Vaultwarden

What is Vaultwarden?

Vaultwarden is an open source, self-hosted password manager. It’s an unofficial server implementation of the Bitwarden API, written in Rust, that stores your passwords, passkeys, and secrets on your own server while you keep using the official Bitwarden browser extensions, desktop, mobile, and CLI apps. It used to be called bitwarden_rs.

What is Vaultwarden best for?

Individuals, families, and small teams who want a private, self-hosted password vault without paying a subscription — and homelabbers running on modest hardware. Because it’s a single lightweight binary, it runs comfortably on a small VPS or even a Raspberry Pi Zero, unlike the resource-heavy official Bitwarden server.

What can Vaultwarden do?

• Sync passwords, passkeys, notes, cards, and identities through the official Bitwarden clients
• Run organizations with collections, groups, and password sharing
• Use built-in two-factor auth: TOTP authenticator, email, FIDO2 WebAuthn, YubiKey, and Duo
• Send encrypted text and files with Bitwarden Send, plus file attachments and emergency access
• Store data in SQLite (default), MySQL/MariaDB, or PostgreSQL
• Deploy as one container via Docker, Docker Compose, Podman, or Kubernetes
• Manage users and settings through a built-in admin page, with SSO support

Is Vaultwarden free?

Yes — Vaultwarden is fully free and open source under the AGPL-3.0 license, with no paid tier. Self-hosting it also unlocks the features Bitwarden normally gates behind a paid plan (like advanced 2FA and organization sharing) at no cost, since you run the server yourself; you only pay for the hardware it runs on.

Where does Vaultwarden fall short?

• It’s unofficial and not affiliated with Bitwarden, Inc. If Bitwarden changes its client API, the maintainers have to catch up by reverse-engineering the change.
• It deliberately skips large-enterprise features — there’s no SCIM provisioning or directory sync, and some enterprise policies and the public API aren’t implemented.
• The web vault won’t load unless you serve it over HTTPS, so a reverse proxy or built-in TLS isn’t optional — and since this is your only copy of every credential, a lapsed backup means losing the whole vault.

What does Vaultwarden replace?

Vaultwarden is a self-hosted alternative to cloud password managers like 1Password, LastPass, and Dashlane. Instead of trusting a vendor’s proprietary cloud and paying per user, you keep every credential in a password manager you control. It’s also the lightweight way to self-host a Bitwarden-compatible server without running Bitwarden’s full multi-container stack.

FAQ

Is Vaultwarden open source? Yes. Vaultwarden is licensed under AGPL-3.0, and the full source is on GitHub. It is community-driven and not officially affiliated with Bitwarden.

Can I use it with the official Bitwarden apps? Yes. Vaultwarden implements the Bitwarden client API, so the official browser extensions, desktop, mobile, and CLI apps connect to it once you point them at your server URL.

What do I need to run Vaultwarden? A server with Docker and HTTPS (via a reverse proxy or its built-in TLS). It’s light enough for a small VPS or a Raspberry Pi, and SQLite means no separate database is required.

Is Vaultwarden a good 1Password or LastPass alternative? For individuals and small teams who want self-hosted control and no subscription, yes. If you need vendor support, SCIM, or directory sync for a large organization, a paid product or the official Bitwarden plans fit better.