Is Vaultwarden safe to use?

Yes. Vaultwarden implements the same end-to-end encryption as the official Bitwarden server — your master password never leaves your device and all vault data is AES-256 encrypted before being sent to the server. The project is actively maintained with security patches published regularly.

Does Vaultwarden require HTTPS?

Yes. Official Bitwarden clients refuse to connect to servers without a valid TLS certificate. You need a domain name pointing to your VPS and a reverse proxy (Caddy, Nginx, or Traefik) with a Let's Encrypt certificate. This takes about 5 minutes with Caddy.

How much RAM does Vaultwarden need?

Vaultwarden is extremely lightweight: under 50 MB RAM at idle, even while serving dozens of concurrent users. A 512 MB VPS is sufficient for personal use or a small team; 1 GB is comfortable for an organization with 20–50 users.

Can I migrate from Bitwarden.com to Vaultwarden?

Yes. Export your vault from Bitwarden.com (Settings → Export Vault → JSON) and import it into Vaultwarden from the web vault or the app. The process takes under two minutes and all your passwords, notes, and folders are preserved.

How do I back up my Vaultwarden data?

All data lives in the Docker volume mounted at /data: one SQLite file plus attachments. Back up this directory (e.g. with `docker run --rm -v vaultwarden:/data -v /backup:/out busybox tar czf /out/vaultwarden.tar.gz /data`) and you have a complete snapshot. Schedule this daily with cron for zero-worry backups.

Harden infrastructure security.

Vaultwarden

Self-hosted Bitwarden in one Rust container — unlimited passwords, zero subscription, your data stays on your VPS.

512 MB (1 GB recommended) RAM 1 vCPU Port 8000 Available

Source code

Tech stack

DockerRustSQLite

Minimum RAM512 MB (1 GB recommended)

Minimum CPU1 vCPU

Default port8000

Compatible OSubuntu-24.04

Vaultwarden is an unofficial, open-source server implementation of the Bitwarden protocol written in Rust. Every official Bitwarden client works with it unchanged: browser extensions (Chrome, Firefox, Safari), iOS and Android apps, and the desktop client. Your team gets encrypted password sharing, TOTP authenticator, secure notes, emergency access, and an admin panel — all on a server that idles under 50 MB RAM.

Deployed on a ServOrbit VPS, Vaultwarden stores your vault in an SQLite database inside a single Docker volume. No external database server, no third-party telemetry, no per-user billing. One container, one volume to back up, and all your passwords are yours for life at a fixed monthly cost.

Key features

100% compatible with all official Bitwarden clients: browser extensions, iOS, Android, desktop, and CLI

End-to-end encrypted vault: passwords, secure notes, credit cards, identities, and file attachments

Built-in TOTP authenticator — replace Google Authenticator or Authy with a self-hosted alternative

Organization vaults and encrypted sharing for teams, families, or agencies

Emergency access: grant a trusted contact read access after a configurable waiting period

Admin panel to manage users, reset accounts, and configure sign-up policies without CLI

Uses under 50 MB RAM at idle — runs comfortably alongside other services on the smallest VPS

When to use this solution?

1

Team password management

Share credentials across your dev team or agency in encrypted organization vaults. Every member uses the Bitwarden app they already know — you just own the server.

2

Freelancer & solo dev

Stop paying Bitwarden's or 1Password's per-user fee. Self-host for yourself and your clients on a VPS that costs less per year than a single premium subscription.

3

Agency client onboarding

Spin up a Vaultwarden instance for each client. Give them a branded URL (e.g. passwords.client.ma), their own vault, and emergency-access policies — without mixing their credentials with yours.

Deploy Vaultwarden on your VPS

Guide optimized for ServOrbit Cloud VPS.

01

Create the VPS

Order a ServOrbit VPS with at least 1 vCPU and 512 MB RAM. Ubuntu 22.04 LTS is the recommended OS. You will need a public domain name pointing to this VPS — Bitwarden clients refuse non-HTTPS vaults.

02

Deploy Vaultwarden

SSH into your VPS and run: docker run -d --name vaultwarden --restart=always -v vaultwarden:/data -p 127.0.0.1:8000:80 -e WEBSOCKET_ENABLED=true vaultwarden/server:latest. The container is instantly ready on localhost port 8000.

03

Set up HTTPS with Caddy (required)

Bitwarden clients only connect over HTTPS. Install Caddy: apt install -y caddy. Create /etc/caddy/Caddyfile with: passwords.yourdomain.com { reverse_proxy localhost:8000 }. Caddy fetches a Let's Encrypt certificate automatically and renews it forever.

04

Create your account

Open https://passwords.yourdomain.com in your browser. Click 'Create Account', enter your master password (make it strong — it encrypts everything), and your vault is ready.

05

Disable public sign-ups

Once you have created all accounts, set SIGNUPS_ALLOWED=false in the Docker command (add -e SIGNUPS_ALLOWED=false) and restart the container. Your instance is now invite-only and locked against unauthorized registrations.

Frequently asked questions

Vaultwarden is an open-source, unofficial implementation of the Bitwarden server API written in Rust. It is fully compatible with all official Bitwarden clients (browser extensions, iOS, Android, desktop, CLI) while using a fraction of the resources of the official server.

Complementary solutions

Networking & VPN

Activate Vaultwarden on your infrastructure.

Dedicated Cloud VPS — IPv4 included, European datacenter, support included. Your data never leaves your server.

Recommended configuration: 512 MB (1 GB recommended) RAM · 1 vCPU