You have decided to run your own password vault. Then you hit the fork that every self-hosting guide glosses over: the official Bitwarden server, or the community-built Vaultwarden that speaks the same language in a fraction of the space.
The internet’s answer to this has been settled for years. Vaultwarden is one tiny container, official Bitwarden is eleven containers and 4 GB of RAM, so obviously you pick Vaultwarden. That advice was correct, and in December 2025 it quietly stopped being correct.
Bitwarden shipped Bitwarden Lite, a single-container deployment that runs on SQLite. The deployment gap that decided this argument for six years mostly closed overnight. What did not close is the licensing gap, and that is now the thing your decision actually turns on.
This guide breaks down where the two genuinely differ in 2026, which one fits your situation, and what it costs to run either properly. If you are still fuzzy on the basics, start with our explainer on what Vaultwarden is and come back.
TL;DR / Key Takeaways
- Vaultwarden optimizes for zero cost and low footprint. Bitwarden optimizes for accountability and support. That is the whole comparison in one line.
- Bitwarden Lite killed the old deployment argument. Official Bitwarden now runs in one container with SQLite, so “Vaultwarden is simpler” is a much weaker claim than it was.
- The licensing gap did not close. Self-hosting Bitwarden is free, but premium features require a license file, and that license requires an active paid cloud subscription.
- Vaultwarden gives you organizations, TOTP, Send, emergency access, and OIDC SSO at no license cost. On Bitwarden, most of those sit behind a plan.
- Bitwarden wins decisively on assurance: funded third-party audits, SOC 2, HIPAA, GDPR, and a support contract you can escalate to.
- It is effectively a tie on client experience. Both use the same official Bitwarden apps, extensions, and CLI.
- Migration between them is a JSON export and import, so this is not a one-way door. Pick the one that fits this year.
Vaultwarden vs Bitwarden at a Glance
| Factor | Vaultwarden | Bitwarden (self-hosted) |
|---|---|---|
| Maintainer | Community project, AGPL-3.0 | Bitwarden, Inc. |
| Language | Rust, single binary | .NET |
| Deployment | 1 container | 1 container (Lite) or ~11 (Standard) |
| Typical RAM | Under 50 MB | ~250 MB–1 GB (Lite), 4 GB+ (Standard) |
| Database | SQLite default; MySQL, MariaDB, PostgreSQL | SQLite, MySQL, PostgreSQL (Lite); MSSQL (Standard) |
| Cost to run | Free, no license | Free base; license needed for premium features |
| Premium features | All included | Require a paid cloud subscription |
| Clients | Official Bitwarden apps | Official Bitwarden apps |
| Third-party audits | Not formally audited | Regular funded audits, SOC 2 / HIPAA / GDPR |
| Official support | Community forums, Matrix, GitHub | Commercial support on paid plans |
| Secrets Manager / SCIM | Not implemented | Available |
| Best for | Individuals, families, homelabs, small teams | Businesses needing compliance and a vendor |
If you only remember one line: Vaultwarden is what you run when you want every feature for free, and Bitwarden is what you run when somebody needs to be contractually responsible if it breaks.
What Is Vaultwarden?
Vaultwarden is an unofficial reimplementation of the Bitwarden server API, written in Rust and released under AGPL-3.0. It was formerly called bitwarden_rs, is maintained by Dani García and a large contributor group on GitHub, and has passed 60,000 stars.
The core trick is that it is not a fork. It is a clean-room reimplementation of an API that Bitwarden never formally documented, tracked by watching what the official clients do. That reverse-engineering effort is the project’s real ongoing work.
The practical result is a password server that runs in under 50 MB of RAM on a Raspberry Pi, and that the official Bitwarden desktop app, mobile apps, browser extensions, and CLI all connect to without modification.
The Misconception Worth Clearing Up
Vaultwarden is not a stripped-down or “lite” version of Bitwarden. It implements more of the paid feature set than a free Bitwarden account gets, including organizations, shared collections, the built-in TOTP authenticator, Send, emergency access, event logs, and, since version 1.35.0, single sign-on via OpenID Connect.
The two things it deliberately does not implement are Secrets Manager and SCIM provisioning. Both sit outside what an AGPL reimplementation can reasonably cover, so the project leaves them alone rather than half-shipping them.
