A self-hosted password manager
A password vault your whole team uses is exactly the thing you do not want in a service you cannot see inside. Vaultwarden gives you a Bitwarden-compatible server on your own hardware.
Vaultwarden is a lightweight re-implementation of the Bitwarden server in Rust. It is small enough to run alongside other things, speaks to the official Bitwarden apps and browser extensions, and keeps every secret on your disk.
TLS is not optional here
This is a password server. It must only ever be reached over HTTPS, and the apps will refuse to connect otherwise — which is the correct behaviour. Put it behind a reverse proxy with a real certificate before you add a single credential. See TLS certificates and hardening TLS.
Close the door after setup
The admin page lets anyone who reaches it reconfigure the server. Protect it with the ADMIN_TOKEN as an Argon2 hash, and once your users are enrolled, turn signups off:
SIGNUPS_ALLOWED=false
Leave signups open and the internet will create accounts on your vault.
The data is small and precious
Everything lives in one SQLite database and an attachments folder — a few megabytes that are worth more than the rest of the server combined. Back it up often and keep a copy off the machine. Because it is small, there is no excuse not to. See backups that actually restore.
Two-factor and recovery
Turn on two-factor for every account, and make sure at least one organisation owner has a stored recovery path. A self-hosted vault with no recovery route is one forgotten master password away from losing everything.
Keep it patched
A password server is a target. Subscribe to its releases and apply them promptly — the same discipline as automatic security updates, applied with extra care because of what it holds.
Still stuck? Mail support@novogara.com — an engineer answers, at any hour. Back to the knowledge base