Repos / Vaultwarden
AlternativesVaultwarden
For anyone who already uses, or wants to use, the Bitwarden clients but keep their passwords on a lightweight server of their own instead of a hosted one.
What it does.
- store your passwords and use them from the official Bitwarden clients pointed at your server
- use Send, attachments and a personal API key
- share passwords in organizations with collections, groups and policies
- turn on two-step verification (Authenticator, email, FIDO2, YubiKey or Duo)
- set up emergency access and an optional admin panel
Systems: Docker or Podman containers (the recommended route) or your own build. The clients are the official Bitwarden ones: browser, desktop and mobile.
What you need.
- HTTPS and a secure context: the web vault uses the Web Crypto API and does not work without HTTPS. source for this requirement (opens in a new tab)
- A reverse proxy in front of the service is the maintainers' recommendation. source for this requirement (opens in a new tab)
- Docker or Podman (images on ghcr.io, docker.io and quay.io), or build it yourself. source for this requirement (opens in a new tab)
How to install.
Download the image:
docker pull vaultwarden/server:latestStart it with docker run or Docker Compose as in the README: a DOMAIN variable with your https URL, a volume for /data and the port published on 127.0.0.1:8000.
Put a reverse proxy with HTTPS in front and point your Bitwarden clients at your domain.
Commands taken from the official documentation. Read them before you run them: it is your machine.
Permissions and data.
- The /data volume holds your database and attachments: back it up and limit who can read it.
- The README example publishes the port only on 127.0.0.1; access from the internet goes through your reverse proxy with HTTPS.
Limits and warnings.
- It is not affiliated with Bitwarden: report bugs to Vaultwarden, not to official Bitwarden support.
- It is an "almost complete" implementation of the Bitwarden API, not an identical copy of the official service.
- The maintainers take no responsibility for data loss and recommend regular backups of files and database.
- Community packages may lag behind the latest version.
Real cost and cloud.
- The software is free, but you are the administrator: domain, HTTPS certificate, updates and backups are on you.
- The maintainers focus the project on personal use, families and small organizations.
- It is a single piece of your infrastructure that holds all your passwords: decide where you keep its backups.
License.
AGPL-3.0 Open source with copyleft
AGPL-3.0: strong copyleft. If you modify the server and offer it to others over a network, you must publish your changes under the same license.
This is a summary to orient you, not legal advice. For commercial use, read the original LICENSE file.
Where all of this comes from.
Checked against the official documentation on October 29, 2026; this is not a lab test. Nothing was installed or measured to write this guide. If something has changed, the project's documentation is the authority.