In January 2026, Bitwarden raised its Premium plan from $9.99 a year to $19.80 a year. It was the first price change in roughly a decade, and it was entirely defensible. It also sent a lot of people looking at the alternative they had been ignoring for years.
That alternative is Vaultwarden: a password manager server you run on your own box, that speaks fluent Bitwarden to every official Bitwarden client you already have installed. It gives away, for free, most of what Bitwarden charges for. And it does it in under 50 MB of RAM.
The obvious question follows about two seconds later. Your passwords are the single most sensitive thing you own, so is it actually safe to put them on a server you manage yourself? That is the real question, and most articles skip it in favor of a docker compose snippet.
This guide covers what Vaultwarden is, what it gives you, its honest security record, and how to run it without creating a much bigger problem than a subscription fee. If you would rather skip the server work entirely, managed Vaultwarden hosting is a one-click deploy, but read the safety section first either way.
Table of Contents
TL;DR (Too Long, Didn’t Read?)
Short on time? Here is the whole guide in a few lines:
- Vaultwarden is an unofficial, community-built reimplementation of the Bitwarden server API, written in Rust. It is not made by Bitwarden, Inc.
- It runs as a single container using roughly 50 MB of RAM, where the official self-hosted Bitwarden stack wants a dozen containers and about 4 GB.
- It unlocks features Bitwarden reserves for paid plans, including organizations, TOTP, Send, emergency access, and now OIDC single sign-on, at no license cost.
- Your vault is encrypted on your device before it ever reaches the server. Vaultwarden stores encrypted blobs it cannot read. That property does not change when you self-host.
- The risk is not the encryption, it is the operations. Unpatched versions, an exposed admin panel, and missing backups are what actually lose people their vaults.
- Vaultwarden’s own security advisories cluster heavily around the optional admin panel, which is the one component you can simply turn off.
- Self-hosting is safe when the server is patched, TLS-terminated, firewalled, and backed up. Those four things are the whole job.
- If you do not want that job, a managed one-click deploy hands it to someone else and gets you a live vault in about five minutes.
What Is Vaultwarden?
Vaultwarden is a lightweight server that implements the Bitwarden API, so official Bitwarden apps and browser extensions can sync against your own machine instead of Bitwarden’s cloud. It was formerly called bitwarden_rs, is maintained by Dani García and a large contributor group, and ships under the AGPL-3.0 license.
Think of it like a compatible replacement engine. The dashboard, the pedals, and the steering wheel are all still Bitwarden’s, because you keep using the official clients. Only the engine underneath changed, and the new one is dramatically smaller.
The project has passed 60,000 stars on GitHub and releases regularly. The current version at the time of writing is 1.37.2, published on August 22, 2026.
A Few Things Worth Knowing
- It is not a fork of Bitwarden’s code. It is a clean-room reimplementation of the API in Rust, which is why there is no licensing conflict.
- It is not affiliated with Bitwarden, Inc. The project states that one active maintainer is employed by Bitwarden and contributes on personal time, with review from other maintainers.
- The Bitwarden server API is not formally documented. Vaultwarden tracks it by watching client releases, which is the project’s real technical achievement and its main ongoing maintenance burden.
- You do not install a “Vaultwarden app.” You install the server and point the standard Bitwarden desktop, mobile, CLI, and browser clients at your domain.
- SQLite is the default database. MySQL, MariaDB, and PostgreSQL are supported if you want them, but most single-team deployments never need to leave SQLite.
Vaultwarden vs the Official Bitwarden Server
| Factor | Vaultwarden | Official self-hosted Bitwarden |
|---|---|---|
| Language / runtime | Rust, single binary | .NET across multiple services |
| Container count | 1 | ~10+ (API, identity, admin, notifications, MSSQL, Nginx) |
| Typical RAM | Under 50 MB | 4 GB minimum for the stack |
| Database | SQLite by default; MySQL/MariaDB/PostgreSQL optional | MSSQL required |
| License cost | Free, AGPL-3.0 | Self-hosting is an Enterprise-tier feature |
| Premium features | Included | Behind paid plans |
| Secrets Manager / SCIM | Not implemented | Available |
| Formal support | Community (Matrix, Discourse, GitHub) | Commercial support contracts |
| Best for | Individuals, families, small teams, agencies | Regulated orgs needing contracts and compliance sign-off |
If you only remember one line: Vaultwarden is what you run when you want the whole feature set on a $6 VPS, and the official server is what you run when a compliance auditor needs a vendor to call.
