Bitwarden self-hosted is the password manager vendor’s own server: the same code behind Bitwarden’s cloud service, packaged as Docker images you run on your own hardware instead of theirs. It’s free, officially maintained, and noticeably heavier than the community server most homelabbers actually mean when they say the same phrase.
If you arrived here from our Self-Hosted Password Manager: Vaultwarden vs Bitwarden comparison, you already know the general shape of this. We also cover Vaultwarden on its own page, since that lighter, unofficial server is what most people mean by “self-hosted Bitwarden.” This page stays narrower: what the real, vendor-built release is, how its two deployment options differ, what its license says, and when it earns its extra weight over the alternative.
What official self-hosted means here
Bitwarden, Inc. writes one codebase and ships it two ways: as the multi-tenant cloud service at vault.bitwarden.com, and as Docker images anyone can pull and run on their own server. Same application, same encryption, same client-facing API. Self-hosting moves where the encrypted vault lives, from Bitwarden’s infrastructure to yours. It doesn’t touch the part that matters most: your master password is derived and used only on your own device, never sent anywhere, no matter who runs the server.
The images are published to GitHub’s Container Registry rather than Docker Hub, and every one is signed with Cosign, so you can verify what you’re running. Its install scripts live in a separate repository, bitwarden/self-host.
Quick facts
- Distribution: ghcr.io, Cosign-signed images
- Deployment repo: github.com/bitwarden/self-host (710 stars)
- Latest self-host release: v2026.6.0
Standard vs Lite: two different installs
Bitwarden ships two self-hosted deployment shapes, and which one you land on changes the whole experience.
The standard deployment has existed since Bitwarden’s earliest days: eleven separate Docker containers, covering web, API, identity, admin, notifications and more, orchestrated through Docker Compose and backed by a Microsoft SQL Server database, x64 hardware only. Most enterprise self-hosting guides on bitwarden.com assume this version.
Lite is newer and much smaller: one container, your choice of SQL Server, MySQL, PostgreSQL, or SQLite, with ARMv7 and ARM64 support, so a Raspberry Pi is a genuinely supported target. It spent about three years in open beta as Bitwarden Unified before Bitwarden renamed and formally released it as Bitwarden Lite in December 2025.
| Standard | Lite | |
|---|---|---|
| Docker containers | 11, via Compose | 1 |
| Database options | Microsoft SQL Server only | SQL Server, MySQL, PostgreSQL, SQLite |
| CPU architecture | x64 only | x64, ARMv7, ARM64 |
| Runs on Raspberry Pi | No | Yes |
| Best for | Organizations, compliance, SSO | Individuals, families, home labs |
Tip: for personal or family use, Lite is almost always the deployment you want. Save the standard, eleven-container stack for cases where an organization specifically needs it.
Bitwarden self-hosted vs Vaultwarden, briefly
We went deep on this exact question in Self-Hosted Password Manager: Vaultwarden vs Bitwarden in 2026, so here’s the short version. Vaultwarden is a from-scratch reimplementation of Bitwarden’s server API, written in Rust by an independent developer with no official tie to Bitwarden, Inc., shipped as one small binary compatible with official client apps. Official self-hosted Bitwarden, Lite included, is the vendor’s actual code, with an upgrade path tied to Bitwarden’s own release notes. Vaultwarden stays lighter for a single vault. Official self-hosted earns its extra weight once you need SSO, SCIM, or vendor accountability behind the software.
What you need before you install anything
A registered domain pointed at your server, a TLS certificate or reverse proxy that issues one automatically, a working SMTP server for verification emails, Docker with Docker Compose, and a free installation ID and key. That last one is easy to miss: request it with just an email address at bitwarden.com/host, and the setup script won’t get past its first prompt without it.
Installing the standard deployment
The official repository ships a bitwarden.sh script (bitwarden.ps1 on Windows) that pulls the right containers and writes your config for you.
- Request your installation ID and key at bitwarden.com/host; both arrive by email within minutes.
- Download the setup script from the official repository into a working directory.
- Run the install command and answer its prompts: domain, database, and whether to auto-issue a Let’s Encrypt certificate.
- Start the stack, then open your domain and create your first account.
mkdir -p /opt/bitwarden && cd /opt/bitwarden
curl -Lso bitwarden.sh https://raw.githubusercontent.com/bitwarden/self-host/main/bitwarden.sh
chmod 700 bitwarden.sh
./bitwarden.sh install
./bitwarden.sh startLite swaps that eleven-container install for a single docker run or short Compose file pulling ghcr.io/bitwarden/lite, with the same domain, database, and SMTP prompts either way. Bitwarden’s own Lite deployment guide covers the exact flags for each supported database.
Don’t expose it directly. Put a reverse proxy in front of either deployment and keep the containers bound to localhost, same rule as Vaultwarden or anything else self-hosted holding your passwords.
The license, precisely
Bitwarden’s server code, in the bitwarden/server repository, ships under two licenses at once. Almost everything defaults to the GNU Affero General Public License v3.0. One folder, /bitwarden_license, carries a separate Bitwarden License v1.0 instead: source-available, not OSI-approved, covering enterprise-only features like SSO and directory sync. The separate bitwarden/self-host repository, holding only the installation scripts, is licensed GPL-3.0 on its own: three license files, two repositories, one product. None of it stops you from running the software for yourself; the restrictions only bite if you redistribute modified copies commercially.
Bitwarden self-hosted: pros and cons
- Vendor-written, vendor-maintained code, not a community reimplementation
- Lite deployment now officially supports ARM, including Raspberry Pi boards
- Self-hosting the core product costs nothing beyond your own hardware
- Every container image is Cosign-signed and verifiable before you run it
- Standard deployment means eleven containers and an MSSQL database for one person’s vault
- Needs a domain, TLS certificate, and working SMTP server before setup even finishes
- Self-hosted organizations lose the free 2-person org tier cloud accounts get, per Bitwarden’s own community forum
- Heavier to deploy and maintain than Vaultwarden for pure personal use
Who should actually run this
Reach for official self-hosted Bitwarden, Lite specifically, if you want the vendor’s real code without the full standard stack. Reach for the standard deployment for an organization that needs SSO, SCIM, or an audit trail with Bitwarden’s name behind it. If it’s just you, or you and your family, Vaultwarden gets you there with a fraction of the resources, and our Vaultwarden vs Bitwarden comparison walks through that decision in more depth than one fiche allows.
The reverse proxy and HTTPS setup either deployment needs is the same pattern covered in our Jellyfin remote access guide. Browse our Network & Security and Homelab archives for the rest of a self-hosted setup.
FAQ
Is self-hosting Bitwarden a good idea?
For an organization with compliance requirements, or a homelab owner comfortable maintaining a Linux server, yes. For casual personal use, it’s more than most people need: Vaultwarden or Bitwarden’s free cloud tier deliver the same encryption model with less to maintain.
Can Bitwarden actually be self-hosted, or is that just Vaultwarden?
Both exist. Bitwarden publishes its own official Docker images for self-hosting, Standard and Lite, and Vaultwarden is a separate, unofficial reimplementation that works with the same client apps. People often mean Vaultwarden when they say “self-hosted Bitwarden,” though the vendor’s own release is just as real.
How much does it cost to self-host Bitwarden?
Nothing to run the software itself, Standard or Lite. Organization features like SSO and directory sync still need a paid license tied to a Bitwarden subscription, and self-hosted Enterprise customers get self-hosting included at no extra charge.