Vaultwarden — Lightweight Self-Hosted Bitwarden Server

What Vaultwarden Does

• Password Vault: Store and auto-fill passwords, credit cards, identities, and secure notes
• Cross-Device Sync: All changes sync across browser, desktop, and mobile via Bitwarden apps
• Organizations: Share passwords with family or team members with role-based access
• Send: Securely share text or files with anyone via encrypted, expiring links
• TOTP Generator: Built-in 2FA code generator (premium Bitwarden feature, free in Vaultwarden)
• Attachments: Attach files to vault items with encrypted storage
• Emergency Access: Grant trusted contacts access to your vault in emergencies
• Vault Health Reports: Identify weak, reused, and breached passwords

Why Vaultwarden Over Official Bitwarden?

Official Bitwarden Server:
- Written in C# (.NET) + multiple services
- Requires 2GB+ RAM, SQL Server or PostgreSQL
- Premium features need paid subscription

Vaultwarden:
- Written in Rust (single binary)
- Requires ~50MB RAM, SQLite included
- ALL premium features free
- Runs on Raspberry Pi, NAS, any VPS

Self-Hosting

Docker (Recommended)

docker run -d --name vaultwarden 
  -e SIGNUPS_ALLOWED=true 
  -e DOMAIN=https://vault.yourdomain.com 
  -v /vw-data/:/data/ 
  -p 443:80 
  vaultwarden/server:latest

Docker Compose with HTTPS

services:
  vaultwarden:
    image: vaultwarden/server:latest
    environment:
      DOMAIN: https://vault.yourdomain.com
      SIGNUPS_ALLOWED: "false"  # Disable after creating your account
      ADMIN_TOKEN: your-admin-token
      SMTP_HOST: smtp.gmail.com
      SMTP_PORT: 587
      SMTP_SECURITY: starttls
      SMTP_USERNAME: your-email@gmail.com
      SMTP_PASSWORD: your-app-password
      SMTP_FROM: your-email@gmail.com
    volumes:
      - vw-data:/data
    ports:
      - "8080:80"
    restart: unless-stopped

volumes:
  vw-data:

Security Best Practices

# 1. Disable signups after creating your accounts
SIGNUPS_ALLOWED=false

# 2. Set admin token for web admin panel
ADMIN_TOKEN=$(openssl rand -base64 48)

# 3. Always use HTTPS (via reverse proxy)
# 4. Enable 2FA on your account
# 5. Regular backups of /data directory

Client Apps

Use official Bitwarden clients — they're fully compatible:

Point each client to your Vaultwarden URL instead of the default Bitwarden servers.

Key Features

Organization Sharing

Family Vault
├── Shared Logins
│   ├── Netflix (Mom, Dad, Kids)
│   ├── Spotify Family (All)
│   └── WiFi Password (All)
├── Finance (Mom, Dad only)
│   ├── Bank Login
│   └── Tax Software
└── Kids Only
    └── School Portal

Bitwarden Send

Share sensitive information securely:

• Text or file sharing with end-to-end encryption
• Set expiration date and max access count
• Optional password protection
• Auto-delete after expiration

Admin Panel

Access at /admin with your admin token:

• View and manage all users
• Invite new users via email
• View organization details
• Server diagnostics and configuration

Vaultwarden vs Alternatives

FAQ

Q: Is Vaultwarden secure? A: Encryption happens entirely on the client (AES-256), using the same scheme as Bitwarden. The server only stores encrypted data. The key is ensuring HTTPS in transit and physical server security.

Q: Can I migrate from 1Password/LastPass? A: Yes. Export a CSV from 1Password/LastPass and import via the Bitwarden client or Web Vault. Supported formats include 1Password 1pux, LastPass CSV, and KeePass XML.

Q: How do I back up? A: Back up the /data directory, which includes the SQLite database, attachments, RSA keys, and configuration. Schedule daily backups to off-site storage. You can also use the Bitwarden CLI to export an encrypted JSON.