Install Vaultwarden: Self-Host a Bitwarden-Compatible Server

Vaultwarden is an unofficial, Bitwarden-compatible server you run on your own VPS; the official Bitwarden apps then connect to your server. The project is not associated with Bitwarden, Inc. (Vaultwarden README, as of Nov 8, 2026).

A VPS (virtual private server) is a virtual server in a data center; current prices incl. VAT are in the VPS comparison. Per the project, Vaultwarden implements nearly all of the Bitwarden client API, including organizations, attachments, Send and Emergency Access (Vaultwarden README, as of Nov 8, 2026). Your vault data then sits on your server.

Prerequisites

You need:

• A VPS; current plans and prices incl. VAT are in the VPS comparison
• A domain or subdomain (for HTTPS)
• SSH access to the server
• Docker & Docker Compose installed

Resources: The project describes Vaultwarden as an alternative to the resource-heavy official server (Vaultwarden README, as of Nov 8, 2026); it gives no RAM figure. Plan for the memory of other services on the same server.

Providers at a glance: Hetzner, Netcup and IONOS; prices are in the VPS comparison.

Step 1: Create the Docker Compose file

Create a folder:

mkdir -p ~/vaultwarden && cd ~/vaultwarden

Store the admin token as an Argon2id hash, not in plain text. Vaultwarden generates the hash itself; you enter a password while doing so (Vaultwarden wiki, as of Nov 8, 2026):

docker run --rm -it vaultwarden/server /vaultwarden hash

docker-compose.yml (image per the Vaultwarden wiki, as of Nov 8, 2026):

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    volumes:
      - ./data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=true  # Set to false after the first account!
      - ADMIN_TOKEN=$$argon2id$$v=19$$m=65540,t=3,p=4$$...  # your hash, every $ doubled
    ports:
      - 127.0.0.1:8080:80

Leave out the top-level version field; it is obsolete (Docker docs, as of Nov 8, 2026). In the Compose file, double every $ in the hash, otherwise Compose treats it as a variable.

Important: Replace vault.yourdomain.com with your real domain!

Step 2: Start Vaultwarden

Start the container:

docker compose up -d

Check status:

docker compose logs -f
# The logs should show no errors; exit with Ctrl+C

Vaultwarden is now reachable only locally on port 8080; the README example also binds to 127.0.0.1 (Vaultwarden README, as of Nov 8, 2026). Without HTTPS the web vault fails: it uses Web Crypto, which browsers only provide over HTTPS (Vaultwarden wiki, as of Nov 8, 2026). On to the next step.

Step 3: Set up HTTPS with Caddy

The project recommends a reverse proxy that handles HTTPS and shows an example with Caddy (Vaultwarden wiki, as of Nov 8, 2026). Extend your docker-compose.yml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    volumes:
      - ./data:/data
    environment:
      - DOMAIN=https://vault.yourdomain.com
      - SIGNUPS_ALLOWED=true
      - ADMIN_TOKEN=$$argon2id$$...  # your hash
    # Ports removed - Caddy takes over

  caddy:
    image: caddy:2
    container_name: caddy
    restart: always
    ports:
      - 80:80
      - 443:443
      - 443:443/udp
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-config:/config
      - ./caddy-data:/data

Create the Caddyfile:

vault.yourdomain.com {
    reverse_proxy vaultwarden:80 {
        header_up X-Real-IP {remote_host}
    }
}

X-Real-IP passes the real client IP to Vaultwarden, otherwise the log only sees the proxy IP (Vaultwarden wiki, as of Nov 8, 2026).

Restart:

docker compose down
docker compose up -d

Tip: Caddy fetches a TLS certificate automatically. Your domain must point to the server via an A or AAAA record, and ports 80 and 443 must be reachable from outside (Caddy docs, as of Nov 8, 2026).

Step 4: Create your first account

Open https://vault.yourdomain.com in your browser:

1. Click 'Create Account'
2. Choose an email and a strong master password
3. Create the account

IMPORTANT: While SIGNUPS_ALLOWED=true is set, anyone who can reach your instance can sign up (Vaultwarden wiki, as of Nov 8, 2026).

Step 5: Disable registration

So no one else can sign up:

Change in docker-compose.yml:

- SIGNUPS_ALLOWED=false

Restart the container:

docker compose up -d

Tip: Afterwards you invite more users via the admin page at /admin, even with registration disabled. You log in there with the password you entered when hashing, not with the hash (Vaultwarden wiki, as of Nov 8, 2026).

Step 6: Configure the apps

Now connect the official Bitwarden apps to your server (Bitwarden Help, as of Nov 8, 2026):

Browser extension

1. Install 'Bitwarden' from the browser store
2. On the login screen, choose 'Self-hosted' in the 'Logging in on' field
3. Enter https://vault.yourdomain.com under 'Server URL' and save
4. Log in

Mobile app

1. Install 'Bitwarden' from the App Store or Play Store
2. On the login screen, choose 'Logging in on' → 'Self-hosted'
3. Server URL: https://vault.yourdomain.com
4. Log in

Desktop app

1. Download the app from the Bitwarden website
2. On the login screen, choose 'Self-hosted' in the 'Accessing' field, enter the server URL and save
3. Log in

Step 7: Explore the admin panel

Vaultwarden has an admin panel at /admin:

https://vault.yourdomain.com/admin
→ Password = the password you entered when creating the hash

Admin page functions (Vaultwarden wiki, as of Nov 8, 2026):

• Change settings
• Invite new users (even with registration disabled)
• Manage users: remove two-step login, sign out sessions, disable, delete
• Delete organizations
• Diagnostics page

Caution: What you save on the admin page goes into config.json and overrides the environment variables (Vaultwarden wiki, as of Nov 8, 2026). Use the admin page only from trusted networks or secure it further (IP allowlist, VPN).

