Why Run Your Own Password Server
Password managers built on third-party cloud infrastructure work well until they don’t. Breaches, subscription price hikes, feature removals, and company acquisitions are all real risks that have hit major password management services in recent years. When your entire digital life runs through one service, that dependency matters. Vaultwarden gives you a way out – a self-hosted, open-source compatible server that speaks the same protocol as Bitwarden clients, meaning you get polished apps on every device without trusting anyone else’s infrastructure.
Vaultwarden is a community-built reimplementation of the Bitwarden server written in Rust. It is lighter on resources than the official Bitwarden server, which makes it a good fit for a Raspberry Pi, a home NAS, or a low-powered VPS. The official Bitwarden server is excellent but requires more RAM and Docker containers than most home setups comfortably support. Vaultwarden cuts that overhead dramatically while remaining fully compatible with all official Bitwarden browser extensions and mobile apps.
What You Will Need Before Starting
This setup assumes you have Docker and Docker Compose installed on your host machine. Any Linux-based system works – Ubuntu, Debian, and Raspbian are all tested and reliable options. You will also want a domain name pointing to your server if you plan to access Vaultwarden from outside your home network, because Bitwarden clients require HTTPS connections to function. A self-signed certificate works for local-only access, but for remote access you need a valid TLS certificate. Pairing Vaultwarden with a reverse proxy like Nginx Proxy Manager is the cleanest way to handle TLS termination without touching Vaultwarden’s configuration directly.
On the hardware side, Vaultwarden runs comfortably on as little as 256MB of RAM. A Raspberry Pi 3 or 4 is more than enough, and a low-tier VPS with 512MB works without issue. Disk usage is minimal unless you store large file attachments in the vault, where it scales with what you put in. Make sure the machine running Vaultwarden has a static local IP or a reliable hostname if you are staying on your local network only.
Installing Vaultwarden With Docker Compose
Create a directory for the project and inside it create a file named docker-compose.yml. The compose file defines the Vaultwarden service, its environment variables, and where it stores data on disk. Using a named volume or a bind mount keeps your vault data persistent across container restarts and updates, which is essential – you do not want to lose stored passwords because a container was recreated.
Paste the following into your compose file:
version: ‘3’
services:
vaultwarden:
image: vaultwarden/server:latest
container_name: vaultwarden
restart: unless-stopped
volumes:
– ./vw-data:/data
ports:
– “8080:80”
environment:
– SIGNUPS_ALLOWED=true
– DOMAIN=https://vault.yourdomain.com
Set DOMAIN to the full URL where your Vaultwarden instance will be reachable. This matters for WebSocket connections and push notifications to work correctly with the mobile apps. If you are running locally only, you can set it to your local IP with HTTP for initial testing, but plan to switch to HTTPS before using it seriously. Once the file is saved, run docker compose up -d from that directory and the container will pull the image and start running.
After the container is running, open a browser and navigate to http://your-server-ip:8080. You should see the Vaultwarden web interface, which uses the official Bitwarden web vault front end. From here, create your first account using the registration form. Once you have created your admin account, go back to your compose file and set SIGNUPS_ALLOWED=false, then run docker compose up -d again to apply the change. Leaving registration open on a public-facing server is a security risk you want to close immediately after initial setup.
Enabling the Admin Panel
Vaultwarden includes an admin panel at /admin on your instance URL. To enable it, add an ADMIN_TOKEN environment variable to your compose file. Generate a strong random token using a command like openssl rand -base64 48 and paste the output as the value. This token acts as the password for the admin interface, so treat it like one.
The admin panel lets you manage users, view server diagnostics, configure SMTP for email verification and password reset, and toggle features like organization support and emergency access. Setting up SMTP is worth doing early. Without it, account recovery is manual, and two-step login verification by email will not work. Most home setups use a free transactional email service or a Gmail app password to handle outgoing mail.
Inside the admin panel under the Settings tab, you can also enable the WEBSOCKET_ENABLED option and configure push notifications if you want real-time sync across devices rather than polling-based sync. Real-time sync makes the vault feel much more responsive when editing entries on one device and checking them on another.
Connecting Bitwarden Clients to Your Server
Every official Bitwarden client – browser extensions for Chrome, Firefox, and Edge, the desktop apps, and the iOS and Android apps – supports connecting to a custom server URL. In the Bitwarden login screen, look for a settings icon or a “Self-hosted” option, enter your Vaultwarden server URL, and save. After that, the login flow works exactly as it does with Bitwarden’s own cloud service, including two-factor authentication via authenticator apps, email codes, or hardware keys like YubiKey.
Browser extensions are the most frequently used client for most people, and they work without any special configuration beyond setting the server URL once. Mobile apps on Android work reliably, though iOS users sometimes need to log out and back in after changing the server URL to force the app to re-resolve the endpoint. If a client is not connecting, double-check that your domain resolves correctly, your TLS certificate is valid and not self-signed in the mobile case, and that port 443 is open on your server or reverse proxy. The most common failure point is a missing or misconfigured certificate rather than anything in Vaultwarden itself.
