[{"data":1,"prerenderedAt":195},["ShallowReactive",2],{"seo-verification":3,"blog-migrating-from-1password-to-vaultwarden-the-complete-guide-ma-en":6,"promo-bar-likely":194},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"key":7,"data":8},"blog-migrating-from-1password-to-vaultwarden-the-complete-guide-ma-en",{"id":9,"slug":10,"slugs":11,"title":15,"excerpt":16,"readTime":17,"views":18,"isPinned":19,"noindex":19,"publishedAt":20,"updatedAt":21,"category":22,"categories":28,"featuredImage":30,"bgImage":31,"posterImage":32,"relatedSolution":33,"intro":36,"sections":37,"ctaTitle":139,"ctaBody":140,"ctaButton":141,"ctaUrl":142,"relatedPosts":143},312,"migrating-from-1password-to-vaultwarden-the-complete-guide",{"fr":12,"en":10,"ar":13,"es":14},"migrer-1password-vaultwarden-self-hosted-2026","الانتقال-من-1password-إلى-vaultwarden-الدليل-الشامل","migrar-de-1password-a-vaultwarden-guia-completa","Migrating from 1Password to Vaultwarden: the complete guide","Export your 1Password vault as .1pux, import it with Bitwarden CLI and deploy Vaultwarden on a VPS — full migration in under an hour.",9,1,false,"2026-08-29T00:00:00+00:00","2026-11-08T01:13:15+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[29],{"id":23,"name":24,"slug":25,"color":26,"icon":27},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fmigrer-1password-vaultwarden-self-hosted-2026-poster.svg",{"categorySlug":34,"appSlug":35},"cybersecurity-bastion","vaultwarden","The 1Password price hike in 2026 pushed many developers to reconsider their password manager. Vaultwarden is a serious alternative: the same AES-256 client-side encryption as Bitwarden.com, full compatibility with all official Bitwarden clients, and a server written in Rust, much lighter than the official Bitwarden server. This guide covers the full migration — 1PUX export, Bitwarden CLI import, Vaultwarden deployment — without losing a single credential.",[38,42,53,56,69,84,87,129,133,136],{"type":39,"title":40,"body":41},"h2","Why migrate now","In 2026, the 1Password Individual plan billed annually has gone from $35.88\u002Fyr to $47.88\u002Fyr, a 33% increase. In January 2026, Bitwarden.com had already raised its Premium plan from $10 to $19.80 per year — nearly double. Both increases coming so close together made self-hosting economically obvious for developers who already have a VPS: Vaultwarden, written in Rust and much lighter than the official Bitwarden server, runs with no software license fee, at a fixed monthly cost equal to an entry-level VPS.\n\nThe most common objection — \"managing my own password manager is risky\" — does not hold against Vaultwarden's architecture. Encryption is done entirely client-side, using AES-256-CBC with PBKDF2 or Argon2id key derivation: the server never sees your passwords in plaintext, even in the event of a full machine compromise.",{"type":43,"title":44,"items":45},"ul","What Vaultwarden brings to a developer",[46,47,48,49,50,51,52],"**AES-256-CBC client-side encryption** — your passwords never leave your device in plaintext, regardless of the server configuration.","**Full compatibility** with all official Bitwarden clients: browser extensions, iOS, Android, desktop apps and CLI, without any modifications.","**Lightweight memory footprint** — written in Rust, Vaultwarden is built for self-hosting where the official, more resource-heavy Bitwarden server is not a good fit.","**Fixed cost** — a 1 vCPU \u002F 512 MB VPS is enough for personal use or a small team, with no variable SaaS subscription.","**Full data control** — backup, restore, datacenter choice and retention period remain in your hands.","**Multi-profile and organization support** — Vaultwarden supports organization management and vault sharing, just like Bitwarden.com.","**Decoupled updates** — you choose when to update the server; official Bitwarden clients manage their own release cycle.",{"type":39,"title":54,"body":55},"Prerequisites before you start","Before starting the migration, make sure you have all of the following.