Step 8: Set up backups

Set up automatic backups. A file copy of the SQLite database is only safe while the database is not in use (Vaultwarden wiki, as of Nov 8, 2026). So the script stops Vaultwarden briefly:

#!/bin/bash
# backup-vaultwarden.sh

BACKUP_DIR="/backup/vaultwarden"
DATE=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR
cd ~/vaultwarden
docker compose stop vaultwarden
tar -czf $BACKUP_DIR/vaultwarden-$DATE.tar.gz data
docker compose start vaultwarden

# Delete old backups (keep 30 days)
find $BACKUP_DIR -type f -mtime +30 -delete

echo "Backup completed: vaultwarden-$DATE.tar.gz"

Set up a cron job (daily at 3 AM):

chmod +x backup-vaultwarden.sh
crontab -e
# Add line (adjust the path if you don't work as root):
0 3 * * * /root/backup-vaultwarden.sh

Tip: The archive contains config.json with secrets in plain text. Encrypt it, e.g. with restic or borgbackup, and also copy it to a second location.

Update with docker compose pull and then docker compose up -d (Vaultwarden wiki, as of Nov 8, 2026). Make a backup first.

Step 9: Two-step login for your account

Protect your account beyond the master password:

1. Log in to the web vault
2. Settings → Security → Two-step login (Bitwarden Help, as of Nov 8, 2026)
3. For example, add an authenticator app
4. Keep recovery codes safe

Vaultwarden supports authenticator app, email, FIDO2 WebAuthn, YubiKey and Duo (Vaultwarden README, as of Nov 8, 2026).

Migrate from other password managers

Import in the web vault under Tools → Import. Supported export formats per password manager are listed in the Bitwarden Help (Bitwarden Help, as of Nov 8, 2026).

Export files are often unencrypted; delete the file after importing.

Vaultwarden vs. commercial password managers

Vaultwarden is an alternative Rust implementation of the Bitwarden client API, compatible with the official Bitwarden clients and not associated with Bitwarden, Inc. (Vaultwarden README, as of Nov 8, 2026). The difference: you run the server yourself.

The Bitwarden clients encrypt the vault on your device with AES-CBC and 256-bit keys before it goes to the server (Bitwarden Help, as of Nov 8, 2026). The server only stores encrypted data.

Don't want to run a server? Use a hosted service. Self-hosting means you handle updates, backups and hardening.

Harden security

A password manager holds the logins to many services. Beyond the basic setup you should:

• Use Argon2id as KDF: In the web vault under Settings → Security → Keys you can switch key derivation from PBKDF2 to Argon2id (Bitwarden Help, as of Nov 8, 2026).
• Keep registration closed: After creating your accounts, SIGNUPS_ALLOWED=false stays set (Vaultwarden wiki, as of Nov 8, 2026).
• Secure the admin token: Store the ADMIN_TOKEN as an Argon2id hash so it isn't readable in plain text; without ADMIN_TOKEN the admin page is disabled (Vaultwarden wiki, as of Nov 8, 2026).
• Set up Fail2Ban: Fail2Ban reads failed logins from the log file or the systemd journal and bans the IPs; with Docker, chain = FORWARD goes into the jail (Vaultwarden wiki, as of Nov 8, 2026).
• Encrypted backups: Back up the SQLite database, the attachments folder, config.json (contains secrets in plain text) and the rsa_key* files, encrypted, to a second location (Vaultwarden wiki, as of Nov 8, 2026).

If you forget your master password, access cannot be recovered (Bitwarden Help, as of Nov 8, 2026). Prepare with Emergency Access for a trusted person.

Organizations & shared vaults

Vaultwarden supports organizations with collections, user roles and groups (Vaultwarden README, as of Nov 8, 2026), for example for families or small teams. Instead of passing passwords around by hand, you create an organization and share individual collections with specific people.

For example, you give your partner access to the "Household" collection (streaming, online shops, utilities), while the "Work" collection stays private. Each person has their own master password and login. If someone leaves, you remove their access to the collection. You should still change passwords they could already see.

Per the README, Vaultwarden supports collections, user roles, groups, policies and Emergency Access, among others; the project describes its client API implementation as nearly complete (Vaultwarden README, as of Nov 8, 2026).

Conclusion

You now run a Bitwarden-compatible server yourself; updates, backups and hardening are up to you.

On the same VPS you can run other services, such as Immich for photos, Paperless for documents or your own VPN. Current prices incl. VAT are in the VPS comparison.

More Self-Hosting Guides

n8n Self-Hosting Guide

Docker Setup Schritt für Schritt

Lesen

Ollama auf VPS installieren

Lokale KI mit Open WebUI

Lesen

WireGuard VPN Setup

Eigenes VPN mit wg-easy

Lesen