Self-Host Vaultwarden Free

Password managers are essential for security. But they're also a single point of failure - if your provider gets breached, hacked, or subpoenaed, your entire digital life is exposed. LastPass proved this in 2022 when attackers stole encrypted password vaults from millions of users. The solution? Host your own.

Vaultwarden is a lightweight, open-source implementation of the Bitwarden API. It uses all official Bitwarden apps - browser extensions, desktop clients, mobile apps - but stores your encrypted vault on a server you control. And thanks to free cloud hosting, you can run it at zero cost.

Last updated: July 2026

Why Self-Host a Password Manager?

The LastPass Lesson

In 2022, LastPass suffered a devastating breach. Attackers stole:

• Encrypted password vaults for millions of users
• Vault metadata including website URLs (unencrypted)
• Customer data including email addresses and billing info

Even though vaults were encrypted, attackers could attempt offline brute-force attacks against weak master passwords. Users with simple passwords were compromised.

With self-hosting, your vault exists only on your server. No central repository for attackers to target. No third party with access to your encrypted data.

Bitwarden vs Vaultwarden

Prerequisites

• A cloud server (VPS) - Get one free: cloud hosting comparison
• A domain name - Required for HTTPS (essential for password manager security)
• 20-30 minutes - For setup
• Basic terminal comfort - Copy-paste commands

Server Requirements

Vaultwarden is extremely lightweight:

This means Vaultwarden easily fits on:

• Oracle Cloud Always Free AMD instance (1GB RAM)
• DigitalOcean $4/month droplet
• Any cloud free tier

Installation: Docker Method

Docker is the recommended installation method - simple setup and easy updates.

Step 1: Prepare Your Server

SSH into your VPS and install Docker:

# Update system
sudo apt update && sudo apt upgrade -y

# Install Docker
curl -fsSL https://get.docker.com | sudo sh

# Add your user to docker group
sudo usermod -aG docker $USER

# Logout and back in
exit

Step 2: Create Vaultwarden Directory

# Create directory
mkdir -p ~/vaultwarden
cd ~/vaultwarden

Step 3: Generate Admin Token

The admin token lets you access the admin panel. Generate a secure one:

# Generate admin token (save this!)
openssl rand -base64 48

Copy the output - you'll need it in the next step.

Step 4: Create Docker Compose File

nano docker-compose.yml

Paste this configuration:

version: '3'

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      - DOMAIN=https://vault.your-domain.com
      - ADMIN_TOKEN=YOUR_GENERATED_TOKEN_HERE
      - SIGNUPS_ALLOWED=true
      - INVITATIONS_ALLOWED=true
      - SHOW_PASSWORD_HINT=false
      - ROCKET_PORT=8080
    volumes:
      - ./data:/data
    ports:
      - 8080:8080

Save with Ctrl+X, then Y, then Enter.

Step 5: Start Vaultwarden

# Start container
docker-compose up -d

# Verify it's running
docker-compose ps
docker logs vaultwarden

Vaultwarden should now be running on port 8080.

Setting Up HTTPS (Required)

Browser extensions won't connect without HTTPS. Choose one method:

Option A: Nginx + Let's Encrypt (Recommended)

# Install Nginx and Certbot
sudo apt install nginx certbot python3-certbot-nginx -y

Create Nginx configuration:

sudo nano /etc/nginx/sites-available/vaultwarden

Paste this configuration:

server {
    listen 80;
    server_name vault.your-domain.com;

    location / {
        proxy_pass http://localhost:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /notifications/hub {
        proxy_pass http://localhost:8080;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }

    location /notifications/hub/negotiate {
        proxy_pass http://localhost:8080;
    }

    # Allow large file uploads (for attachments)
    client_max_body_size 128M;
}

Enable and get SSL certificate:

# Enable site
sudo ln -s /etc/nginx/sites-available/vaultwarden /etc/nginx/sites-enabled/

# Test config
sudo nginx -t

# Restart Nginx
sudo systemctl restart nginx

# Get SSL certificate
sudo certbot --nginx -d vault.your-domain.com

Certbot will automatically configure HTTPS and set up auto-renewal.

Option B: Caddy (Automatic HTTPS)

Caddy handles HTTPS automatically with minimal configuration:

# Install Caddy
sudo apt install -y debian-keyring debian-archive-keyring apt-transport-https
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' | sudo gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' | sudo tee /etc/apt/sources.list.d/caddy-stable.list
sudo apt update
sudo apt install caddy

Create Caddyfile:

sudo nano /etc/caddy/Caddyfile

Add:

vault.your-domain.com {
    reverse_proxy localhost:8080
}

Restart Caddy:

sudo systemctl restart caddy

Caddy automatically obtains and renews Let's Encrypt certificates.

