Vaultwarden: installing your own password manager on a VPS

Vaultwarden lets you store passwords on your own server and synchronize them between your computer, phone, and browser. It works with the official Bitwarden applications and extensions, where you specify the address of your own server.

Below, we will look at what kind of VPS Vaultwarden needs, how to run it on Ubuntu with Docker Compose, disable open registration, enable HTTPS, and configure backups.

Vaultwarden in five steps

The minimum launch plan:

1. Create a VPS with Ubuntu and point a subdomain to it, for example vault.example.com.
2. Install Docker and Docker Compose.
3. Run Vaultwarden together with Caddy for automatic HTTPS.
4. Create the first account and disable open registration.
5. Enable two-factor authentication, updates, and backups.

For a personal vault or a small family, the built-in SQLite database is sufficient. A separate PostgreSQL server is usually unnecessary.

What is Vaultwarden

Vaultwarden is an unofficial server implementation of the Bitwarden API, written in Rust and designed for self-hosted deployment. It is compatible with the official Bitwarden clients: the web interface, mobile and desktop applications, browser extensions, and CLI.

Vault data is encrypted on the user's device before being sent to the server. The VPS synchronizes the encrypted database, but it does not know the master password and cannot recover it if it is lost.

Vaultwarden is not an official Bitwarden product. The owner is personally responsible for updates, availability, HTTPS, backups, and VPS security.

Vaultwarden and Bitwarden: what is the difference

Parameter	Bitwarden Cloud	Vaultwarden
Server	Bitwarden infrastructure	Your VPS or home server
Applications	Bitwarden clients	The same clients in Self-hosted mode
Maintenance	Handled by the provider	Handled by the owner
Control over backups	Limited by the service	Full
Setup	Account registration	Domain, Docker, and VPS configuration

Vaultwarden is suitable for those who want control over the server side and are prepared to update Linux and verify backups. A cloud service is more practical if you do not want to handle administration. Self-hosting does not automatically make the system secure—it transfers responsibility to the owner.

Vaultwarden server requirements

For personal use, a reasonable starting configuration is:

• 1 vCPU;
• 1–2 GB RAM;
• 10–20 GB SSD or NVMe;
• Ubuntu 24.04 LTS;
• a public IP address and a domain;
• open ports 80 and 443.

This is a practical allowance for Ubuntu, Docker, Caddy, and updates, not a strict project minimum. For dozens of users, a large number of attachments, or several containers, it is better to choose at least 2 GB RAM.

How to install Vaultwarden on a VPS

This example uses Ubuntu 24.04 and the vault.example.com subdomain. Replace it with your own address in all files.

1. Configure DNS and prepare Ubuntu

Create an A DNS record pointing to the VPS IPv4 address. Then connect via SSH:

ssh root@SERVER_IP
apt update && apt upgrade -y
ufw allow OpenSSH
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Do not close the current SSH session until you have verified that a new connection works.

2. Install Docker and Docker Compose

Add the official Docker repository:

apt install -y ca-certificates curl
install -m 0755 -d /etc/apt/keyrings
curl -fsSL https://download.docker.com/linux/ubuntu/gpg \
  -o /etc/apt/keyrings/docker.asc
chmod a+r /etc/apt/keyrings/docker.asc

tee /etc/apt/sources.list.d/docker.sources > /dev/null <<EOF
Types: deb
URIs: https://download.docker.com/linux/ubuntu
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF

apt update
apt install -y docker-ce docker-ce-cli containerd.io \
  docker-buildx-plugin docker-compose-plugin
docker compose version

3. Create the configuration

mkdir -p /opt/vaultwarden
cd /opt/vaultwarden

Create compose.yaml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
    volumes:
      - ./vw-data:/data

  caddy:
    image: caddy:2-alpine
    container_name: vaultwarden-caddy
    restart: unless-stopped
    depends_on:
      - vaultwarden
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./Caddyfile:/etc/caddy/Caddyfile:ro
      - ./caddy-data:/data
      - ./caddy-config:/config

Create the Caddyfile:

vault.example.com {
    reverse_proxy vaultwarden:80
}

Only Caddy is exposed externally. The Vaultwarden container is accessible inside the Docker network, and the data is stored in /opt/vaultwarden/vw-data. A separate WebSocket port is not required in the current setup.