What Is Self-Hosted Bitwarden?
Bitwarden, Inc. publishes its server for self-hosting too, and this is where most comparison articles are running on stale information. There are now three deployment paths, not one.
Standard Deployment
The original. A Bash setup script orchestrates roughly eleven Docker containers covering API, identity, admin, notifications, and more, backed by MSSQL Express by default. It wants around 4 GB of RAM and real comfort with Linux and containers.
This is the deployment the “Vaultwarden is 40x lighter” statistic was measured against, and against Standard, that claim still holds.
Bitwarden Lite
Announced as “Bitwarden Unified” back in 2022, it spent three years in open beta and exited beta in December 2025 under the name Bitwarden Lite. It runs all services in a single container and supports SQLite, MySQL, PostgreSQL, or MSSQL.
That is a genuine, meaningful change, and it deserves credit rather than a footnote. Bitwarden is candid about its scope though: the company describes Lite as built primarily for individuals and homelab users, and does not always recommend it for organizations.
Helm Chart
For Kubernetes, aimed at high-availability and cloud-native deployments. Relevant if you already run clusters, irrelevant if the phrase “Ingress configuration” made you wince.
, Bitwarden Lite (1 container, SQLite/MySQL/Postgres), Bitwarden Standard (11 stacked containers, MSSQL) — with a RAM figure under each)
The 6 Differences That Actually Matter
1. Deployment Weight
Here the two used to diverge dramatically, and now they mostly do not. Against Bitwarden Lite, Vaultwarden’s advantage shrinks from “an order of magnitude” to “still lighter, but no longer decisive.”
Vaultwarden remains the smaller process, and on a 512 MB box or a Pi that still matters. On any VPS with 2 GB or more, both run comfortably and you should decide on other grounds.
Against Standard, nothing has changed. Eleven containers and an MSSQL dependency is a different class of commitment, and it is not one most households or five-person teams should take on.
Rule of thumb: if resource footprint is your deciding factor, you are probably on hardware small enough that Vaultwarden is the answer anyway.
2. What “Free” Actually Means
This is the sharpest dividing line, and it survived the Lite release intact.
Self-hosting Bitwarden is free, but unlocking premium features on your own server requires a license file, and that license file requires an active paid Bitwarden cloud subscription. You download it from the cloud web app and apply it to your instance.
So a self-hosted Bitwarden Lite instance with no license behaves roughly like a free Bitwarden account that happens to live on your hardware. No built-in TOTP, no file attachments, no emergency access.
Vaultwarden has no license concept at all. Every feature it implements is on from the moment the container starts. You are not paying Bitwarden less, you are paying them nothing and absorbing the maintenance yourself.
3. Feature Parity and Update Lag
Vaultwarden covers nearly the whole Bitwarden feature surface, which surprises people who expect a community project to be a poor relation. The gaps are narrow and documented.
The real cost is timing. When Bitwarden ships a new server feature, Vaultwarden has to observe it, implement it, and release it, so there is a lag measured in weeks or occasionally months. Client compatibility notes in Vaultwarden releases exist precisely because of this.
Bitwarden’s own documentation notes it cannot guarantee official clients will work perfectly against non-official servers. In practice they almost always do, and the maintainers move fast, but that sentence is the honest shape of the risk.
Rule of thumb: Vaultwarden gives you more features today for free; Bitwarden gives you new features first.
4. Security Assurance
Both systems encrypt your vault client-side. A compromised server of either kind hands an attacker ciphertext, not passwords. That property is identical and it is the most important one, so start there before anyone tells you one is “insecure.”
Where they diverge is assurance. Bitwarden funds regular third-party audits and holds SOC 2, GDPR, CCPA, HIPAA, and Data Privacy Framework compliance. Vaultwarden has not undergone the same level of formal, funded scrutiny, and its maintainers do not claim otherwise.
Vaultwarden’s public advisory history is instructive rather than alarming: the recurring hot spot has been the optional admin panel, which produced both an RCE and a CSRF advisory, plus organization-boundary bugs like CVE-2026-43912. The project discloses and patches quickly, and the admin panel is a component you can simply not enable.
Rule of thumb: for a household, the audit gap is academic. For anyone who fills out security questionnaires, it is the entire decision.