\n\nServer side: a VPS with at least 1 vCPU and 512 MB of RAM, Docker and Docker Compose installed, a domain name pointing to the server IP, and a reverse proxy (Caddy or Nginx) configured for TLS termination. The Vaultwarden deployment itself is covered in the article \u003Ca href=\"\u002Fen\u002Fblog\u002Fself-host-your-password-manager-deploy-vaultwarden-on-vps\">Deploy Vaultwarden on a VPS\u003C\u002Fa> — this guide assumes your instance is already online and accessible over HTTPS.\n\nLocal workstation: 1Password v8 or later installed (required to export in .1pux format), Bitwarden CLI (`bw`) installed via npm (`npm install -g @bitwarden\u002Fcli`) or the official binary, and Node.js ≥ 22 if installing via npm.",{"type":57,"title":58,"steps":59},"steps","Step 1 — Export your 1Password vault",[60,63,66],{"title":61,"body":62},"Open the export dialog","On macOS, open 1Password and go to **File → Export**. On Windows, click the ellipsis (…) at the top of the sidebar, then **Export**. Select the account to export — if you have multiple vaults, you can export the entire account in a single operation.",{"title":64,"body":65},"Choose the 1PUX format","In the dialog box, enter your 1Password account password to confirm the operation. Then select the **1Password Unencrypted Export (.1pux)** format. This JSON-based format preserves the full structure — custom fields, secure notes, identities, application passwords — unlike CSV, which only exports Login and Password items, without custom fields.",{"title":67,"body":68},"Save the file somewhere safe","Choose an encrypted local folder (FileVault or BitLocker enabled) to store the `.1pux` file. This file contains all your secrets in structured plaintext — do not leave it in a downloads folder or send it by email. Once the migration is complete, delete it securely.",{"type":57,"title":70,"steps":71},"Step 2 — Import with Bitwarden CLI",[72,75,78,81],{"title":73,"body":74},"Point the CLI to your Vaultwarden instance","By default, `bw` points to `bitwarden.com`. Redirect it to your instance before anything else:\n\n```bash\nbw config server https:\u002F\u002Fvault.your-domain.com\n```\n\nVerify the response: the CLI should print \"Saved setting `config`.\"",{"title":76,"body":77},"Log in and unlock the vault","Authenticate with your Vaultwarden credentials (email + master password set during initial setup):\n\n```bash\nbw login your@email.com\n```\n\nThe CLI will prompt for your master password interactively. Once logged in, unlock the vault and export the session key:\n\n```bash\nexport BW_SESSION=$(bw unlock --raw)\n```\n\nAll subsequent commands use this variable implicitly to access the decrypted vault.",{"title":79,"body":80},"Run the .1pux import","Import your 1Password export using the `1password1pux` format:\n\n```bash\nbw import 1password1pux \u002Fpath\u002Fto\u002Fexport.1pux\n```\n\nThe CLI replies `Imported \u002Fpath\u002Fto\u002Fexport.1pux`; if it had to skip items, it lists them with the reason. If your 1Password account contained multiple vaults, they are all imported into a single Bitwarden vault — folders are created from each item's first tag, not from the 1Password vaults.\n\nIf the import fails, verify the file has the `.1pux` extension (the CLI only unzips the archive under that extension) and that you are using a recent CLI version (`bw --version`).",{"title":82,"body":83},"Verify the import in a Bitwarden client","Open the Bitwarden browser extension or desktop app, point the server to your Vaultwarden instance, then log in. Browse your vaults and check a sample of passwords — in particular entries with custom fields, secure notes and identities, which are most likely to vary between password managers. File attachments are not imported: add them by hand. Passkeys are not included in a 1Password desktop export: create them again on each site.",{"type":39,"title":85,"body":86},"Step 3 — Vaultwarden on your VPS","If your Vaultwarden instance is not yet deployed, follow the guide \u003Ca href=\"\u002Fen\u002Fblog\u002Fself-host-your-password-manager-deploy-vaultwarden-on-vps\">Deploy Vaultwarden on a VPS\u003C\u002Fa>, which covers the full Docker configuration. In summary, three points are non-negotiable before importing anything:\n\n**HTTPS required.