[{"data":1,"prerenderedAt":161},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-your-password-manager-deploy-vaultwarden-on-vps-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":31,"sections":32,"ctaTitle":109,"ctaBody":110,"ctaButton":111,"ctaUrl":112,"relatedPosts":113},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":10,"en":8,"ar":11},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","Self-Host Your Password Manager: Deploy Vaultwarden on VPS","Self-host Vaultwarden on a VPS to get unlimited Bitwarden-compatible password management, team vaults and TOTP at a fixed monthly cost — under 50 MB RAM.",5,0,false,"2026-06-24T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":23,"appSlug":30},"vaultwarden","Vaultwarden is an open-source, Rust-based implementation of the Bitwarden server — lightweight enough to run alongside other services on the smallest VPS, while remaining fully compatible with every official Bitwarden client on every platform.",[33,37,47,50,72,75,84,99,103,106],{"type":34,"title":35,"body":36},"h2","Why Self-Host Your Password Manager?","Cloud password managers charge per user per month, store your encrypted vault on servers you don't control, and can disappear or raise prices overnight. Vaultwarden flips that model: one container on your VPS, one Docker volume to back up, and without user limits users at a fixed infrastructure cost. Because Vaultwarden speaks the Bitwarden protocol, every Bitwarden client — Chrome extension, Firefox add-on, iOS, Android, Windows, Linux, CLI — connects to your self-hosted instance without any modification.",{"type":38,"title":39,"items":40},"ul","Key benefits",[41,42,43,44,45,46],"100% compatible with all official Bitwarden clients — no forks, no custom apps, no relearning","End-to-end AES-256 encryption: your master password never leaves your device","Under 50 MB RAM at idle — runs comfortably on a 512 MB VPS alongside other services","Without user limits users and organization vaults with encrypted sharing and role-based access","Built-in TOTP authenticator: replace Google Authenticator with a self-hosted alternative","Emergency access — grant a trusted contact read access after a configurable waiting period",{"type":34,"title":48,"body":49},"Prerequisites","You need a VPS with at least 1 vCPU, 512 MB RAM, and Docker installed (Ubuntu 22.04 LTS recommended). You also need a domain name pointing to the VPS — Bitwarden clients refuse non-HTTPS vaults, so HTTPS is mandatory. Allow ports 80 and 443 through your firewall: `ufw allow 80 && ufw allow 443`.",{"type":51,"title":52,"steps":53},"steps","Deploy Vaultwarden in 5 steps",[54,57,60,63,66,69],{"title":55,"body":56},"Install Docker","If Docker is not already installed: `curl -fsSL https:\u002F\u002Fget.docker.com | sh && systemctl enable --now docker`. Verify with `docker --version`.",{"title":58,"body":59},"Start Vaultwarden","Run the container: `docker run -d --name vaultwarden --restart=always -v vaultwarden:\u002Fdata -p 127.0.0.1:8000:80 -e WEBSOCKET_ENABLED=true vaultwarden\u002Fserver:latest`. The server starts in under a second and listens on localhost port 8000.",{"title":61,"body":62},"Set up HTTPS with Caddy","Install Caddy: `apt install -y caddy`. Create `\u002Fetc\u002Fcaddy\u002FCaddyfile` with: `passwords.yourdomain.com { reverse_proxy localhost:8000 }`. Reload Caddy: `systemctl reload caddy`. A Let's Encrypt TLS certificate is provisioned automatically and renewed forever — zero configuration.",{"title":64,"body":65},"Create your account","Open `https:\u002F\u002Fpasswords.yourdomain.com` in your browser. Click 'Create Account', pick a strong master password (it encrypts everything locally before anything is sent to the server), and your vault is live immediately.",{"title":67,"body":68},"Lock down registrations","Once all accounts are created, stop the container and restart it with `-e SIGNUPS_ALLOWED=false` added to the `docker run` command. Your instance is now invite-only. For ongoing user management, enable the admin panel by adding `-e ADMIN_TOKEN=$(openssl rand -base64 48)`.",{"title":70,"body":71},"Logging in for the first time","When you first open the URL, Vaultwarden shows the Bitwarden web vault: click \"Create account\" and set your own e-mail address and master password (nobody can recover it, not even us). Do this IMMEDIATELY: registration is open.",{"type":34,"title":73,"body":74},"Client\u002FServer Compatibility and Silent Failures","Recent Bitwarden clients introduced a new initial authentication flow that calls the `\u002Fidentity\u002Faccounts\u002Fprelogin\u002Fpassword` endpoint. Vaultwarden instances running versions older than 1.36.0 do not know this endpoint and return a 404 error with no explicit message — the client simply shows a generic login failure. The trap is subtle: devices already logged in before the client update continue working normally, because their session is already established and bypasses this new authentication path. Only new devices fail. Run `curl https:\u002F\u002Fyourdomain.com\u002Fidentity\u002Faccounts\u002Fprelogin\u002Fpassword -X POST -d '{\"email\":\"test@test.com\"}' -H 'Content-Type: application\u002Fjson'` — a 404 response means your server is too old.",{"type":38,"title":76,"items":77},"Symptoms of a client\u002Fserver version mismatch",[78,79,80,81,82,83],"Login fails on a new device or browser, while existing devices work normally with the same account","Generic error message with no indication of the root cause (\"An error has occurred\" or \"Invalid username or password\")","A freshly installed Chrome or Firefox extension fails, but the identical version on another machine works","The Bitwarden web