What You Actually Get for Free
This is the part that surprises people. Vaultwarden implements nearly the full Bitwarden feature surface, including things that sit behind a subscription on the hosted service.
| Feature | Bitwarden hosted plan required | In Vaultwarden |
|---|---|---|
| Unlimited passwords and devices | Free | ✅ |
| Built-in TOTP authenticator | Premium ($19.80/yr) | ✅ |
| File attachments | Premium | ✅ |
| Emergency access | Premium | ✅ |
| Bitwarden Send | Partly Premium | ✅ |
| Organizations and shared collections | Families / Teams | ✅ |
| Event logs | Teams ($4/user/mo) | ✅ |
| SSO via OpenID Connect | Enterprise ($6/user/mo) | ✅ (since 1.35.0) |
| Hardware keys (YubiKey, WebAuthn, Duo) | Premium | ✅ |
| Secrets Manager | Paid add-on | ❌ Not implemented |
| SCIM provisioning | Enterprise | ❌ Not implemented |
The two gaps are deliberate. Secrets Manager and SCIM sit outside what an AGPL reimplementation can reasonably cover, so the project explicitly leaves them alone.
The honest reframe: you are not getting $6/user/month of software for free, you are trading a license fee for an operations job. Whether that trade is good depends entirely on how seriously you take the next section.
Is Vaultwarden Safe to Self-Host?
Yes, for most people, with conditions that actually matter. Here is the reasoning broken into the four things that determine the answer.
1. The Encryption Model Does Not Change When You Self-Host
This is the single most misunderstood point, so it goes first. Your vault is encrypted and decrypted on your device using a key derived from your master password. The server only ever sees ciphertext.
A compromised server therefore does not hand an attacker your passwords in readable form. It hands them an encrypted blob plus metadata, and what happens next depends on your master password and key derivation settings.
Modern Bitwarden clients default to Argon2id, which is far more resistant to offline cracking than the old PBKDF2 defaults. If your account predates that change, go raise it. Two minutes, outsized payoff.
2. Rust Removes a Class of Bugs, Not All Bugs
Writing the server in Rust genuinely eliminates whole categories of memory-safety vulnerabilities that plague C and C++ codebases. That is a real structural advantage, not marketing.
It says nothing about logic bugs, though, and logic bugs are what Vaultwarden’s advisories are actually made of. Permission checks, token invalidation, and organization boundaries are where the real issues have surfaced.
3. The Audit Gap Is Real
Bitwarden commissions regular third-party audits of its official server. Vaultwarden has not undergone the same level of formal, funded scrutiny, and pretending otherwise would be dishonest.
For a household or a five-person agency that distinction is largely academic, since client-side encryption carries most of the weight regardless. For a company that fields a security questionnaire every quarter, it is not academic at all, and the official server is the correct answer.
4. The Real Risk Is You
In practice, self-hosted vaults are not lost to exotic cryptographic attacks. They are lost to a server nobody patched for eleven months, an admin panel exposed to the open internet, and a db.sqlite3 file that was never backed up.
Every one of those is an operations problem with a known fix, which is good news. It means the safety of your instance is something you control rather than something you hope about.
What Vaultwarden’s Security Record Actually Looks Like
A project’s advisory history tells you more than its marketing does. Vaultwarden publishes advisories openly on GitHub Security Advisories, and the pattern is instructive.
| Advisory | Severity | Fixed in | What it tells you |
|---|---|---|---|
| RCE in the admin panel (GHSA-h6cc-rc6q-23j4) | High | 1.33.0 | The admin panel is the highest-value target on the box |
| Admin panel access via CSRF (GHSA-f7r5-w49x-gxm3) | High | 1.33.0 | Same component, different route in |
| Cross-org data access (CVE-2026-43912) | High, CVSS 8.7 | 1.35.5 | Organization boundary enforcement is the hard part |
| Refresh tokens not invalidated on stamp rotation (CVE-2026-43911) | Medium, CVSS 6.8 | 1.35.5 | Password changes did not fully kick out old sessions |
| SSO CSRF, enumeration, and SSRF issues | Mixed | 1.36.0 | New SSO code is young code |
| Full cipher enumeration ignoring collection permissions | Moderate | 1.35.x | Permission checks, again |
Two conclusions fall out of that table. First, the admin panel is the recurring hot spot, and it is optional. Second, the project discloses, patches, and ships fixes quickly, which is the behavior you want from a security-sensitive dependency.
The practical takeaway is not “Vaultwarden is dangerous.” It is that an unpatched Vaultwarden is dangerous, and an exposed admin panel is worse. Both are choices, not defaults you are stuck with.
Step-by-Step: How to Self-Host Vaultwarden Safely
Step 1: Size the Server Honestly
Vaultwarden is happy on 1 vCPU and 512 MB of RAM. The constraint is never Vaultwarden itself, it is the reverse proxy, the OS, and whatever else you plan to run beside it.