** Bitwarden clients refuse to connect to a server without valid TLS. Caddy or Nginx with Let's Encrypt (certbot) are sufficient; verify your domain is reachable over `https:\u002F\u002F` before configuring the CLI.\n\n**Correct `DOMAIN` variable.** In your `docker-compose.yml`, the variable `DOMAIN=https:\u002F\u002Fvault.your-domain.com` must match exactly the URL you declared in `bw config server` — no trailing slash.\n\n**Volume backup before import.** The import writes to Vaultwarden's SQLite database (`\u002Fdata\u002Fdb.sqlite3`). Take a snapshot of your Docker volume before running `bw import`, so you can roll back if the import goes wrong.\n\n**Close sign-ups afterwards.** Once your account is created, set `SIGNUPS_ALLOWED=false` and recreate the container: otherwise anyone who can reach the instance can open an account on it. If you enable the admin page, `ADMIN_TOKEN` must be an Argon2 hash generated with `vaultwarden hash`, not a plaintext token.",{"type":88,"title":89,"headers":90,"rows":95},"comparison","1Password vs Bitwarden.com vs Vaultwarden",[91,92,93,94],"Criterion","1Password","Bitwarden.com","Vaultwarden (self-hosted)",[96,101,106,111,116,121,125],[97,98,99,100],"Annual cost (individual)","$47.88\u002Fyr since 2026","$19.80\u002Fyr since Jan. 2026 (Premium)","VPS cost only",[102,103,104,105],"Data control","1Password servers","Bitwarden servers","Your VPS, your datacenter",[107,108,109,110],"Encryption","AES-256-GCM client-side","AES-256-CBC client-side","AES-256-CBC client-side (identical)",[112,113,114,115],"Official mobile clients","Dedicated 1Password apps","iOS, Android, desktop, extension","Official Bitwarden clients, unmodified",[117,118,119,120],"Browser extension","1Password extension","Bitwarden extension","Bitwarden extension (same binary)",[122,123,123,124],"Updates","Automatic (SaaS)","Manual (you choose the timing)",[126,127,127,128],"Server RAM required","N\u002FA (SaaS)","Low (lightweight server written in Rust)",{"type":130,"title":131,"body":132},"tip","Back up and test restoration","Once the import is complete, set up automated backups of the Vaultwarden volume before disabling your 1Password account. The guide \u003Ca href=\"\u002Fen\u002Fblog\u002Fautomate-your-vps-backups-with-restic\">Restic backups on a VPS\u003C\u002Fa> covers a Docker-adapted 3-2-1 strategy: stop the container, snapshot the volume, send encrypted to remote storage, restart. Test restoration on a separate machine — not just the presence of the backup file — before considering the migration done. A password vault without a tested restore is not a backup.",{"type":39,"title":134,"body":135},"Troubleshooting — common errors","**`Proper importer type required.` on import.** The format expected by the CLI is exactly `1password1pux` (no spaces, lowercase). Make sure you are not using `1password` alone or `1pux` — neither is a recognized file format (the older 1PIF format from 1Password 7 and earlier is called `1password1pif`). List available formats with `bw import --formats | grep 1password`.\n\n**`ERR_CERT_AUTHORITY_INVALID` in clients.** Bitwarden clients require a TLS certificate signed by a recognized authority — a self-signed certificate is only accepted if every device trusts the authority that issued it. Verify that Let's Encrypt has issued a valid certificate for your domain and that it is not expired.\n\n**Existing Bitwarden.com account.** If you import from an existing Bitwarden.com account before switching to Vaultwarden, your items remain encrypted with the cloud account key. After `bw config server` pointing to your instance, create a new local account: the CLI does not migrate the encryption key between instances, only plaintext data transits via import.\n\n**Import stops on an SSH entry.