Links checked 2026-10-14
Self-hosting Vaultwarden
The self-hosted route instead of Bitwarden, 1Password.
The container is quick to start. The install that matters is the one where HTTPS, sign-ups, the admin token and a tested off-server backup are all in place first.
What it is
An independent server that implements the Bitwarden client API, written in Rust, so the official Bitwarden apps and browser extensions can sync to a host you run. The project's own README calls it an alternative implementation and points out that its support channels are not Bitwarden's.
What you actually need
This is the reader's own hardware and configuration, not a price. We describe what a job needs; we do not put a figure on what self-hosting costs, because that depends on the provider, the term and the disk you choose.
- The server
- A small VPS. The container is light; the significance of the data is not.
- How it installs
- The container images the project publishes, with a persistent data volume.
- Data store
- The data directory holds the vault database, with the project's wiki covering larger database options for bigger installs.
- What grows
- That directory is small as data goes, and it is the single most important thing you will ever back up.
Before it is safe to expose
- HTTPS before you use it — the project's README states that its API only works when HTTPS is enabled
- A reverse proxy, which the README suggests as the way to terminate that TLS
- Public sign-ups disabled and an administrator token set before it is reachable
- A backup of the data directory stored somewhere other than the server, plus a restore you have tested
- A mail relay if you want invitations and email-based two-factor codes
The trade-offs, specifically for Vaultwarden
- Vaultwarden is not Bitwarden. It is an independent implementation of the same client API, its README carries a disclaimer for that reason, and its maintainers ask that you do not use Bitwarden's support channels. A client update can break compatibility until the project catches up.
- You become the custodian of the credentials your household or team depends on. A lost backup is a lost vault, and a password manager is precisely the thing whose contents nobody has memorised.
- It targets personal and small-team use rather than the compliance and admin features an enterprise buyer is checking for.
- An internet-facing service holding credentials needs its releases and security advisories watched closely, by you.
And the six things you own from now on
These are true of every tool in this section, including Vaultwarden. They are also the reason to decide against self-hosting, which is a legitimate decision.
- You own the updates. Security releases have to be applied by you, on your schedule, and a project that stops publishing releases becomes your problem to notice.
- You own the backups, and a backup is not a backup until you have restored from it once.
- You own the uptime. There is no status page to watch and no support line to call when it stops answering.
- You own the security patches, the TLS certificate, the reverse proxy and the firewall in front of it.
- You are the on-call rota. The failure mode nobody plans for is being the only person who knows how the thing was set up.
- The hardware has a running cost and a lifetime. Disks fail, and the replacement is on you.
What you give up
- A vendor's security programme, audit trail and support line
- The guarantee that the official clients will always work against your server
What you gain
- Vault data stays on your hardware while you keep using the official clients
- No per-seat subscription for the server itself
Elsewhere in the index
The box it runs on
A small VPS. The container is light; the significance of the data is not. That machine is the purchase this page is really about, and it is the one number we will not invent for you: the right size depends on the provider, the term and the disk, so check it on the provider's own page.
Hostinger
Hostinger's VPS product is the closest fit to a self-hosted application: its own page advertises root access, Docker and NVMe storage, with data centres in several regions.
See Hostinger's plansRead Hostinger's published pricing ↗DigitalOcean
Virtual machines billed as you use them, with separate volumes, snapshots and object storage for the parts you want to keep outside the server.
See DigitalOcean's plansRead DigitalOcean's published pricing ↗Hetzner
Cloud instances and dedicated servers with rates published per instance size, so the cost of a bigger box is visible before you move.
See Hetzner's plansRead Hetzner's published pricing ↗What to check before you buy
- A virtual machine you have root on, not a website plan with a control panel bolted on top.
- Snapshots or automated backups, and where those backups are stored.
- Block storage or object storage for the data that will outgrow the server's own disk.
- What the monthly rate renews at, rather than the first-term rate on the signup page.
- Where the data centre is, if the data has a jurisdiction attached to it.
The “See plans” links go through our own /go/ redirect and some are affiliate links, which pay us if you sign up. The descriptions and trade-offs on this page are written from the project's own documentation and are unaffected. The plain pricing link under each provider is not an affiliate link. See our disclosure.
Frequently asked questions about self-hosting Vaultwarden
Answers restate the notes on this page or point at the project's own documentation. Self-hosting moves work to you rather than removing it, and these answers say so.
What is Vaultwarden?
An independent server that implements the Bitwarden client API, written in Rust, so the official Bitwarden apps and browser extensions can sync to a host you run. We cover it as a replacement for Bitwarden, 1Password.
What do you need to run Vaultwarden yourself?
The container images the project publishes, with a persistent data volume. The requirements table on this page lists the server, the data store, what grows and what else to arrange first. Setup steps are at Vaultwarden's repository.
How hard is Vaultwarden to run yourself?
We rate it Moderate. The container is quick to start. The install that matters is the one where HTTPS, sign-ups, the admin token and a tested off-server backup are all in place first.
What are the trade-offs of self-hosting Vaultwarden?
Our notes list these costs. Vaultwarden is not Bitwarden. It is an independent implementation of the same client API, its README carries a disclaimer for that reason, and its maintainers ask that you do not use Bitwarden's support channels. A client update can break compatibility until the project catches up. You become the custodian of the credentials your household or team depends on. A lost backup is a lost vault, and a password manager is precisely the thing whose contents nobody has memorised.
What do you give up by running Vaultwarden yourself?
You take on what Bitwarden, 1Password used to do for you. A vendor's security programme, audit trail and support line. The guarantee that the official clients will always work against your server. Self-hosting moves that work to you rather than removing it.
What do you gain by running Vaultwarden yourself?
Our notes list these. Vault data stays on your hardware while you keep using the official clients. No per-seat subscription for the server itself.