A 1 GB VPS is comfortable for a family or a small team. If picking infrastructure is new to you, our guide on cloud hosting and how it works covers the trade-offs.
Step 2: Deploy the Container
The recommended install path is the official container image. If containers are new to you, start with what Docker is and what Docker Compose does.
The detail that matters most is the port binding. Bind the container to localhost, not to every interface, so the only path in is through your reverse proxy:
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
environment:
DOMAIN: "https://vault.yourdomain.com"
SIGNUPS_ALLOWED: "false"
volumes:
- ./vw-data/:/data/
ports:
- 127.0.0.1:8000:80
Step 3: Put TLS in Front of It, Always
Vaultwarden must be served over HTTPS. Bitwarden’s mobile and desktop clients refuse to connect otherwise, and an unencrypted vault sync is not a vault sync you want.
Terminate TLS at Nginx or Caddy in front of the container. On xCloud, SSL is provisioned automatically; the Let’s Encrypt SSL guide 👉 covers the manual path.
Step 4: Turn Off Signups After Your First Account
Vaultwarden ships with registration enabled so you can create the first account. Leave it that way and anyone who finds your domain can register on your server.
Create your account, set SIGNUPS_ALLOWED=false, restart, and invite everyone else through an organization instead.
Step 5: Decide the Admin Panel Question Deliberately
The admin panel activates only when you set an ADMIN_TOKEN. Given the advisory history above, treat it as a temporary tool rather than a permanent fixture.
The safest configuration is to leave ADMIN_TOKEN unset entirely. If you need it, use an Argon2 hashed token, restrict /admin to your own IP at the proxy, and unset it when you are done.
Step 6: Lock Down the Host
The container is one layer. The server underneath is the other, and it is the one people forget.
Close every port except 22, 80, and 443, move SSH to key-only auth, and add brute-force protection. Our guides on VPS security and Fail2ban cover the specifics.
Step 7: Back Up Before You Need To
A vault with no backup is a countdown. Back up the entire /data directory, not just the database file, since it also holds attachments, RSA keys, and config.
Schedule it with a cron job, send it off the server, then do the part everybody skips: restore it once on a throwaway box to confirm it actually works.
Pro Tips to Keep Your Vault Safe
Tip 1: Subscribe to release notifications. Watch the repository’s releases on GitHub or use an RSS feed. A security fix you learn about a year late is not a security fix.
Tip 2: Pin a version tag instead of running :latest blindly. Read the release notes, then bump. Releases occasionally flag breaking changes to admin templates or minimum client versions.
Tip 3: Check the server first when mobile logins break. Vaultwarden releases state which client versions they support, so an outdated server is the usual culprit after a Bitwarden app update. Cross-reference Bitwarden’s release notes.
Tip 4: Enable two-factor and raise your KDF. TOTP, WebAuthn, and YubiKey are all free here, and Argon2id is your last line of defense if an encrypted backup ever leaks.
Tip 5: Do not expose the server to the whole internet if you do not need to. A WireGuard or Cloudflare Tunnel restricts reachability to your own devices and removes most of the attack surface in one move.
Tip 6: Keep an offline emergency export. An encrypted export on a USB drive in a drawer sounds paranoid right up until your VPS provider suspends the account over a billing mistake.
Quick Checklist Before You Call It Production
- ✅ HTTPS with a valid certificate, no self-signed shortcuts
- ✅
SIGNUPS_ALLOWED=falseafter the first account - ✅
ADMIN_TOKENunset, or hashed and IP-restricted - ✅ Container bound to
127.0.0.1, never0.0.0.0 - ✅ Firewall closed on everything except SSH, HTTP, and HTTPS
- ✅ SSH key-only, root login disabled, Fail2ban active
- ✅ Automated off-server backups of the full
/datadirectory - ✅ One successful test restore on record
- ✅ Two-factor enabled on every account
- ✅ A plan for who applies the next security release, and when
Skip the Ops: Managed Vaultwarden Hosting on xCloud
Read that checklist again and notice what it is. Almost none of it is about Vaultwarden. It is TLS, firewalls, container orchestration, backups, and patching, which is the same list you would write for any self-hosted service.
That is the real cost of self-hosting, and it is the line item people forget when they compare a $19.80 subscription to a $6 VPS. Your time is the third number in that equation, and it does not stop billing after the first weekend.
xCloud’s Managed Vaultwarden Hosting removes that column entirely. Vaultwarden is a one-click app on the platform, so a live vault takes about five minutes and no terminal:
- Deployed on a dedicated Cloud VPS, not a shared box, so your vault is not sitting next to somebody else’s workload
- Free SSL provisioned automatically, which satisfies the HTTPS requirement Bitwarden clients enforce before they will sync
- Security updates applied for you, which addresses the single biggest self-hosting failure mode in the advisory table above
- Automatic backups running on schedule, so the restore test is the only homework left
- 30+ server locations, useful when data residency actually matters to you
- Organizations enabled for shared collections across a team
- Cancel anytime with unused balance refunded, and a 14-day money-back guarantee
Migration is the standard path: export JSON or CSV from Bitwarden, import after deployment, and point the official clients at your new URL.
