Self-Host Vaultwarden: Your Own Password Manager

Vaultwarden is a lightweight server that speaks the Bitwarden protocol. You run it on your own VPS and use the official Bitwarden apps and browser extensions — with your vault stored on hardware you control.

What you need

• A small VPS — Atom or Spark is plenty.
• A domain or subdomain, e.g. vault.example.com, pointed at the server.
• Docker (one-click app on Kvantis, or install it yourself).

Run it with Docker Compose

Create docker-compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data:/data
    ports:
      - "127.0.0.1:8080:80"

docker compose up -d

The port is bound to 127.0.0.1, so the vault is only reachable through your HTTPS proxy.

Add HTTPS

Bitwarden apps require HTTPS. The quickest way is Caddy, which gets certificates automatically. In /etc/caddy/Caddyfile:

vault.example.com {
    reverse_proxy 127.0.0.1:8080
}

systemctl reload caddy

Create your account, then close sign-ups

Open https://vault.example.com, create your account, then set SIGNUPS_ALLOWED: "false" and run docker compose up -d again. Otherwise anyone who finds the page can register.

Connect your apps

In any Bitwarden app, choose self-hosted on the login screen and enter your server URL.

Back it up

Everything lives in vw-data/. Copy it off the server regularly — the SQLite database plus the attachments folder. Your apps keep a local copy, but the server is your source of truth.

Keep it updated

docker compose pull && docker compose up -d

Deploy a server — own your passwords, paid in crypto.