Abstract violet and amber illustration representing Vaultwarden, a self-hosted password manager

Vaultwarden

Vaultwarden is an unofficial server implementation of the Bitwarden API, written in Rust. It works with every official Bitwarden client, browser extensions, mobile apps, desktop apps, the CLI, without any changes on the client side. The project started in 2018 as bitwarden_rs, built by developer Daniel Garcia because the official Bitwarden server ships as a stack of several .NET and database services, a lot of overhead for one person’s password vault running on a Raspberry Pi or a cheap VPS. It was renamed Vaultwarden in 2020 to avoid trademark confusion with Bitwarden, Inc. The two projects have never been affiliated, though one of Vaultwarden’s maintainers happens to also work at Bitwarden and contributes in their own time.

If you’ve already read our Vaultwarden vs Bitwarden comparison, you know the shape of the tradeoff: same client apps, same encryption model, a fraction of the resources to run it. This page stays narrower and more practical: what Vaultwarden actually does, whether it deserves your trust, and how to get it running.

What Vaultwarden actually does

Vaultwarden implements almost the entire Bitwarden API: encrypted vault storage, Sends, attachments, organizations with collections and groups, two-factor auth (TOTP, email, WebAuthn/FIDO2, YubiKey, Duo), emergency access, and an admin panel for managing users without touching a database console. Your Bitwarden apps have no idea they’re talking to Vaultwarden instead of Bitwarden’s own servers. Same API, same end-to-end encryption, same zero-knowledge design where your master password never leaves your device.

The difference sits entirely on the server. Official self-hosted Bitwarden runs as a set of containers: web, API, identity, a SQL Server or PostgreSQL database, and a few more. Vaultwarden is one Rust binary in one container, typically under 200 MB of RAM, backed by a SQLite file by default, though MySQL and PostgreSQL work too. That’s really the whole pitch.

Quick facts

The AGPL-3.0 license mostly matters if you plan to modify Vaultwarden’s code and run that modified version as a public service for other people, since then you’d owe them the source. Running an unmodified copy for yourself, on your own hardware, carries none of that obligation.

Is Vaultwarden safe to trust with your passwords?

That’s a fair question to ask before handing a piece of software your entire password vault, and it comes up often enough to answer directly instead of waving it off.

  • Open source under AGPL-3.0: every route and every crypto call sits on GitHub for anyone to audit. No closed binary quietly doing something else with your data.
  • Never touches Bitwarden’s actual infrastructure. Your vault stays on hardware you control, talking to an API your client apps already trust.
  • Not a weekend project: running under one name or another since 2018, 63,000+ GitHub stars, and a Docker image pulled over 100 million times.
  • Upfront about what it is: the README explicitly disclaims any relationship with Bitwarden, Inc., and asks that bugs be reported to Vaultwarden’s own maintainers, never Bitwarden’s support channels.

None of that makes it risk-free. It’s built by volunteers, not a company with a dedicated security team, and like any self-hosted service, how safe it is depends a lot on how you deploy it, not only on the code. One thing worth actively avoiding: the public “free instance” community servers floating around online. Running your password vault on a server you don’t control defeats the entire point of self-hosting one.

Installing Vaultwarden with Docker

Docker is the standard way to run this, and the one the project itself recommends. A minimal compose file:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.yourdomain.com"
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data:/data
    ports:
      - "127.0.0.1:8000:80"
docker compose up -d

Then open the domain you set, create your account, and only then move to the two steps below.

Two steps not worth skipping:

  1. Flip SIGNUPS_ALLOWED to false in your compose file and restart, once your account exists. Skip this and anyone who finds your vault’s URL can register their own account on it.
  2. Put a reverse proxy in front of it. Vaultwarden’s web vault needs HTTPS to function at all, since browsers block the Web Crypto API over plain HTTP; the project’s own wiki calls this “pretty much required.” Caddy, Nginx Proxy Manager, or Traefik with Let’s Encrypt all handle it in a handful of config lines. Our Jellyfin remote access guide walks through the same reverse-proxy pattern for a different app, and the logic carries over directly.

Notice the container binds to 127.0.0.1:8000 instead of being exposed directly. The reverse proxy is what the outside world talks to. Vaultwarden itself never should be.

Alternatives worth knowing about

Vaultwarden isn’t the only way to self-host a password manager, and it isn’t automatically the right one for everyone. If you’d rather run the official code than a community reimplementation, Bitwarden ships its own self-hosted release: heavier, but supported and maintained directly by the company that writes it. If you want to skip a server entirely, KeePassXC keeps an encrypted file synced through whatever you’re already using for that, Syncthing or Nextcloud, with nothing running around the clock. We line up all three, with setup steps and honest tradeoffs, in Self-Hosted Password Manager: Vaultwarden vs Bitwarden in 2026.

For more homelab security tooling, browse our Network & Security archive.

FAQ

What’s the actual difference between Bitwarden and Vaultwarden?

Bitwarden is the company, along with its official server and apps. Vaultwarden is a separate, community-built server that speaks the same API, so official Bitwarden apps connect to it without issue. Same clients, a much lighter backend underneath.

Is it legal to use Vaultwarden instead of Bitwarden’s own server?

Yes. Bitwarden’s clients are open source themselves, and Vaultwarden implements a documented, public API. This is the kind of interoperability open-source licensing exists to enable.

Do I have to pay for organizations or two-factor auth?

No. Vaultwarden unlocks features by default, organizations, TOTP generation, emergency access, that Bitwarden’s own hosted cloud normally reserves for paying customers.

Can I move an existing Bitwarden vault into Vaultwarden?

Yes. Bitwarden’s own export format, JSON or encrypted JSON, imports straight into a fresh Vaultwarden instance through the same import screen in the web vault.