5. Support and Who Answers at 2 a.m.
Vaultwarden’s support is a community: GitHub Discussions, Matrix, and Discourse forums, staffed by people helping because they want to. The quality is genuinely high and the response times are often excellent.
It is still not a support contract. Nobody owes you a fix, and there is no escalation path when your vault is down and forty employees cannot log in.
Bitwarden’s paid plans include commercial support, and for a business that is not a luxury, it is the reason the line item exists. You are buying somebody to call.
6. Scaling to a Team
Vaultwarden implements organizations, collections, groups, and event logs, so a small team works fine and costs nothing per seat. That is a real advantage as headcount grows.
But SCIM provisioning and Directory Connector–style automated user lifecycle are not there, and neither is Secrets Manager. If onboarding and offboarding staff automatically from your identity provider is a requirement rather than a nice-to-have, Vaultwarden cannot do it.
Bitwarden Enterprise at $6/user/month includes self-hosting at no extra cost, along with SCIM, SSO with customer-managed encryption keys, and policy controls.
Can You Migrate Between Them Later?
This is the part most comparison articles skip, and it lowers the stakes of the whole decision considerably.
Both use the same Bitwarden JSON and CSV export formats. Export from one, import into the other, and personal vault items, notes, cards, and identities come across cleanly.
The one wrinkle worth planning for: organization structures do not transfer automatically. Shared collections and member assignments have to be recreated on the destination, then shared items reimported into them. For a five-person team that is an afternoon; for two hundred users it is a project.
Attachments and TOTP seeds travel with a JSON export, but do a test import on a throwaway instance before you decommission anything. Treat this as a starting point rather than a strict rule.
Use-Case Mapping
| Your situation | Better fit | Why |
|---|---|---|
| Personal vault, homelab, Raspberry Pi | Vaultwarden | Smallest footprint, every feature free |
| Family of four or five | Vaultwarden | Organizations included, beats $47.88/yr Families |
| Small agency or startup, 5–20 people | Vaultwarden | No per-seat cost, event logs and collections included |
| You want official features the day they ship | Bitwarden Lite | No reimplementation lag |
| Regulated industry, audits, questionnaires | Bitwarden | SOC 2, HIPAA, funded third-party audits |
| Need SCIM or automated deprovisioning | Bitwarden Enterprise | Vaultwarden does not implement SCIM |
| Need Secrets Manager for infrastructure secrets | Bitwarden | Not implemented in Vaultwarden |
| You want a vendor accountable in a contract | Bitwarden | Community support is not an SLA |
| You would rather not maintain any of it | Managed Vaultwarden | Someone else patches and backs it up |
Which One Should You Choose?
Choose Vaultwarden if…
- ✅ You are securing a household, a family, or a team under about twenty people
- ✅ You want organizations, TOTP, Send, and emergency access without a per-seat bill
- ✅ Your hardware is modest, whether that is a Pi, a NAS, or a $6 VPS
- ✅ You are comfortable applying updates, or you will pay someone to do it
- ✅ Nobody is going to hand you a compliance questionnaire about it
Vaultwarden is the right default for the large majority of people who search this question.
Choose Bitwarden if…
- ✅ You need SOC 2, HIPAA, or audit documentation for a third party
- ✅ SCIM, Directory Connector, or Secrets Manager are actual requirements
- ✅ You want commercial support with an escalation path
- ✅ You are already paying for Enterprise, which includes self-hosting anyway
- ✅ Being on the newest server features immediately matters to you
If a compliance officer will ever ask who is accountable for this system, the answer needs to be a company.
Where to Host Whichever You Pick
Notice what neither option removes. Both need a server, TLS that the Bitwarden clients will accept, a firewall, a patching routine, and backups you have actually tested. The vault software is the easy part.
That is the real cost of self-hosting, and it is the line item people forget when comparing a $19.80 subscription to a $6 VPS. Your time is the third number in that equation, and it keeps billing long after the first weekend.
The DIY path: bring your own VPS from DigitalOcean, Vultr, Hetzner, or AWS with self-managed hosting, and deploy either server via Custom Docker 👉. You will want our guides on Docker Compose, Let’s Encrypt SSL 👉, VPS security, and scheduled backups with cron.