Option C: Cloudflare Tunnel (No Port Opening)

If you can't open ports 80/443, use a Cloudflare Tunnel:

# Install cloudflared
curl -L --output cloudflared.deb https://github.com/cloudflare/cloudflared/releases/latest/download/cloudflared-linux-amd64.deb
sudo dpkg -i cloudflared.deb

# Login to Cloudflare
cloudflared tunnel login

# Create tunnel
cloudflared tunnel create vaultwarden

# Create config
mkdir -p ~/.cloudflared
nano ~/.cloudflared/config.yml

Add configuration:

tunnel: YOUR_TUNNEL_ID
credentials-file: /home/YOUR_USER/.cloudflared/YOUR_TUNNEL_ID.json

ingress:
  - hostname: vault.your-domain.com
    service: http://localhost:8080
  - service: http_status:404

Route DNS and start:

cloudflared tunnel route dns vaultwarden vault.your-domain.com
sudo cloudflared service install
sudo systemctl start cloudflared

Initial Setup

Step 1: Create Your Account

1. Open https://vault.your-domain.com in your browser
2. Click Create Account
3. Enter your email and a strong master password
4. Verify your account via the confirmation email

Step 2: Disable Public Registration

After creating your account, disable signups to prevent strangers from using your server:

cd ~/vaultwarden
nano docker-compose.yml

# Change:
SIGNUPS_ALLOWED=true
# To:
SIGNUPS_ALLOWED=false

# Restart:
docker-compose down && docker-compose up -d

Step 3: Access Admin Panel

Go to https://vault.your-domain.com/admin and enter your admin token.

Here you can:

• Manage users and organizations
• View server statistics
• Configure settings
• Invite new users

Installing Bitwarden Apps

Vaultwarden works with all official Bitwarden clients. Install them from official sources:

Browser Extensions

• Chrome/Brave/Edge
• Firefox
• Safari

Desktop Apps

• Windows, Mac, Linux

Mobile Apps

• Android (Google Play)
• Android (F-Droid)
• iOS

Connecting to Your Server

When logging in, you must configure the server URL:

1. Open any Bitwarden app
2. Before logging in, click the settings gear or "Self-hosted"
3. Enter your server URL: https://vault.your-domain.com
4. Save and log in with your credentials

Enable Two-Factor Authentication

Protect your vault with 2FA:

1. Log in to the web vault
2. Go to Settings → Two-step Login
3. Choose your method:
   • Authenticator app (recommended) - Works with any TOTP app
   • Email - Sends codes to your email
   • YubiKey - Hardware key support
4. Follow the setup wizard
5. Save your recovery code! - This is your only backup if you lose 2FA access

Family/Team Setup (Organizations)

Share passwords securely with family or team members:

Create an Organization

1. In web vault, go to Organizations
2. Click New Organization
3. Name it (e.g., "Family")
4. Choose plan type - free tier works for most families

Invite Members

1. Go to Organization → Manage → People
2. Click Invite User
3. Enter their email address
4. They'll receive an invitation to create an account

Remember: You disabled signups, so you need to either:

• Temporarily enable signups while they register
• Or manually create their account in the admin panel

Create Shared Collections

Collections let you organize shared passwords:

1. Go to Organization → Manage → Collections
2. Create collections like "Streaming Services", "Utilities", "Shared Accounts"
3. Add items to collections when creating or editing passwords
4. Control which members can access which collections

Importing Existing Passwords

From LastPass

1. In LastPass: Account Options → Advanced → Export
2. Download the CSV file
3. In Bitwarden web vault: Tools → Import Data
4. Select LastPass (csv)
5. Upload the file
6. Delete the CSV immediately - it contains all your passwords in plain text!

From 1Password

1. In 1Password: File → Export → All Items
2. Choose 1Password Unencrypted Export (.1pux)
3. In Bitwarden: Tools → Import Data
4. Select 1Password (1pux)
5. Upload and delete the export file

From Chrome/Firefox

1. In Chrome: Settings → Passwords → Export
2. In Bitwarden: Tools → Import Data
3. Select Chrome (csv)
4. Upload and delete the export

Backup Your Vault

Regular backups are critical. Vaultwarden stores everything in the data directory.

