Is Vaultwarden safe to use?

Yes. Vaultwarden implements the same end-to-end encryption as the official Bitwarden server — your master password never leaves your device and all vault data is AES-256 encrypted before being sent to the server. The project is actively maintained with security patches published regularly.

Does Vaultwarden require HTTPS?

Yes. Official Bitwarden clients refuse to connect to a server without a valid TLS certificate, so you do need a domain name pointing at your VPS. What you do not need is to set up a reverse proxy or request a certificate yourself: attach the domain to the app from your ServOrbit client area and the nginx vhost and the TLS certificate are installed, then renewed, for you. It takes a couple of minutes, plus DNS propagation.

How much RAM does Vaultwarden need?

Vaultwarden is extremely lightweight: under 50 MB RAM at idle, even while serving dozens of concurrent users. A 512 MB VPS is sufficient for personal use or a small team; 1 GB is comfortable for an organization with 20–50 users.

Can I migrate from Bitwarden.com to Vaultwarden?

Yes. Export your vault from Bitwarden.com (Settings → Export Vault → JSON) and import it into Vaultwarden from the web vault or the app. The process takes under two minutes and all your passwords, notes, and folders are preserved.

Harden infrastructure security.

Vaultwarden

Self-hosted Bitwarden in one Rust container — unlimited passwords, zero subscription, your data stays on your VPS.

512 MB (1 GB recommended) RAM 1 vCPU Port 8000 Available

Source code

Tech stack

DockerRustSQLite

Minimum RAM512 MB (1 GB recommended)

Minimum CPU1 vCPU

Default port8000

Compatible OSubuntu-24.04

Vaultwarden is an unofficial, open-source server implementation of the Bitwarden protocol written in Rust. Every official Bitwarden client works with it unchanged: browser extensions (Chrome, Firefox, Safari), iOS and Android apps, and the desktop client. Your team gets encrypted password sharing, TOTP authenticator, secure notes, emergency access, and an admin panel — all on a server that idles under 50 MB RAM.

Deployed on a ServOrbit VPS, Vaultwarden stores your vault in an SQLite database inside a single Docker volume. No external database server, no third-party telemetry, no per-user billing. One container, one volume to back up, and all your passwords are yours for life at a fixed monthly cost.

Key features

100% compatible with all official Bitwarden clients: browser extensions, iOS, Android, desktop, and CLI

End-to-end encrypted vault: passwords, secure notes, credit cards, identities, and file attachments

Built-in TOTP authenticator — replace Google Authenticator or Authy with a self-hosted alternative

Organization vaults and encrypted sharing for teams, families, or agencies

Emergency access: grant a trusted contact read access after a configurable waiting period

Admin panel to manage users, reset accounts, and configure sign-up policies without CLI

Uses under 50 MB RAM at idle — runs comfortably alongside other services on the smallest VPS

When to use this solution?

1

Team password management

Share credentials across your dev team or agency in encrypted organization vaults. Every member uses the Bitwarden app they already know — you just own the server.

2

Freelancer & solo dev

Stop paying Bitwarden's or 1Password's per-user fee. Self-host for yourself and your clients on a VPS that costs less per year than a single premium subscription.

3

Agency client onboarding

Spin up a Vaultwarden instance for each client. Give them a branded URL (e.g. passwords.client.ma), their own vault, and emergency-access policies — without mixing their credentials with yours.

Deploy Vaultwarden on your VPS

Guide optimized for ServOrbit Cloud VPS.

01

Order the VPS

Order a ServOrbit VPS with at least 1 vCPU and 512 MB of RAM, running Ubuntu 24.04. Plan for a domain name to point at that VPS as well: Bitwarden clients refuse to talk to a vault that is not served over HTTPS.

02

Deploy Vaultwarden

In your ServOrbit client area: Marketplace → Security → Vaultwarden → Deploy. Provisioning starts the vaultwarden/server:latest image with the vaultwarden volume mounted on /data, the port published on the local loopback at 127.0.0.1:8000, and WEBSOCKET_ENABLED=true so that clients sync live. The container is ready within seconds; there is not a single command for you to type.

03

Sign in for the first time

The first time you open the address, Vaultwarden shows the Bitwarden web vault: click “Create account” and set your own e-mail address and master password (nobody can recover it, not even us). Do it IMMEDIATELY: sign-ups are open, and the instance starts with no admin token (ADMIN_TOKEN).

04

Attach your domain

Create an A record such as passwords.example.com pointing at the VPS IP, then attach that domain to the application from your client area: ServOrbit installs the nginx vhost and issues the TLS certificate, with nothing for you to install and nothing to configure. Your vault then answers on https://<your-domain>, with no port number. As long as no domain is attached, the instance is only reachable through an SSH tunnel — ssh -L 8000:127.0.0.1:8000 root@<vps-ip> then http://localhost:8000 — enough to look at the web vault from a computer, but neither the browser extension nor the phone app will be able to connect. Port 8000 is the catalogue port; if it has been reassigned, use the one shown on your app's card in the client area.

05

Connect your clients

Open https://<your-domain> in your browser, sign in with the account you created above, then enter that same address in the “self-hosted server” field of the browser extension and of the mobile app before signing in there. Choose a strong master password: it is what encrypts the whole vault, and nobody can regenerate it.

06

Close public sign-ups

Once every account has been created, turn off open registration: connect to the VPS over SSH and restart the Vaultwarden container with SIGNUPS_ALLOWED=false in place of its initial value. The vaultwarden volume is left untouched: no vault is lost. Your instance then only accepts accounts created by invitation.

Frequently asked questions

Vaultwarden is an open-source, unofficial implementation of the Bitwarden server API written in Rust. It is fully compatible with all official Bitwarden clients (browser extensions, iOS, Android, desktop, CLI) while using a fraction of the resources of the official server.

All data lives in the Docker volume mounted at /data: one SQLite file plus attachments. Back up this directory (e.g. with docker run --rm -v vaultwarden:/data -v /backup:/out busybox tar czf /out/vaultwarden.tar.gz /data) and you have a complete snapshot. Schedule this daily with cron for zero-worry backups.

Embed the deploy button

Maintaining a project that uses Vaultwarden? This button lets your readers deploy it on a VPS in one click, without reading Docker documentation.

Markdown

[![Deploy Vaultwarden on ServOrbit](https://servorbit.com/brand/deploy/button.svg)](https://servorbit.com/vps-cloud?template=vaultwarden&utm_source=deploy-badge&utm_medium=referral&utm_campaign=vaultwarden)

HTML

<a href="https://servorbit.com/vps-cloud?template=vaultwarden&utm_source=deploy-badge&utm_medium=referral&utm_campaign=vaultwarden"><img src="https://servorbit.com/brand/deploy/button.svg" alt="Deploy Vaultwarden on ServOrbit" height="40"></a>

The button points to a VPS order with the template preselected. The image is served from servorbit.com — nothing to host on your side.

Complementary solutions

Networking & VPN

Activate Vaultwarden on your infrastructure.

Dedicated Cloud VPS — IPv4 included, European datacenter, support included. Your data never leaves your server.

Recommended configuration: 512 MB (1 GB recommended) RAM · 1 vCPU