The zero-ops path: xCloud’s Managed Vaultwarden Hosting deploys Vaultwarden as a one-click app on a dedicated Cloud VPS in about five minutes, with no terminal involved:
- Free SSL provisioned automatically, satisfying the HTTPS requirement Bitwarden clients enforce before they sync
- Security updates applied for you, which is the single biggest self-hosting failure mode handled
- Automatic backups on a schedule, across 30+ server locations
- Organizations enabled for team sharing, with no per-seat pricing
- Cancel anytime with unused balance refunded, plus a 14-day money-back guarantee
The honest caveat: the 6 GB Cloud VPS tier starts at $24.99/month, which is several times a bare Hetzner box. If you already run servers and enjoy it, DIY is cheaper and you should do that. Where managed wins is the comparison you are actually making — $24.99/month is roughly Bitwarden Teams at six seats or Enterprise at four, except nobody bills you per user as the team grows, and the VPS has room for the rest of the one-click app catalog.
Ready to stop maintaining a password server? Deploy Vaultwarden on xCloud and have a live vault before your coffee goes cold.
Make the Call and Move On
For most people reading this, the answer is Vaultwarden. It gives a household or a small team the complete feature set for free, runs on hardware you would otherwise retire, and the encryption model is identical to the official server’s. The audit gap is real and, for personal use, largely academic.
For anyone who has to answer to an auditor, the answer is Bitwarden, and Bitwarden Lite has made that a far more reasonable proposition than it was a year ago. Paying for accountability is a legitimate purchase, not a failure of nerve.
So pick this week rather than researching for another month. Spin up a small VPS, deploy behind a reverse proxy with real SSL, disable open signups, skip the admin token, schedule a backup, and test the restore once. Or hand the whole checklist to a managed deploy and spend the afternoon on something else. And if you get it wrong, a JSON export moves you to the other one. Whichever direction you go, that is the move worth making.
If you have found this blog helpful, feel free to subscribe to our blogs for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our Facebook community to share insights and engage in discussions.
Frequently Asked Questions
Is Vaultwarden the same as Bitwarden?
No. Vaultwarden is an independent, community-maintained server that reimplements the Bitwarden API in Rust, originally released as bitwarden_rs. It is not a Bitwarden, Inc. product and carries no official support, though it works with all the official Bitwarden client apps.
Is Vaultwarden safe compared to official Bitwarden?
The encryption model is the same in both: your vault is encrypted on your device before it reaches the server. The difference is assurance rather than architecture, since Bitwarden funds regular third-party audits and Vaultwarden has not had the same formal scrutiny. Read our full breakdown of Vaultwarden’s security record for the specifics.
Is self-hosting Bitwarden free?
Running the server is free, but premium features are not. Unlocking them on your own instance requires a license file, and obtaining that file requires an active paid Bitwarden cloud subscription. Without a license, a self-hosted instance behaves much like a free account.
What is Bitwarden Lite?
It is Bitwarden’s single-container self-hosted deployment, formerly called Bitwarden Unified, which exited beta in December 2025. It supports SQLite, MySQL, PostgreSQL, and MSSQL, and is much simpler than the standard eleven-container deployment. Bitwarden positions it for individuals and homelabs rather than organizations.
Can I switch from Vaultwarden to Bitwarden later, or the other way around?
Yes. Both support the same JSON and CSV export formats, so personal vault items transfer cleanly in either direction. Organization structures and shared collections need to be recreated manually on the destination server, so plan extra time if you have a lot of shared items.
Does Vaultwarden work with the official Bitwarden mobile app?
Yes. Point the app at your own server URL during login instead of bitwarden.com, and the desktop apps, browser extensions, and CLI work the same way. Bitwarden notes it cannot guarantee perfect compatibility with non-official servers, but in practice it works and the maintainers track client releases closely.
Which uses less RAM, Vaultwarden or Bitwarden?
Vaultwarden, comfortably. It typically sits under 50 MB, while Bitwarden Lite needs a few hundred megabytes and the standard deployment wants around 4 GB. On anything with 2 GB or more, both run fine and you should decide on features and support instead.
“I run a 12-person agency. Which one do we actually need?”
Vaultwarden, in almost every case. Twelve seats on Bitwarden Teams runs $576 a year, while Vaultwarden gives you organizations, shared collections, and event logs at no per-seat cost. Switch to Bitwarden only if a client contract requires audit documentation or you need SCIM to automate onboarding.