Automatic Backup Script

nano ~/backup-vaultwarden.sh

Add:

#!/bin/bash
BACKUP_DIR="/root/vaultwarden-backups"
DATE=$(date +%Y%m%d-%H%M)

mkdir -p $BACKUP_DIR

# Backup the entire data directory
cd ~/vaultwarden
tar -czf $BACKUP_DIR/vaultwarden-$DATE.tar.gz data

# Keep only last 30 backups
ls -t $BACKUP_DIR/*.tar.gz | tail -n +31 | xargs -r rm

echo "Backup completed: $DATE"

# Make executable
chmod +x ~/backup-vaultwarden.sh

# Add to cron (daily at 2 AM)
crontab -e
# Add:
0 2 * * * /root/backup-vaultwarden.sh >> /var/log/vaultwarden-backup.log 2>&1

Off-Site Backup

Copy backups to another location for disaster recovery:

# Install rclone
curl https://rclone.org/install.sh | sudo bash

# Configure remote storage
rclone config

# Add to backup script:
rclone copy $BACKUP_DIR remote:vaultwarden-backups/ --max-age 7d

Updates and Maintenance

Update Vaultwarden

cd ~/vaultwarden

# Pull latest image
docker-compose pull

# Recreate container with new image
docker-compose up -d

# Check logs for issues
docker logs vaultwarden

Set up automatic updates with Watchtower:

# Add to docker-compose.yml:
  watchtower:
    image: containrrr/watchtower
    container_name: watchtower
    restart: always
    volumes:
      - /var/run/docker.sock:/var/run/docker.sock
    environment:
      - WATCHTOWER_CLEANUP=true
      - WATCHTOWER_SCHEDULE=0 0 4 * * *  # 4 AM daily
    command: vaultwarden

Monitor Health

# Check container status
docker-compose ps

# View logs
docker logs -f vaultwarden

# Check disk space
df -h

Security Hardening

1. Firewall Configuration

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow ssh
sudo ufw allow 80
sudo ufw allow 443
sudo ufw enable

2. Fail2Ban for Brute Force Protection

# Install Fail2Ban
sudo apt install fail2ban -y

# Create Vaultwarden jail
sudo nano /etc/fail2ban/jail.d/vaultwarden.conf

Add:

[vaultwarden]
enabled = true
port = 80,443
filter = vaultwarden
logpath = /home/YOUR_USER/vaultwarden/data/vaultwarden.log
maxretry = 5
bantime = 3600
findtime = 600

Create filter:

sudo nano /etc/fail2ban/filter.d/vaultwarden.conf

Add:

[Definition]
failregex = ^.*Username or password is incorrect\. Try again\. IP: <HOST>\. Username:.*$
ignoreregex =

Restart Fail2Ban:

sudo systemctl restart fail2ban

3. Disable Admin Panel in Production

After initial setup, consider disabling the admin panel:

# In docker-compose.yml, remove or comment out:
# - ADMIN_TOKEN=...

You can re-enable it temporarily when needed.

Troubleshooting

"Error: Invalid certificate" in apps

Your SSL certificate isn't properly configured. Verify:

• Certificate is valid: sudo certbot certificates
• Domain resolves correctly: dig vault.your-domain.com
• Test SSL: SSL Labs

"Connection error" in browser extension

Check:

• Server URL is correct (include https://)
• Container is running: docker-compose ps
• Firewall allows 443: sudo ufw status

WebSocket connection issues

Ensure Nginx proxies WebSocket connections (check the /notifications/hub location block).

Password hints not showing

Password hints are disabled by default (SHOW_PASSWORD_HINT=false) for security. Enable only if needed.

Emergency Access Setup

Vaultwarden supports emergency access - trusted contacts can request access to your vault if something happens to you:

1. Go to Settings → Emergency Access
2. Add trusted contacts
3. Set wait time (how long before they get access)
4. Choose access level (view only or takeover)

If you become incapacitated, trusted contacts can request access. After the wait period (if you don't deny), they receive access.

Next Steps

You now have a fully self-hosted password manager. Consider adding:

Summary

You've set up a self-hosted password manager that:

• Costs nothing with free cloud credits
• Uses official Bitwarden apps you already know
• Includes premium features like TOTP, attachments, and emergency access
• Stores data on your server - no third party involved
• Can share with family via organizations
• Only you control - immune to provider breaches

LastPass users learned the hard way: entrusting passwords to others creates risk. With Vaultwarden, you get the same convenience without the trust assumption. Your passwords, your server, your rules.