How to Self-Host a Password Manager on a VPS

Self-hosting a password manager means your credentials live on infrastructure you control, with no third-party breach surface and no subscription. But which one? This guide compares the leading self-hosted options, helps you choose, and walks through deploying the most popular pick on a VPS securely. Whichever you choose, two rules are non-negotiable: HTTPS and backups.

The main options

• Vaultwarden — a lightweight server compatible with all official Bitwarden apps. The best all-rounder for most people: great apps, browser autofill, sharing and TOTP, all self-hosted. Full walkthrough in how to self-host Vaultwarden.
• KeePass + sync — a local encrypted database file you sync between devices (via Syncthing or Nextcloud). Maximum control, no server to secure, but clunkier multi-device use.
• Passbolt — team-oriented, built around end-to-end encryption and granular sharing. Heavier to run; excellent for organisations.

For most individuals and families, Vaultwarden wins on polish-to-effort ratio, so that's what we'll deploy.

Non-negotiables for any password server

1. HTTPS always. Browser extensions refuse plain HTTP, and you should too. Use Let's Encrypt via a reverse proxy — see free SSL certificates with Let's Encrypt.
2. Backups, tested. A lost database means every password gone. Automate backups off-server and actually restore one to confirm it works.
3. A tight firewall and strong admin auth. Only 80/443/SSH open, and two-factor on your account.

Deploy Vaultwarden with Docker

mkdir -p ~/passwords && cd ~/passwords

services:
  vaultwarden:
    image: vaultwarden/server:latest
    restart: unless-stopped
    environment:
      - DOMAIN=https://vault.example.com
      - SIGNUPS_ALLOWED=true
    volumes:
      - ./vw-data:/data

  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data

volumes:
  caddy_data:

Caddyfile:

vault.example.com {
    reverse_proxy vaultwarden:80
}

docker compose up -d

Harden it after first login

Create your account at https://vault.example.com, then set SIGNUPS_ALLOWED=false and restart so nobody else can register. Lock the firewall:

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Enable two-factor authentication on your vault and, for the truly cautious, keep the whole thing reachable only over a WireGuard VPN so it's never exposed publicly.

Back up the vault

tar czf vault-backup-$(date +%F).tar.gz vw-data

Schedule that with cron and copy it off-server. Treat this backup as the most important one you have.

Migrating from your current manager

Switching to a self-hosted vault doesn't mean re-typing everything. Almost every password manager — LastPass, 1Password, Chrome, Firefox, KeePass — can export your entries to a CSV or JSON file, and the Bitwarden apps that Vaultwarden uses import dozens of these formats directly. The process:

1. Export your existing vault to a file.
2. In the Bitwarden web vault (pointed at your server) choose *Tools → Import data* and select the matching format.
3. Verify a handful of entries imported correctly.
4. Securely delete the export file — it's plaintext and dangerous to leave lying around: shred -u export.csv.

Good vault hygiene

Self-hosting is only as secure as your habits. A short checklist:

• Use a long, unique master password you don't reuse anywhere — it's the one password protecting all the others.
• Turn on two-factor authentication for the vault itself.
• Run the built-in vault health reports to find reused, weak or breached passwords, and fix them.
• Store 2FA recovery codes for critical accounts somewhere separate, so losing vault access never locks you out entirely.
• Keep the server patched and the data directory backed up off-site and tested.

Do those things and a self-hosted vault is every bit as safe as a commercial one — with the bonus that the encrypted data never leaves hardware you control.

KeePass and Passbolt, in brief

Vaultwarden suits most people, but the alternatives fit specific needs:

KeePass (with synced database). There's no server to secure — your passwords live in a single encrypted .kdbx file that you open with a local app. To use it across devices, sync that file with Syncthing or Nextcloud. You get maximum control and the smallest attack surface, at the cost of clunkier multi-device use and manual conflict handling. It's a great choice for the security-focused who don't mind the extra friction.

Passbolt. Built for teams, Passbolt centres on end-to-end encrypted sharing with fine-grained permissions and an audit trail. It's heavier to run than Vaultwarden — it wants its own database and careful GPG key setup — but for an organisation that needs to share credentials safely with accountability, it's purpose-built. Install it with Docker much like the others, behind HTTPS and a firewall.

Whichever you pick, the non-negotiables from earlier still apply: HTTPS, strong master credentials, two-factor and tested off-site backups. The tool matters less than the habits around it.

FAQ

Which self-hosted password manager is best?

For most people, Vaultwarden — it's light, works with official Bitwarden apps, and covers autofill, sharing and TOTP. KeePass suits control purists; Passbolt suits teams.

Is a self-hosted password manager safe?

Yes, when done right: HTTPS, strong master password, two-factor, a tight firewall and tested backups. Vaults are encrypted client-side, so the server only ever holds ciphertext.

What happens if my server goes down?

Clients cache a local copy of the vault, so you can still read passwords offline; syncing resumes when the server returns. This is exactly why backups matter.

Do I need a static IP or domain?

A domain is strongly recommended so you can get a valid HTTPS certificate and use a stable URL across devices.

Keep your credentials on hardware you own. Deploy on a secure NVMe VPS, and read our approach on the security page.