Vaultwarden: self-hosting my password manager

My passwords live in a vault on my own server, not with a cloud company. Vaultwarden makes that easy: it’s a lightweight, self-hosted server that works with all the official Bitwarden apps and browser extensions.

What is Vaultwarden?

Bitwarden is a popular open-source password manager. Vaultwarden is an independent re-implementation of the Bitwarden server, written in Rust. It’s small enough to run happily alongside everything else on a home server, and because it speaks the same language as Bitwarden, you use the normal Bitwarden apps on your phone, desktop and browser. You just point them at your own server.

• Passwords, passkeys, secure notes and cards, synced across all your devices
• Family and organisation sharing
• Sends (secure, expiring shares) and attachments
• No subscription, and your vault never leaves your house

My setup

This is my compose file, saved as /opt/stacks/vaultwarden/compose.yaml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      DOMAIN: "https://vaultwarden.example.com"
    volumes:
      - ./vw-data:/data
    ports:
      - 88:80
    labels:
      - com.centurylinklabs.watchtower.enable=false

• DOMAIN must match the public HTTPS address you’ll use. Some features break if it doesn’t.
• Everything Vaultwarden stores, including the database, attachments and keys, lives in ./vw-data.
• The Watchtower label stops automatic updates. For something as important as my password vault, I’d rather update deliberately after reading the release notes. See my post on Watchtower.

HTTPS is not optional

The Bitwarden web vault uses browser cryptography features that only work over HTTPS, so Vaultwarden needs a proper certificate. I put it behind Nginx Proxy Manager with a Let’s Encrypt certificate, with Websockets Support turned on so changes sync to other devices instantly.

Lock it down

• Turn off public sign-ups once your own accounts exist, otherwise anyone who finds your server can create an account on it. Add SIGNUPS_ALLOWED: "false" to the environment section and recreate the container. You can still invite family members from the admin page.
• Protect the admin page. It’s disabled unless you set ADMIN_TOKEN. If you enable it, use a hashed token. Running docker exec -it vaultwarden /vaultwarden hash generates one.
• Use two-factor login on your account. An authenticator app is supported out of the box.
• Use a strong master password. It’s the one password you can’t recover. Vaultwarden can’t reset it for you.

Back it up

Verdict

Vaultwarden is one of the most useful things I self-host. It’s light, rock solid, and it means my passwords are under my control while I still get the polished Bitwarden apps everywhere.