Why Run Your Own Password Manager?
Cloud-based password managers are convenient until they get breached, sunset a feature, or raise prices. Bitwarden solves that problem with a fully open-source codebase and an official self-hosted option that puts your vault entirely under your own control, on your own server, behind your own firewall.
What You Need Before You Start
Bitwarden’s self-hosted deployment runs through Docker and Docker Compose, so that’s the first requirement. You’ll need a Linux server – a VPS, a home machine, or even a Raspberry Pi 4 with enough RAM. Bitwarden’s official stack recommends at least 2GB of RAM, though Vaultwarden (an unofficial but popular compatible server written in Rust) runs comfortably on 256MB if you’re working with constrained hardware.
You also need a domain name pointing to your server’s IP address. Bitwarden requires HTTPS, and its installer handles SSL certificate provisioning through Let’s Encrypt automatically, but only if port 80 and 443 are open and your DNS records are already resolving correctly before you run setup. Check that first, or you’ll spend an hour troubleshooting certificate failures that are actually just DNS propagation delays.
On your server, install Docker and Docker Compose if they aren’t already present. On a Debian or Ubuntu system, the official Docker install script handles everything in one command: curl -fsSL https://get.docker.com | sh. Add your user to the docker group afterward with sudo usermod -aG docker $USER and log out and back in so the group change takes effect.
Before downloading anything, open your firewall to allow traffic on ports 80 and 443. On a UFW-managed system, run sudo ufw allow 80/tcp and sudo ufw allow 443/tcp. If you’re on a cloud provider like DigitalOcean or Linode, also check the provider-level firewall rules in your dashboard – they operate separately from UFW and will silently block traffic even when UFW says it’s open.
Installing and Configuring Bitwarden
Bitwarden publishes an official install script that pulls the Docker images, generates configuration files, and walks you through initial setup interactively. Download it with curl -Lso bitwarden.sh “https://func.bitwarden.com/api/dl/?app=self-host&platform=linux”, then make it executable with chmod +x bitwarden.sh. Run it as your non-root user with ./bitwarden.sh install and follow the prompts – you’ll supply your domain name, an email address for SSL certificate registration, and optionally a Bitwarden installation ID and key, which you can get for free from bitwarden.com/host.
The installer creates a ./bwdata directory containing all your configuration. The main file to know is ./bwdata/env/global.override.env. Open it and set up SMTP so Bitwarden can send account verification and two-factor authentication emails. Without SMTP, new account registration will appear to work but you won’t receive the confirmation email, and the account will be stuck in an unverified state. Most people point this at a transactional email service like Mailgun or use their existing mail server credentials.
Once configuration is in place, run ./bitwarden.sh start to bring all the containers up. The first start takes a few minutes because Docker pulls a set of images – the default stack includes separate containers for the API, identity, web frontend, admin panel, database (MSSQL), and several other services. This is where that 2GB RAM recommendation comes from. Watch the container status with docker ps and wait until every service shows a healthy state before trying to access the web interface.
Navigate to your domain in a browser. You should see the Bitwarden web vault login page over HTTPS. Create your admin account, then visit https://yourdomain.com/admin – the admin panel lets you manage users, view server diagnostics, and configure organization settings. By default, open registration is enabled, meaning anyone who reaches your server can create an account. If this is a personal install, go into the admin panel and disable new signups immediately, or set a whitelist of allowed email domains.
Two-factor authentication for your admin account and vault account should be enabled before you do anything else. Bitwarden supports TOTP apps, email codes, and hardware keys like YubiKey. Given that your entire vault lives on this server, securing access is not optional. Also configure automatic backups for the ./bwdata directory – this folder contains your encrypted database, SSL certificates, and all configuration. A daily backup to an offsite location, whether that’s an S3 bucket, a separate VPS, or even an external hard drive, is the difference between a recoverable incident and a permanent loss of every password you own.
Connecting Your Devices
Every Bitwarden client app – browser extensions, desktop apps, and mobile apps – has a “Self-hosted environment” option on the login screen. Tap or click it, enter your server URL, save, and then log in with your credentials. The process is identical across Chrome, Firefox, Safari, iOS, Android, and the desktop clients. Your vault syncs to your server the same way it would with Bitwarden’s cloud service, except all traffic stays within your infrastructure.
If you’re already running other self-hosted tools, Bitwarden fits naturally alongside them. Self-hosters who use Linkwarden for bookmark archiving often run Bitwarden on the same host, since both are Docker-based and share the same reverse proxy setup. One decision worth making early: whether to expose Bitwarden directly to the internet or keep it on a private network accessible only through a VPN like Tailscale or WireGuard. The VPN approach adds a login step on mobile, but it removes your vault from the public internet entirely – which is a different category of security than SSL and strong passwords alone.