vault hosted on your instance returns 404 on `\u002Fidentity\u002Faccounts\u002Fprelogin\u002Fpassword`","No error in Vaultwarden server logs — the endpoint does not exist, so there is nothing to log","The problem appeared after an automatic Bitwarden client update on the new device",{"type":51,"title":85,"steps":86},"Diagnose and fix the mismatch",[87,90,93,96],{"title":88,"body":89},"Check your server version","Query the version endpoint: `curl https:\u002F\u002Fyourdomain.com\u002Fapi\u002Fversion`. If the response shows a version older than 1.36.0, your server does not support the new authentication flow required by recent clients.",{"title":91,"body":92},"Update to the latest image","The safest approach is to always use `vaultwarden\u002Fserver:latest` and keep the image current. To update: `docker pull vaultwarden\u002Fserver:latest && docker stop vaultwarden && docker rm vaultwarden`, then re-run the same `docker run` command used at installation. Vaultwarden preserves all data in the named volume — no manual migration required.",{"title":94,"body":95},"Verify the update took effect","After restarting, query `curl https:\u002F\u002Fyourdomain.com\u002Fapi\u002Fversion` again and confirm the version is 1.36.0 or later. Then test login from a fresh private browsing tab.",{"title":97,"body":98},"Pin a version if stability is a priority","If you prefer to control updates manually, use a versioned tag: `vaultwarden\u002Fserver:1.37.0` for example. In that case, monitor GitHub releases and update whenever a new Bitwarden client version ships — the two are tightly coupled.",{"type":100,"title":101,"body":102},"tip","SIGNUPS_ALLOWED=false trap: only set it after creating your admin account","A common installation mistake: setting `-e SIGNUPS_ALLOWED=false` before creating the administrator account. The result — your own instance refuses to let you register and you cannot log in at all. The order is mandatory: (1) start without this parameter, (2) immediately create your admin account through the web interface, (3) then restart the container with `SIGNUPS_ALLOWED=false`. If you have already locked yourself out, the emergency exit is to enable the admin panel with `-e ADMIN_TOKEN=$(openssl rand -base64 48)` and invite the admin user from `\u002Fadmin`.",{"type":100,"title":104,"body":105},"Daily backups in one cron line","Add this to root's crontab (`crontab -e`): `0 3 * * * docker run --rm -v vaultwarden:\u002Fdata -v \u002Fbackup:\u002Fout busybox tar czf \u002Fout\u002Fvaultwarden-$(date +%F).tar.gz \u002Fdata`. Run it daily at 3 AM — the entire vault (SQLite file + attachments) lands in `\u002Fbackup` as a timestamped archive. Send that directory to S3 or Backblaze B2 with `rclone` for off-site protection.",{"type":100,"title":107,"body":108},"The Official Documentation","For advanced configuration and tool-specific options, refer to the \u003Ca href=\"https:\u002F\u002Fgithub.com\u002Fdani-garcia\u002Fvaultwarden\u002Fwiki\" target=\"_blank\" rel=\"noopener noreferrer\">official Vaultwarden documentation\u003C\u002Fa>. This guide covers going live on a VPS; the vendor's documentation remains the reference for fine-tuning, major upgrades and specific use cases.","Deploy Vaultwarden on your VPS","Order a ServOrbit VPS, deploy Vaultwarden in minutes, and own your password vault forever.","Deploy Vaultwarden","\u002Fmarketplace\u002Fcybersecurity-bastion\u002Fvaultwarden",[114,131,148],{"id":115,"slug":116,"slugs":117,"title":120,"excerpt":121,"readTime":122,"views":15,"isPinned":16,"publishedAt":123,"category":124,"categories":125,"featuredImage":26,"bgImage":27,"posterImage":127,"relatedSolution":128},108,"securing-your-vps-with-crowdsec",{"fr":118,"en":116,"ar":119},"securiser-vps-crowdsec","تأمين-خادمك-الافتراضي-vps-باستخدام-crowdsec","Securing your VPS with CrowdSec","Deploy CrowdSec on your VPS to block attacks thanks to behavioral detection and a shared community blocklist.",4,"2026-03-04T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[126],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fsecuriser-vps-crowdsec-poster.svg",{"categorySlug":129,"appSlug":130},"cybersecurity-bastion","crowdsec",{"id":132,"slug":133,"slugs":134,"title":137,"excerpt":138,"readTime":139,"views":15,"isPinned":16,"publishedAt":140,"category":141,"categories":142,"featuredImage":26,"bgImage":27,"posterImage":144,"relatedSolution":145},110,"setting-up-a-wireguard-vpn-on-your-vps",{"fr":135,"en":133,"ar":136},"vpn-wireguard-vps","إعداد-شبكة-vpn-باستخدام-wireguard-على-خادمك-vps","Setting up a WireGuard VPN on your VPS","Deploy a WireGuard VPN on your Cloud VPS: encrypted tunnel, Docker configuration and clients in a few minutes. Step-by-step guide.",3,"2026-03-02T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[143],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fvpn-wireguard-vps-poster.svg",{"categorySlug":146,"appSlug":147},"networking-vpn","wireguard-server",{"id":149,"slug":150,"slugs":151,"title":154,"excerpt":155,"readTime":122,"views":15,"isPinned":16,"publishedAt":156,"category":157,"categories":158,"featuredImage":26,"bgImage":27,"posterImage":160,"relatedSolution":26},116,"free-ssl-certificates-with-lets-encrypt-on-a-vps",{"fr":152,"en":150,"ar":153},"certificats-ssl-lets-encrypt-vps","شهادات-ssl-مجانية-باستخدام-lets-encrypt-على-خادم-vps","Free SSL Certificates with Let's Encrypt on a VPS","Deploy Let's Encrypt on your VPS: free HTTPS, automatic renewal, an A+ on SSL Labs with Nginx, Caddy or Traefik in Docker.","2026-02-24T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[159],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fcertificats-ssl-lets-encrypt-vps-poster.svg",1787581015133]