[{"data":1,"prerenderedAt":184},["ShallowReactive",2],{"seo-verification":3,"blog-migrating-from-1password-to-vaultwarden-the-complete-guide-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":13,"excerpt":14,"readTime":15,"views":16,"isPinned":17,"publishedAt":18,"category":19,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":134,"ctaBody":135,"ctaButton":136,"ctaUrl":137,"relatedPosts":138},312,"migrating-from-1password-to-vaultwarden-the-complete-guide",{"fr":10,"en":8,"ar":11,"es":12},"migrer-1password-vaultwarden-self-hosted-2026","الانتقال-من-1password-إلى-vaultwarden-الدليل-الشامل","migrar-de-1password-a-vaultwarden-guia-completa","Migrating from 1Password to Vaultwarden: the complete guide","Export your 1Password vault as .1pux, import it with Bitwarden CLI and deploy Vaultwarden on a VPS — full migration in under an hour.",8,0,false,"2026-08-29T00:00:00+00:00",{"id":15,"name":20,"slug":21,"color":22,"icon":23},"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":15,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fmigrer-1password-vaultwarden-self-hosted-2026-poster.svg",{"categorySlug":30,"appSlug":31},"cybersecurity-bastion","vaultwarden","The 1Password price hike in March 2026 pushed many developers to reconsider their password manager. Vaultwarden is a serious alternative: the same AES-256 client-side encryption as Bitwarden.com, full compatibility with all official Bitwarden clients, and a process that uses less than 50 MB of RAM on your VPS. This guide covers the full migration — 1PUX export, Bitwarden CLI import, Vaultwarden deployment — without losing a single credential.",[34,38,49,52,65,80,83,124,128,131],{"type":35,"title":36,"body":37},"h2","Why migrate now","Since March 27, 2026, the 1Password Individual plan billed annually has gone from {{$35.88\u002Fyr}} to {{$47.88\u002Fyr}}, a 33% increase. In January 2026, Bitwarden.com had already raised its Premium plan from $9.99 to $19.80 per year — nearly double. Both increases happening simultaneously made self-hosting economically obvious for developers who already have a VPS: Vaultwarden runs on less than 50 MB of RAM, with no software license fee, at a fixed monthly cost equal to an entry-level VPS.\n\nThe most common objection — \"managing my own password manager is risky\" — does not hold against Vaultwarden's architecture. Encryption is done entirely client-side, using AES-256-CBC with PBKDF2 or Argon2id key derivation: the server never sees your passwords in plaintext, even in the event of a full machine compromise.",{"type":39,"title":40,"items":41},"ul","What Vaultwarden brings to a developer",[42,43,44,45,46,47,48],"**AES-256-CBC client-side encryption** — your passwords never leave your device in plaintext, regardless of the server configuration.","**Full compatibility** with all official Bitwarden clients: browser extensions, iOS, Android, desktop apps and CLI, without any modifications.","**Lightweight memory footprint** — the Vaultwarden process alone uses 10 to 30 MB of RAM; less than 100 MB with the Docker container.","**Fixed cost** — a 1 vCPU \u002F 512 MB VPS is enough for personal use or a small team, with no variable SaaS subscription.","**Full data control** — backup, restore, datacenter choice and retention period remain in your hands.","**Multi-profile and organization support** — Vaultwarden supports organization management and vault sharing, just like Bitwarden.com.","**Decoupled updates** — you choose when to update the server; official Bitwarden clients manage their own release cycle.",{"type":35,"title":50,"body":51},"Prerequisites before you start","Before starting the migration, make sure you have all of the following.\n\nServer side: a VPS with at least 1 vCPU and 512 MB of RAM, Docker and Docker Compose installed, a domain name pointing to the server IP, and a reverse proxy (Caddy or Nginx) configured for TLS termination. The Vaultwarden deployment itself is covered in the article \u003Ca href=\"\u002Fblog\u002Fdeploy-vaultwarden-vps\">Deploy Vaultwarden on a VPS\u003C\u002Fa> — this guide assumes your instance is already online and accessible over HTTPS.\n\nLocal workstation: 1Password v8 or later installed (required to export in .1pux format), Bitwarden CLI (`bw`) installed via npm (`npm install -g @bitwarden\u002Fcli`) or the official binary, and Node.js ≥ 18 if installing via npm.",{"type":53,"title":54,"steps":55},"steps","Step 1 — Export your 1Password vault",[56,59,62],{"title":57,"body":58},"Open the export dialog","On macOS, open 1Password and go to **File → Export**. On Windows, click the ellipsis (…) at the top of the sidebar, then **Export**. Select the account to export — if you have multiple vaults, you can export the entire account in a single operation.",{"title":60,"body":61},"Choose the 1PUX format","In the dialog box, enter your 1Password account password to confirm the operation. Then select the **1Password