Now the honest part, because the numbers do not favor xCloud everywhere. The 6 GB Cloud VPS tier starts at $24.99/month, which is several times what a bare Hetzner or Contabo box costs. Vaultwarden needs a fraction of those resources, so if you already run servers and enjoy running them, DIY is cheaper and you should do that.
Where managed wins is the comparison people actually face. At $24.99/month you are roughly at par with Bitwarden Teams for six seats, or Enterprise for four — except you also get a dedicated VPS with room for the other 166 one-click apps in the catalog, and nobody bills you per user as the team grows.
Prefer to run it yourself but want the panel? Bring your own VPS from DigitalOcean, Vultr, Hetzner, or AWS with self-managed hosting and deploy via Custom Docker 👉, or read self-managed vs managed hosting if you are undecided.
Ready to stop maintaining a password server? Deploy Vaultwarden on xCloud and have a live vault before your coffee goes cold.
Take Control of Your Passwords This Week
Vaultwarden is one of the strongest arguments in the self-hosting world. It gives a household or a small team the complete feature set of a commercial password manager, runs on hardware you would otherwise throw away, and keeps your encrypted vault on infrastructure you control.
It is safe to self-host, with the same caveat that applies to everything you self-host: it is exactly as safe as your patching, your TLS, your firewall, and your backups. The encryption was never the weak point. The neglected server always is.
So pick your path this week. Spin up a small VPS, deploy the container behind a proxy with SSL, turn off signups, skip the admin token, schedule a backup, and test the restore. If that sounds like a weekend you would rather not spend, deploy it as a managed one-click app and get the same result before lunch. Whichever direction you go, that is the move worth making.
If you have found this blog helpful, feel free to subscribe to our blogs for valuable tutorials, guides, knowledge, and tips on web hosting and server management. You can also join our Facebook community to share insights and engage in discussions.
Frequently Asked Questions
Is Vaultwarden free?
Yes. Vaultwarden is fully open source under the AGPL-3.0 license, with no paid tier and no license fee. Your only cost is the server it runs on, which starts at a few dollars a month on any small VPS.
Is Vaultwarden safe to use?
For most individuals and small teams, yes. Your vault is encrypted on your device before it reaches the server, so the server never holds readable passwords, and the project patches disclosed vulnerabilities quickly. The risk sits in operations, so keep it updated, put it behind HTTPS, avoid exposing the admin panel, and back it up.
Is Vaultwarden made by Bitwarden?
No. It is an independent, community-maintained project that reimplements the Bitwarden server API in Rust, originally released as bitwarden_rs. The project notes that one active maintainer works at Bitwarden and contributes on personal time, but Vaultwarden is not a Bitwarden, Inc. product and carries no official support.
Can I use official Bitwarden apps with Vaultwarden?
Yes, and that is the entire point of the project. The desktop app, mobile apps, browser extensions, and CLI all work once you change the server URL in the client’s settings to your own domain. No special client is needed.
Do I need Docker to run Vaultwarden?
No, but it is the recommended path. Official container images are published to ghcr.io, docker.io, and quay.io, and you can also build the Rust binary yourself or use community packages. Containers are simply the best-tested route, and platforms like xCloud make Docker Compose deployment a dashboard action.
“I self-hosted Vaultwarden six months ago and never touched it since. What should I do?”
Check your running version against the latest release today, because that gap almost certainly spans multiple security advisories. Back up the /data directory first, then update the container image and restart. After that, unset your ADMIN_TOKEN if it is still set, confirm signups are disabled, and schedule a real backup before you walk away again.
Can I get Vaultwarden hosted for me instead of setting it up myself?
Yes. xCloud offers Vaultwarden as a managed one-click app on a dedicated Cloud VPS, with SSL, security updates, and backups handled for you and no terminal involved. Deployment takes around five minutes, and you can import an existing Bitwarden vault from a JSON or CSV export afterward. It costs more than a bare VPS, so it makes sense when you would rather not own the patching and backup routine.
Should I self-host Vaultwarden or just pay for Bitwarden?
Pay for Bitwarden if password management is the only thing you would be self-hosting, or if you need audit reports, SCIM, or a support contract. Self-host Vaultwarden if you already run a server, want organizations and event logs without per-seat pricing, or care about keeping the data on your own infrastructure. Switching later is straightforward through JSON export and import, so this is not a one-way door.
