutiny too: KeePassXC 2.7.9 earned a Security Visa from ANSSI, France’s national cybersecurity agency, after passing its first-level security certification.

Proton Pass is worth mentioning mainly to rule it out. It’s end-to-end encrypted like the others, but it isn’t self-hosted at all. Proton runs the servers, and you’re trusting their zero-knowledge encryption claims instead of your own infrastructure. It’s a reasonable middle ground if you’ve decided self-hosting genuinely isn’t for you but you still don’t want a vendor able to read your vault. Just don’t confuse it with the self-hosted options above, it’s a different category of tool wearing similar marketing.

Teams and small businesses researching this space will also run into Passbolt, an open-source, self-hostable option built around OpenPGP-based sharing and role-based access. Worth a look if Vaultwarden’s simpler organization features don’t quite cover what you need.

Which one should you actually run?

If you’re running a homelab and want the least friction, Vaultwarden is the answer, and it’s the one this guide leans on for a reason: tiny footprint, works with every official Bitwarden client, and a community large enough that most problems have already been solved on the project’s Discourse forum or Matrix channel. Reach for Bitwarden’s own lite self-hosted deployment instead if you specifically need vendor-supported code for compliance reasons, or you’re deploying this for an organization rather than yourself. Pick KeePassXC if running any server at all, even a small one, is more than you want to maintain. And if you read all of this and decided self-hosting just isn’t for you, that’s a legitimate outcome too. Proton Pass or Bitwarden’s own hosted plan will still give you real end-to-end encryption without any of the maintenance.

If you’re already self-hosting Ollama and Open WebUI, or running Jellyfin for your own media library, a password vault is a natural next thing to add to the same box. Same Docker Compose habits, just protecting something more sensitive than movie recommendations this time.

FAQ

Is Vaultwarden safe to use?

Vaultwarden uses the same end-to-end encryption model as Bitwarden, so your vault is encrypted on your device before it ever touches the server. In practice, its safety depends more on how you run it, HTTPS, a real admin token, staying current on updates, than on the software itself. It’s got a large, active community and years of real-world use behind it.

Is Vaultwarden the same thing as Bitwarden?

No. Vaultwarden is an independent, unofficial reimplementation of Bitwarden’s server API, built and maintained separately from Bitwarden, Inc. It’s compatible with official Bitwarden apps, but it isn’t Bitwarden’s own code, and Bitwarden doesn’t support it.

Do I need Docker to self-host a password manager?

Not strictly. Vaultwarden can be built from source, and Bitwarden’s standard deployment predates its current container setup. In practice, nearly everyone runs Vaultwarden or Bitwarden’s lite deployment in Docker. It’s the path both projects document first, and the one with the most community troubleshooting if something goes wrong.

Can I use the official Bitwarden apps with Vaultwarden?

Yes, that’s the entire point of Vaultwarden. Every official Bitwarden app, mobile, desktop, every browser extension, has a setting to point it at a custom server URL instead of bitwarden.com. Set that to your own domain and the apps work exactly as they would against Bitwarden’s real servers.

What happens if my self-hosted password manager server goes down?

You lose access to your vault until it’s back up. That’s the real cost of self-hosting one. Whatever’s already cached locally in an app you were logged into usually keeps working for a while, but new logins and syncing stop. It’s why a tested backup and a bit of uptime monitoring matter more here than for almost anything else you self-host.

Is self-hosting a password manager legal?

Yes. Vaultwarden, Bitwarden’s self-hosted release, and KeePassXC are all legitimate open-source or officially published software, no different legally from running any other program on hardware you own.

A password vault fits naturally alongside the rest of a privacy-minded homelab. Our Best Self-Hosted AI Tools guide covers Ollama, Open WebUI, and n8n for the same self-hosted-first approach, and our Jellyfin vs Plex comparison is where a lot of this audience’s homelab habit started in the first place. The Homelab hub and Network & Security hub round up everything else in this silo as we publish it.