How to Self-Host Vaultwarden (Bitwarden-Compatible) on a VPS

Vaultwarden is a lightweight, unofficial server that speaks the Bitwarden protocol — so you get a self-hosted password manager that works with all the official Bitwarden browser extensions and mobile apps, but sips resources (it runs happily in well under 200 MB of RAM). This guide installs it with Docker and HTTPS. For the specific case of putting it behind Nginx, see Vaultwarden behind an Nginx reverse proxy.

Why self-host a password manager?

Your vault never leaves infrastructure you control, there's no per-user subscription, and features that Bitwarden gates behind a paid plan (like organisations and TOTP) are free in Vaultwarden. The trade-off is that you're responsible for backups and uptime — non-negotiable for a password store. For the broader picture, see how to self-host a password manager on a VPS.

Prerequisites

• A VPS with Docker installed (run Docker on a VPS).
• A domain with an A record, e.g. vault.example.com. HTTPS is mandatory — browser extensions refuse to connect over plain HTTP.

Deploy Vaultwarden with Compose

We'll run Vaultwarden plus Caddy for automatic TLS.

mkdir -p ~/vaultwarden && cd ~/vaultwarden

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      - DOMAIN=https://vault.example.com
      - SIGNUPS_ALLOWED=true
    volumes:
      - ./vw-data:/data

  caddy:
    image: caddy:2
    restart: unless-stopped
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile
      - caddy_data:/data
    depends_on:
      - vaultwarden

volumes:
  caddy_data:

Caddyfile:

vault.example.com {
    reverse_proxy vaultwarden:80
}

docker compose up -d

Open https://vault.example.com, create your account, then log in.

Lock it down after first signup

Once your accounts exist, disable open registration so nobody else can create an account on your server. Set SIGNUPS_ALLOWED=false and restart:

docker compose up -d

Also set an ADMIN_TOKEN to reach the admin panel at /admin, and keep the firewall to 80/443/SSH only:

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Connect your apps

In any Bitwarden app or browser extension, tap the settings gear on the login screen and set the Server URL to https://vault.example.com before logging in. From then on it syncs against your server.

Back up your vault — do not skip this

Everything lives in ./vw-data. Back it up regularly and store copies off-server:

tar czf vw-backup-$(date +%F).tar.gz vw-data

Losing this directory means losing every password, so automate it and test a restore. A snapshot or attached block storage volume makes this reliable.

Beyond passwords: Sends, TOTP and organisations

Vaultwarden does more than store logins:

• TOTP (2FA codes): store your two-factor secrets alongside a login and Vaultwarden generates the rotating code for you — no separate authenticator app needed. Keep your most critical accounts' 2FA elsewhere too, so you're never fully dependent on a single vault.
• Vaultwarden Send: share a password or file via an expiring, optionally password-protected link — far safer than emailing secrets.
• Organisations and Collections: create an organisation to share sets of credentials with family or a team, with per-collection access control. All of this is free in Vaultwarden, unlike the hosted Bitwarden tiers.

Emergency access and updates

Think about recovery before you need it. Periodically export an encrypted backup of your vault and store it safely offline, so a catastrophic server loss never locks you out. Keep the server current — password infrastructure is exactly what you want patched promptly:

cd ~/vaultwarden
docker compose pull && docker compose up -d

Because all your data lives in the vw-data volume, updates are painless and non-destructive.

Setting up the apps and autofill

The payoff of self-hosting is that the polished official Bitwarden clients all work against your server. On each device, before logging in, open the client's settings and set the Server URL to https://vault.example.com, then sign in as normal:

• Browser extensions (Chrome, Firefox, Edge, Safari) autofill logins and offer to save new ones as you browse.
• Mobile apps integrate with the OS autofill service so passwords appear right in the login fields of other apps.
• Desktop apps and the CLI cover power users and scripting.

Once connected, they sync seamlessly. Because the vault is cached locally on each device, you can still read your passwords if the server is briefly unavailable — new changes simply sync when it returns. Turn on two-factor authentication for your account and, if you want defence in depth, keep the server reachable only over your WireGuard VPN so the vault is never exposed to the public internet at all.

FAQ

Is Vaultwarden safe to use instead of Bitwarden?

Yes. Your vault is encrypted client-side, so the server only ever stores ciphertext. Keep it updated and backed up and it's a solid self-hosted option.

Does Vaultwarden work with official Bitwarden apps?

Yes — that's the whole point. Every official browser extension and mobile app works; you just point them at your server URL.

How much RAM does Vaultwarden need?

Very little — it comfortably runs in a couple of hundred MB, which is why it's popular for small VPS plans and running alongside other services.

What happens if my VPS goes down?

Clients keep a cached local copy of the vault, so you can still read passwords offline. Syncing new changes resumes when the server is back. This is exactly why backups matter.

Keep your passwords on hardware you control. Deploy Vaultwarden on a secure NVMe VPS with full root access, or read more on the security page.