Unencrypted Export (.1pux)** format. This JSON-based format preserves the full structure — custom fields, secure notes, identities, application passwords — unlike CSV, which truncates metadata.",{"title":63,"body":64},"Save the file somewhere safe","Choose an encrypted local folder (FileVault or BitLocker enabled) to store the `.1pux` file. This file contains all your secrets in structured plaintext — do not leave it in a downloads folder or send it by email. Once the migration is complete, delete it securely.",{"type":53,"title":66,"steps":67},"Step 2 — Import with Bitwarden CLI",[68,71,74,77],{"title":69,"body":70},"Point the CLI to your Vaultwarden instance","By default, `bw` points to `bitwarden.com`. Redirect it to your instance before anything else:\n\n```bash\nbw config server https:\u002F\u002Fvault.your-domain.com\n```\n\nVerify the response: the CLI should confirm `Saved setting 'serverUrl'.`",{"title":72,"body":73},"Log in and unlock the vault","Authenticate with your Vaultwarden credentials (email + master password set during initial setup):\n\n```bash\nbw login your@email.com\n```\n\nThe CLI will prompt for your master password interactively. Once logged in, unlock the vault and export the session key:\n\n```bash\nexport BW_SESSION=$(bw unlock --raw)\n```\n\nAll subsequent commands use this variable implicitly to access the decrypted vault.",{"title":75,"body":76},"Run the .1pux import","Import your 1Password export using the `1password1pux` format:\n\n```bash\nbw import 1password1pux \u002Fpath\u002Fto\u002Fexport.1pux\n```\n\nThe CLI shows progress and a summary of imported items by type (logins, notes, identities, cards). If your 1Password account contained multiple vaults, they are all imported into a single Bitwarden vault — folders are recreated to preserve the structure.\n\nIf you see an `Invalid format` error, verify the file has the `.1pux` extension and that you are using a recent CLI version (`bw --version`).",{"title":78,"body":79},"Verify the import in a Bitwarden client","Open the Bitwarden browser extension or desktop app, point the server to your Vaultwarden instance, then log in. Browse your vaults and check a sample of passwords — in particular entries with custom fields, secure notes and identities, which are most likely to vary between password managers.",{"type":35,"title":81,"body":82},"Step 3 — Vaultwarden on your VPS","If your Vaultwarden instance is not yet deployed, follow the guide \u003Ca href=\"\u002Fblog\u002Fdeploy-vaultwarden-vps\">Deploy Vaultwarden on a VPS\u003C\u002Fa>, which covers the full Docker configuration. In summary, three points are non-negotiable before importing anything:\n\n**HTTPS required.** Bitwarden clients refuse to connect to a server without valid TLS. Caddy or Nginx with Let's Encrypt (certbot) are sufficient; verify your domain is reachable over `https:\u002F\u002F` before configuring the CLI.\n\n**Correct `DOMAIN` variable.** In your `docker-compose.yml`, the variable `DOMAIN=https:\u002F\u002Fvault.your-domain.com` must match exactly the URL you declared in `bw config server` — no trailing slash.\n\n**Volume backup before import.** The import writes to Vaultwarden's SQLite database (`\u002Fdata\u002Fdb.sqlite3`). Take a snapshot of your Docker volume before running `bw import`, so you can roll back if the import goes wrong.",{"type":84,"title":85,"headers":86,"rows":91},"comparison","1Password vs Bitwarden.com vs Vaultwarden",[87,88,89,90],"Criterion","1Password","Bitwarden.com","Vaultwarden (self-hosted)",[92,97,102,106,111,116,120],[93,94,95,96],"Annual cost (individual)","{{$47.88\u002Fyr}} since March 2026","{{$19.80\u002Fyr}} since Jan. 2026 (Premium)","VPS cost only",[98,99,100,101],"Data control","1Password servers","Bitwarden servers","Your VPS, your datacenter",[103,104,104,105],"Encryption","AES-256-CBC client-side","AES-256-CBC client-side (identical)",[107,108,109,110],"Official mobile clients","Dedicated 1Password apps","iOS, Android, desktop, extension","Official Bitwarden clients, unmodified",[112,113,114,115],"Browser extension","1Password X","Bitwarden extension","Bitwarden extension (same binary)",[117,118,118,119],"Updates","Automatic (SaaS)","Manual (you choose the timing)",[121,122,122,123],"Server RAM required","N\u002FA (SaaS)","10–30 MB (process), \u003C 100 MB (Docker)",{"type":125,"title":126,"body":127},"tip","Back up and test restoration","Once the import is complete, set up automated backups of the Vaultwarden volume before disabling your 1Password account. The guide \u003Ca href=\"\u002Fblog\u002Fsauvegardes-restic-vps\">Restic backups on a VPS\u003C\u002Fa> covers a Docker-adapted 3-2-1 strategy: stop the container, snapshot the volume, send encrypted to remote storage, restart. Test restoration on a separate machine — not just the presence of the backup file — before considering the migration done. A password vault without a tested restore is not a backup.",{"type":35,"title":129,"body":130},"Troubleshooting — common errors","**`Invalid format` on import.