Vaultwarden is a lightweight, community-maintained server for password management that speaks the Bitwarden client API, so the official Bitwarden apps on every platform connect to it unchanged. Written in Rust and licensed AGPL-3.0, it is designed to run comfortably on a Raspberry Pi or a small VPS with SQLite by default. It serves individuals, families, and small teams who want their vault under their own control, with organizations, attachments, TOTP storage, and emergency access working without a subscription.[1]
Quick verdict
Vaultwarden suits self-hosters, families, and small teams that want Bitwarden's polished clients with the vault on their own Pi or VPS. Its strength is the combination of a tiny Rust server, the unchanged official apps, and team features with no subscription. The tradeoff is total operator responsibility: HTTPS, SMTP, backups, and updates are yours, with no vendor support. If someone technical will own the server, choose Vaultwarden; if not, use Bitwarden's hosted cloud with the same clients.[1][2]
Key features
Bitwarden-compatible server API Vaultwarden implements the Bitwarden client API as an alternative server implementation, so the upstream Bitwarden desktop, mobile, browser, CLI, and web-vault clients connect to it without modification.[1]
Rust build that runs on small hardware Written in Rust and designed to be lightweight, Vaultwarden runs on a Raspberry Pi or a single-board computer, where the official resource-heavy Bitwarden server would not fit.[1]
Organizations and sharing included Organizations, collections, and sharing work out of the box, so families and small teams can separate shared credentials from personal vaults without a paid tier.[1]
Attachments, TOTP, and emergency access File attachments, TOTP authenticator-code storage, and emergency access, features that are restricted upstream, are implemented and usable in a self-hosted Vaultwarden instance.[1]
Flexible database backends SQLite is the default and the recommended starting point, with MySQL, MariaDB, and PostgreSQL supported for larger deployments; the wiki steers new operators toward SQLite unless they outgrow it.[1][2]
Full client ecosystem, unchanged Every official client works, including the web vault, and the clients stay authoritative for account flows: organization invitations and signup-related mails are accepted in the clients, with mail delivery handled by your own SMTP server.[1][2]
Admin controls for the operator An admin page, enabled with your own admin token, lets the operator manage users, organizations, and invitations, and supports disabling public signup while still inviting chosen users.[1]
Documented backup and update path Updates follow the normal container flow of pulling the current stable image and recreating the container, and the wiki documents the supported paths for SQLite, MySQL, and PostgreSQL backups.[1]
Who will love it
Self-hosters with a Pi or small VPS People who already run a home server or a small VPS and are comfortable with Docker get a full password-manager backend for the cost of hardware they own.[1][2]
Families and small teams avoiding seat fees Groups that need shared collections and organizations but cannot justify per-seat subscriptions get team sharing without a billing relationship with any vendor.[1]
Bitwarden users who want data control People who like the Bitwarden clients but want their encrypted vault on infrastructure they control can switch servers without retraining anyone or changing apps.[1]
Who should avoid it
Anyone who will not operate a server If nobody will own HTTPS, SMTP, updates, and backups, a self-hosted vault becomes a liability; Bitwarden's hosted cloud is the safer choice for these users.[1]
Teams needing vendor support and compliance paperwork Vaultwarden is explicitly unofficial and unaffiliated with Bitwarden, with no support contracts or compliance program, so regulated organizations that need a vendor to call should look elsewhere.[1]
Buyers wanting every upstream enterprise control Compatibility tracks the Bitwarden client API rather than matching every upstream server feature release-for-release, so anyone depending on a specific new enterprise control should verify it against the current release notes first.[1]
Compatibility
Official clients on every platform Windows, macOS, Linux, iOS, Android, every major browser, the command line, and the web vault all work because compatibility is at the server API level.[1][2]
Reverse proxy with HTTPS expected The project recommends a reverse proxy with a valid certificate for all deployments, including LAN-only ones, and documents proxy configuration for common setups.[1]
Mail delivery is your SMTP server Invitations, verification, and emergency-access mails go through SMTP credentials you configure; without them, account mails silently do not arrive.[1]
Questions worth asking
What is the best Vaultwarden alternative for non-technical users?
Bitwarden's own hosted cloud service is the natural pick: it uses the same official clients as Vaultwarden, covers unlimited passwords and devices on its free tier, and needs no server of your own. Choose Vaultwarden only if someone technical in the household or team will own the server; otherwise the hosted service removes backups, updates, and HTTPS from your plate.[1]
Is Vaultwarden really no-code?
Day-to-day use is graphical: you live in the standard Bitwarden desktop, mobile, browser, and web-vault apps. Running the server is not no-code, though: installation is a Docker container with volume mounts, production use wants a reverse proxy with HTTPS, and mail delivery needs your own SMTP credentials. Expect Docker and basic networking skills from whoever operates it.[1][2]
How much does Vaultwarden cost per month?
The software itself costs nothing: it is AGPL-3.0 licensed with no tiers, seats, or subscriptions, and organizations, attachments, TOTP storage, and emergency access all work without paying. Your only spending is the machine it runs on, from a Raspberry Pi you already own to a small VPS, plus electricity or hosting fees. There is no per-user monthly price to quote because there is none.[1]
Can you self-host Vaultwarden?
Yes, self-hosting is its entire purpose: Vaultwarden exists so you can run the Bitwarden-compatible server yourself, on anything from a Raspberry Pi to a VPS, with SQLite by default and MySQL, MariaDB, or PostgreSQL as options. The project recommends a reverse proxy with HTTPS even for LAN-only setups, keeps attachments inside the database rather than server files, and leaves backups, updates, and availability to you.[1][2]
Sources and editorial review
Source research. Reviewed on October 9, 2026. Written by Sanjib Sah. AI assisted; reviewed by a human editor.
We have not run or tested this product.
- Vaultwarden GitHub repository README
official · Observed October 9, 2026
Official repository README: unofficial Bitwarden-compatible server in Rust, AGPL-3.0, lightweight for Raspberry Pi, feature list (organizations, attachments, TOTP, emergency access, SQLite/MySQL/PostgreSQL), Docker usage, and unaffiliated-with-Bitwarden notice. Read October 2026.
- Vaultwarden project wiki
official · Observed October 9, 2026
Official project wiki home: setup guidance, admin page and invitation flow, SMTP requirement, reverse-proxy recommendation for all deployments including LAN-only, updates and backup guidance, SQLite default. Read October 2026.