** In some CLI versions, a single non-compliant SSH key in the 1pux file made the whole import fail (`Failed to parse key`, issue bitwarden\u002Fclients #20432). Since CLI version 2026.8.0 (August 2026), the faulty item is skipped and listed, and the rest is imported; create that key again by hand. Update with `npm install -g @bitwarden\u002Fcli@latest` if you encounter this behavior.",{"type":39,"title":137,"body":138},"Leaving 1Password with confidence","Once the import is verified on the Vaultwarden side — open each item type (logins, notes, identities, cards) in a Bitwarden client and check a representative sample — you can deactivate your 1Password account. Do not wait for your subscription to expire before deleting the local `.1pux` file: it contains all your secrets in structured plaintext.\n\nTo go further in securing your infrastructure, the articles \u003Ca href=\"\u002Fen\u002Fblog\u002Finitial-linux-server-hardening\">Initial Linux server hardening\u003C\u002Fa> and \u003Ca href=\"\u002Fen\u002Fblog\u002Fpassbolt-on-vps-auditable-team-password-vault-no-subscription\">Passbolt for a team\u003C\u002Fa> cover the next steps: port lockdown, SSH key management and secure sharing in a team context.","A VPS to run Vaultwarden","A ServOrbit VPS with root access and a dedicated IPv4 is enough to host Vaultwarden for life. Choose your OS, deploy in minutes.","Launch a ServOrbit VPS","\u002Fvps-cloud",[144,162,177],{"id":145,"slug":146,"slugs":147,"title":151,"excerpt":152,"readTime":153,"views":154,"isPinned":19,"noindex":19,"publishedAt":155,"updatedAt":156,"category":157,"categories":158,"featuredImage":30,"bgImage":31,"posterImage":160,"relatedSolution":161},131,"self-host-your-password-manager-deploy-vaultwarden-on-vps",{"fr":148,"en":146,"ar":149,"es":150},"deploy-vaultwarden-vps","استضف-مدير-كلمات-المرور-بنفسك-انشر-vaultwarden-على-vps","desplegar-vaultwarden-en-un-vps","Deploy Vaultwarden on a VPS: self-hosted password manager","Self-host Vaultwarden on a VPS: password management, Bitwarden compatibility, team vaults and TOTP, at a fixed monthly cost and under 50 MB of RAM.",15,3,"2026-06-24T00:00:00+00:00","2026-11-04T16:30:25+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[159],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fdeploy-vaultwarden-vps-poster.svg",{"categorySlug":27,"appSlug":35},{"id":163,"slug":164,"slugs":165,"title":169,"excerpt":170,"readTime":23,"views":18,"isPinned":19,"noindex":19,"publishedAt":171,"updatedAt":172,"category":173,"categories":174,"featuredImage":30,"bgImage":31,"posterImage":176,"relatedSolution":30},296,"passbolt-on-vps-auditable-team-password-vault-no-subscription",{"fr":166,"en":164,"ar":167,"es":168},"passbolt-gestionnaire-mots-de-passe-equipe-vps","passbolt-على-vps-خزنة-مرور-للفريق-بلا-اشتراك","passbolt-en-vps-boveda-de-contrasenas-sin-suscripcion","Passbolt on VPS: auditable team password vault, no subscription","Deploy Passbolt Community Edition on your VPS with Docker and PostgreSQL: per-recipient GPG encryption, per-entry audit log, REST API — zero SaaS subscription.","2026-08-23T00:00:00+00:00","2026-09-07T11:26:10+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[175],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fpassbolt-gestionnaire-mots-de-passe-equipe-vps-poster.svg",{"id":178,"slug":179,"slugs":180,"title":184,"excerpt":185,"readTime":186,"views":187,"isPinned":19,"noindex":19,"publishedAt":188,"updatedAt":189,"category":190,"categories":191,"featuredImage":30,"bgImage":31,"posterImage":193,"relatedSolution":30},113,"automate-your-vps-backups-with-restic",{"fr":181,"en":179,"ar":182,"es":183},"sauvegardes-restic-vps","أتمتة-نسخ-خادمك-vps-الاحتياطية-باستخدام-restic","copias-de-seguridad-vps-con-restic","Automate Your VPS Backups with Restic","Automate your VPS backups with Restic: encrypted snapshots, deduplication and shipping to S3 or any object backend.",11,0,"2026-02-27T00:00:00+00:00","2026-11-08T01:13:12+00:00",{"id":23,"name":24,"slug":25,"color":26,"icon":27},[192],{"id":23,"name":24,"slug":25,"color":26,"icon":27},"\u002Fblog\u002Fcovers\u002Fsauvegardes-restic-vps-poster.svg",true,1794270450893]