** The format expected by the CLI is exactly `1password1pux` (no spaces, lowercase). Make sure you are not using `1password` alone or `1pux` — these names correspond to other formats (respectively the 1PIF format from 1Password 6 and an unrecognized alias). List available formats with `bw import --formats | grep 1password`.\n\n**`ERR_CERT_AUTHORITY_INVALID` in clients.** Bitwarden clients require a TLS certificate signed by a recognized authority — a self-signed certificate is rejected. Verify that Let's Encrypt has issued a valid certificate for your domain and that it is not expired (`bw config server` shows a warning if the certificate is invalid).\n\n**Vault locked in migration mode.** If you import from an existing Bitwarden.com account before switching to Vaultwarden, your items remain encrypted with the cloud account key. After `bw config server` pointing to your instance, create a new local account: the CLI does not migrate the encryption key between instances, only plaintext data transits via import.\n\n**Import stops on an SSH entry.** A known regression in certain CLI versions blocked import of SSH keys in 1pux format (issue bitwarden\u002Fclients #20432). CLI version 2026.7.0 includes a fix. Update with `npm install -g @bitwarden\u002Fcli@latest` if you encounter this behavior.",{"type":35,"title":132,"body":133},"Leaving 1Password with confidence","Once the import is verified on the Vaultwarden side — open each item type (logins, notes, identities, cards) in a Bitwarden client and check a representative sample — you can deactivate your 1Password account. Do not wait for your subscription to expire before deleting the local `.1pux` file: it contains all your secrets in structured plaintext.\n\nTo go further in securing your infrastructure, the articles \u003Ca href=\"\u002Fblog\u002Fdurcissement-serveur-linux-initial\">Initial Linux server hardening\u003C\u002Fa> and \u003Ca href=\"\u002Fblog\u002Fpassbolt-gestionnaire-mots-de-passe-equipe-vps\">Passbolt for a team\u003C\u002Fa> cover the next steps: port lockdown, SSH key management and secure sharing in a team context.","A VPS to run Vaultwarden","A ServOrbit VPS with root access and a dedicated IPv4 is enough to host Vaultwarden for life. Choose your OS, deploy in minutes.","Launch a ServOrbit VPS","\u002Fvps-cloud",[139,155,169],{"id":140,"slug":141,"slugs":142,"title":146,"excerpt":147,"readTime":148,"views":16,"isPinned":17,"publishedAt":149,"category":150,"categories":151,"featuredImage":26,"bgImage":27,"posterImage":153,"relatedSolution":154},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":143,"en":141,"ar":144,"es":145},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","desplegar-vaultwarden-en-un-vps","Self-Host Your Password Manager: Deploy Vaultwarden on VPS","Self-host Vaultwarden on a VPS to get unlimited Bitwarden-compatible password management, team vaults and TOTP at a fixed monthly cost — under 50 MB RAM.",6,"2026-06-24T00:00:00+00:00",{"id":15,"name":20,"slug":21,"color":22,"icon":23},[152],{"id":15,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":23,"appSlug":31},{"id":156,"slug":157,"slugs":158,"title":162,"excerpt":163,"readTime":15,"views":16,"isPinned":17,"publishedAt":164,"category":165,"categories":166,"featuredImage":26,"bgImage":27,"posterImage":168,"relatedSolution":26},296,"passbolt-on-vps-auditable-team-password-vault-no-subscription",{"fr":159,"en":157,"ar":160,"es":161},"passbolt-gestionnaire-mots-de-passe-equipe-vps","passbolt-على-vps-خزنة-مرور-للفريق-بلا-اشتراك","passbolt-en-vps-boveda-de-contrasenas-sin-suscripcion","Passbolt on VPS: auditable team password vault, no subscription","Deploy Passbolt Community Edition on your VPS with Docker and PostgreSQL: per-recipient GPG encryption, per-entry audit log, REST API — zero SaaS subscription.","2026-08-23T00:00:00+00:00",{"id":15,"name":20,"slug":21,"color":22,"icon":23},[167],{"id":15,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fpassbolt-gestionnaire-mots-de-passe-equipe-vps-poster.svg",{"id":170,"slug":171,"slugs":172,"title":176,"excerpt":177,"readTime":178,"views":16,"isPinned":17,"publishedAt":179,"category":180,"categories":181,"featuredImage":26,"bgImage":27,"posterImage":183,"relatedSolution":26},113,"automate-your-vps-backups-with-restic",{"fr":173,"en":171,"ar":174,"es":175},"sauvegardes-restic-vps","أتمتة-نسخ-خادمك-vps-الاحتياطية-باستخدام-restic","copias-de-seguridad-vps-con-restic","Automate Your VPS Backups with Restic","Automate your VPS backups with Restic: encrypted snapshots, deduplication and shipping to S3 or any object backend.",3,"2026-02-27T00:00:00+00:00",{"id":15,"name":20,"slug":21,"color":22,"icon":23},[182],{"id":15,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fsauvegardes-restic-vps-poster.svg",1788035350436]