Vaultwarden

What Vaultwarden does

Vaultwarden is a server, not a full password manager on its own. It reimplements the API that Bitwarden’s apps talk to, so you install the official Bitwarden browser extensions, desktop and mobile apps, point them at your own address and get a synced, shared vault without running Bitwarden’s server. The project was called bitwarden_rs until it was renamed to avoid confusion with the official product, and it states clearly that it is not associated with Bitwarden, Inc.

The README describes the API coverage as nearly complete. It includes the personal vault, Send, attachments, website icons, personal API keys, and organizations with collections, sharing, member roles, groups, event logs, admin password reset, directory sync and policies. Two-step login supports authenticator apps, email codes, FIDO2 WebAuthn, YubiKey and Duo, and emergency access works too. Single sign-on through any OpenID Connect provider is documented in the wiki. A Vaultwarden admin page manages users and server settings.

Security and audits

Encryption happens in the Bitwarden clients, so the server only stores vault data that is already encrypted on the device; the end-to-end design is the one Bitwarden documents. Because the web vault uses the browser’s Web Crypto API, Vaultwarden only works over HTTPS, and the project recommends putting it behind a reverse proxy.

The project wiki lists its audits. Germany’s Federal Office for Information Security (BSI) analyzed Vaultwarden 1.30.3 in its CAOS program and published the report. ERNW found three vulnerabilities, including an authentication bypass, during a customer’s penetration test in October 2024 and disclosed them to the maintainers. Other audits were carried out for companies that did not allow publication.

Self-hosting Vaultwarden

Installation is a single container image published on GitHub Container Registry, Docker Hub and Quay, started with Docker, Podman or a short Compose file that mounts a data folder. By default it uses an SQLite file in that folder, and a DATABASE_URL setting switches it to MySQL/MariaDB or PostgreSQL. You can also build the Rust binary yourself, and community packages exist for other platforms, though the README warns they may lag behind.

The work you take on is the usual for a self-hosted service that holds every password you own: HTTPS certificates, a reverse proxy, updates and, above all, backups. The maintainers state they are not liable for data loss and recommend regular backups of the files and database.

Hosted version

There is none. The project does not run public instances and does not endorse instances that others run. If you want a managed service with the same apps, that is Bitwarden’s own cloud.

Limitations

Vaultwarden depends on staying compatible with Bitwarden’s clients, so changes in the official apps can require server updates first. Problems must be reported to the Vaultwarden community rather than Bitwarden support, and there is no commercial support. Not every feature of the official server is implemented.

Who it suits

Vaultwarden suits home users, families and small organizations who already run a home server or a small VPS and want Bitwarden’s apps with their own server. Larger businesses that need vendor support, compliance documents or the full enterprise feature set are better served by the official Bitwarden server or cloud. For a vault that needs no server at all, see KeePassXC.