Hosting your own password manager is one of the most delicate decisions in self-hosting: the service guards the keys to everything else. Vaultwarden is a lightweight reimplementation of the Bitwarden server, written in Rust. It is compatible with the official Bitwarden apps for browsers, desktop and phone, but uses a fraction of the original server's resources and runs comfortably even on a small single-board computer.
Why the risk is lower than it seems
Bitwarden's security model is based on client-side encryption: the vault is encrypted on the device with a key derived from the master password, and the server receives only data that is already encrypted. Even someone who obtained a copy of the database would see unreadable blobs, provided the master password is long and unique.
That does not make the server irrelevant. Whoever controls it could, in theory, serve a modified web interface to capture the password. This is why the security of the system hosting Vaultwarden, and preferring the installed apps over the web vault, still matter.
Installation
Vaultwarden ships as a single Docker image. A bare-bones example:
services:
vaultwarden:
image: vaultwarden/server:1.32.0
environment:
DOMAIN: "<full service address, including https>"
SIGNUPS_ALLOWED: "false"
ADMIN_TOKEN: "<argon2 hash generated with vaultwarden hash>"
volumes:
- ./vw-data:/data
restart: unless-stopped
Three points need to be understood from the start:
- HTTPS is mandatory. The web vault uses the browser's cryptographic functions, which only work in a secure context. You therefore need a reverse proxy with a valid certificate in front of Vaultwarden.
- The
DOMAINvariable must match the address you use exactly, otherwise attachments and some login features will not work. - The version should be pinned instead of using a generic tag, so that you update deliberately.
Closing the front door
A server with open sign-ups lets anyone who can reach it create an account. The correct procedure is:
- create the accounts you need, or send invitations from the admin panel;
- set
SIGNUPS_ALLOWED=false; - if you need new users later, use invitations, which require an outgoing mail server (SMTP) to be configured.
The admin panel
The /admin panel lets you manage users, organisations and settings. It is protected by the ADMIN_TOKEN value, which should not be stored in plain text: the built-in vaultwarden hash command generates an Argon2 hash to put in the configuration. Good practice is to disable the panel entirely when you don't need it, by removing the variable, or to make it reachable only from the local network with a reverse proxy rule.
Second factor and access
Vaultwarden supports the two-factor methods of the Bitwarden clients: TOTP codes from an authenticator app, FIDO2/WebAuthn security keys and email codes. For a password manager, a physical key or at least TOTP is advisable, with the recovery codes kept on paper in a safe place.
As for exposure, there are two approaches:
| Approach | Advantages | Disadvantages |
|---|---|---|
| VPN / private network only | minimal attack surface | the VPN must be on to sync |
| Public behind a reverse proxy | sync from anywhere | requires prompt updates and protection against repeated attempts |
It helps to know that the clients keep an encrypted copy of the vault: if the server is unreachable, passwords already synced remain available. Changes are sent once the connection returns. This makes the "VPN only" approach more practical than you might think.
Backups: the part you cannot get wrong
The /data folder contains everything: the database (SQLite by default), attachments, the server's RSA keys and the configuration. Copying the SQLite file while the service is writing can produce a corrupt copy; it is better to use SQLite's backup command:
sqlite3 vw-data/db.sqlite3 ".backup '/backup/vw-$(date +%F).sqlite3'"
Along with the dump, save the attachments folder, the rsa_key* files and config.json if present. The copies should be encrypted and also kept outside the home.
There is also a second layer of protection that does not depend on the server: an encrypted export of the vault from the client, made periodically and kept on offline media. If the server were lost completely, that file would let you import the passwords into any new installation.
An emergency plan
A password manager hosted at home creates a dependency: if the server fails while you are travelling, or the person who runs it is unavailable, the family must still be able to get in. It is worth preparing a sheet, kept somewhere safe, with instructions for restoring the backup and the emergency credentials, and considering the emergency access feature between users offered by the clients.
In short
- Vaultwarden is compatible with the Bitwarden apps and uses very few resources.
- Encryption happens on the device, but the server still needs careful protection.
- Closed sign-ups, an admin panel with an Argon2 hash and HTTPS are mandatory.
- Backups should use SQLite's command and include attachments and keys.
- An offline encrypted export and emergency instructions complete the picture.