4. Start Vaultwarden

docker compose up -d
docker compose ps
docker compose logs --tail=100 caddy

Open https://vault.example.com. Caddy will automatically obtain a TLS certificate if DNS already points to the VPS and ports 80 and 443 are accessible. If the site does not open, check DNS, the firewall, and whether another web server is using those ports.

5. Create an account and disable registration

Register the first account. Use a long, unique master password and keep an emergency copy outside Vaultwarden: the server administrator cannot reset or recover the master password.

After registration, change the following in compose.yaml:

SIGNUPS_ALLOWED: "false"

Apply the setting:

docker compose up -d

Other people will now be unable to create accounts. To add a new user, you can temporarily enable registration or configure invitations.

How to connect the Bitwarden application

You do not need to install a separate Vaultwarden client. On the sign-in screen of the Bitwarden application or extension, select Self-hosted and enter:

https://vault.example.com

Use this address on your computer, phone, and browser. To migrate, import an export from your previous password manager. Delete an unencrypted CSV or JSON file immediately after the transfer, and do not send it by email or through public links.

Secure Vaultwarden configuration

After launch, take several steps:

• enable TOTP or WebAuthn and store recovery codes separately;
• keep SIGNUPS_ALLOWED disabled;
• use SSH keys and update Ubuntu regularly;
• do not expose the internal port of the Vaultwarden container;
• do not run questionable containers on the same VPS;
• verify that backups can be restored.

The /admin panel is usually unnecessary for a personal vault. If you enable it, use a long token in the form of an Argon2 hash and, where possible, restrict access by IP address or VPN. Storing a plain-text ADMIN_TOKEN is undesirable.

Create a backup before updating, then run:

cd /opt/vaultwarden
docker compose pull
docker compose up -d

The server should be updated regularly: Bitwarden clients are released independently, so a very old Vaultwarden version may lose compatibility with them.

Backing up Vaultwarden

The main SQLite database is located at vw-data/db.sqlite3, while attachments are stored as separate files. Do not copy a running database with the ordinary cp command: a write operation at that moment may make the copy inconsistent.

Create a safe snapshot with the built-in command:

docker exec vaultwarden /vaultwarden backup

A separate db_.sqlite3 file will appear in the data directory. Save attachments, sends, config.json if it has been created, and the rsa_key files along with it.

A backup on the same VPS does not protect against server deletion or disk failure. Automatically send copies to another device or to separate object storage, preferably with additional encryption. Perform a test restoration periodically.

Which VPS to choose for Vaultwarden

A basic Linux VPS with 2 GB RAM is sufficient for a personal or family vault. This provides extra capacity for Ubuntu, Docker, Caddy, updates, and automated backups.

You can run Vaultwarden on an entry-level VPS from tropic.host and increase the resources later if you add other self-hosted services to the server. For a password manager, a stable network, a permanent public address, and a reliable disk matter more than extra CPU cores.

A home server is also suitable, but you will then need to provide external access, HTTPS, stable power, and recovery after failures. A VPS is usually simpler when the vault must work from any network.

Conclusion

Vaultwarden is a convenient self-hosted password manager for those who want to use Bitwarden clients while keeping the server side on their own infrastructure. A small VPS, a domain, Docker Compose, and Caddy are enough to get started.

The main responsibility begins after installation: disable registration, enable 2FA, update the containers, and keep tested backups outside the server.

FAQ

Can Vaultwarden be installed without a domain?

Technically, you can use a local address, but the web vault requires a secure HTTPS context. For access from different devices, using a domain and a TLS certificate is simpler.

How much RAM does Vaultwarden need?

For one or several users, 1 GB RAM is usually sufficient. A VPS with 2 GB provides a more comfortable allowance for the system, Docker, Caddy, and updates.

Does Vaultwarden work with the Bitwarden mobile application?

Yes. On the sign-in screen, select a self-hosted server and enter the full HTTPS address of your Vaultwarden instance.

What happens if the VPS is temporarily unavailable?

Previously synchronized data usually remains in the client's local encrypted cache. However, synchronization, signing in on a new device, and receiving changes will not work until the server is restored.

Can a forgotten master password be recovered through /admin?

No. The administrator can manage the server and accounts but does not possess the decryption key for the user's vault. The master password and recovery codes must be stored separately.