How to self-host Vaultwarden: a private password manager on a VPS

To self-host Vaultwarden you need a VPS, a domain with an SSL certificate, and Docker: run the vaultwarden/server container, put it behind an HTTPS reverse proxy such as nginx, create your accounts, then disable new signups. Vaultwarden is light (around 256 MB of RAM is plenty for a family or small team) and works with the official Bitwarden apps on phones, desktops and browsers.

This guide explains what Vaultwarden is and how it differs from Bitwarden, how to install it with ZoPanel and by hand with Docker Compose on Ubuntu or Debian, and the two parts most tutorials rush: locking the server down after installation, and backing up the vault in a way you can actually restore.

What is Vaultwarden, and how is it different from Bitwarden?

Vaultwarden is an unofficial implementation of the Bitwarden server API, written in Rust. It used to be called bitwarden_rs and was renamed to avoid confusion with the official server. Vaultwarden is not affiliated with Bitwarden, Inc.; it simply speaks the same protocol as the official clients.

You have three ways to use the Bitwarden ecosystem:

Option	Who runs it	Resources	Notes
Bitwarden cloud	Bitwarden, Inc.	No server needed	Easiest; data sits with the provider (end-to-end encrypted).
Official Bitwarden self-hosted	You	2 GB RAM minimum, 4 GB recommended	Needs an installation ID and key from Bitwarden; vendor-supported.
Vaultwarden	You	Around 256 MB RAM	Light, one container; community-developed.

The official server's requirements come from Bitwarden's installation docs at the time of writing (October 2026). Bitwarden also documents a "lite" deployment; check their docs if vendor support matters to you.

Vaultwarden fits when you want Bitwarden's convenience (autofill, sync across devices, shared vaults for a family or team) without handing your data to a third party, and you accept that keeping it running is now your job.

What do you need to self-host Vaultwarden?

• A VPS running Ubuntu 22.04/24.04 or Debian 12/13. Vaultwarden is light enough to share a server with websites.
• A domain or subdomain such as vault.example.com, with an A record pointing to the VPS.
• HTTPS, without exception. The web vault uses the browser's Web Crypto API, which only works in a secure context, so plain HTTP does not work.
• Somewhere off the server for backups. A password vault is the one dataset you cannot afford to lose.
• (Optional) SMTP for invitation and verification emails.

How to install Vaultwarden with ZoPanel

Vaultwarden is in ZoPanel's App Store. The panel creates a website for the domain, starts the container and sets up the reverse proxy with SSL.

1. If the server does not have Docker yet, click App Store → Install Docker (or install Docker from Components).
2. Open App Store, choose Vaultwarden and enter the domain, for example vault.example.com. Administrators also choose the hosting account that owns the app.
3. Click Install and follow the task log.
4. Point the domain's A record to the server if you have not already. Wait for SSL to be issued before opening the site.
5. Open https://vault.example.com and choose Create account. The master password encrypts the vault and cannot be recovered, so write it down and store it safely.
6. In the Bitwarden apps or browser extension, choose Self-hosted and enter https://vault.example.com as the server URL.
7. Once your family or team has their accounts, open https://vault.example.com/admin with the ADMIN_TOKEN shown under Login details on the website's Docker tab, and turn off Allow new signups. You can still invite people from the admin page.

The app has a 256 MB memory limit. ZoPanel runs containers in a user namespace, publishes their ports on 127.0.0.1 only (visitors come in through nginx with SSL), blocks connections between containers and to the server's internal network, and stores app data in /var/lib/zopanel-apps/<instance>/, readable only by root and the container. Update to latest on the Docker tab pulls a new image and keeps your data. Details are in the App Store docs and the app catalog.

How to install Vaultwarden manually with Docker Compose

If you run the server yourself, install Docker Engine and the Compose plugin following Docker's official instructions (Docker's apt repository, not a random script). Then follow these steps.

Step 1: Generate a hashed ADMIN_TOKEN

Do not leave the admin token in plain text. Vaultwarden ships a command that produces an Argon2 hash:

docker run --rm -it vaultwarden/server /vaultwarden hash

It asks for a password twice and prints a string starting with $argon2id$. You sign in to /admin with the original password, not the hash.

Step 2: Write the Compose file

Create /opt/vaultwarden, then a .env file (single quotes, no need to double the $ signs):

ADMIN_TOKEN='$argon2id$v=19$m=65540,t=3,p=4$...'

And compose.yaml:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
      ADMIN_TOKEN: ${ADMIN_TOKEN}
    volumes:
      - ./vw-data:/data
    ports:
      - "127.0.0.1:8000:80"

Run sudo chmod 600 .env, then docker compose up -d. The 127.0.0.1:8000:80 mapping matters: according to Docker's documentation, traffic to published ports is routed before UFW's rules apply, so publish on localhost only and let nginx face the internet (Docker and firewalls).

Step 3: nginx reverse proxy and SSL

server {
    listen 80;
    server_name vault.example.com;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

Check with sudo nginx -t && sudo systemctl reload nginx, then issue a certificate with sudo certbot --nginx -d vault.example.com. The Upgrade/Connection lines allow WebSockets, so clients pick up changes almost immediately.

Step 4: Create accounts, then close signups

Create everyone's accounts, then set SIGNUPS_ALLOWED to "false" and run docker compose up -d again. One catch: the first time you save settings on the /admin page, Vaultwarden writes config.json to the data folder, and values in that file override environment variables. From then on, change settings in the admin page.

How to secure the vault after installation

The vault is encrypted on the client with the master password, so someone who takes over the server cannot read your passwords straight away. They could, however, tamper with the web vault's JavaScript, lock you out, or try to guess master passwords. So:

• Disable signups as soon as everyone is in. An open server is free storage for strangers.
• Use an Argon2 ADMIN_TOKEN, as in step 1. If you never use the admin page, leave the variable unset and the page stays disabled.
• Turn on two-factor authentication for every account in the web vault (TOTP app or security key).
• Use a long, unique master password. It is the only thing protecting the vault if the database file leaks.
• Update regularly. Watch Vaultwarden's releases and pull new images.
• Keep the server itself tidy. Automatic security updates, SSH keys, a firewall that opens only 22, 80 and 443. See how to secure an Ubuntu VPS.

On ZoPanel many of these come built in: Fail2ban, the firewall, automatic security updates, and a Security Center that scores your SSH configuration. See the security docs.

How to back up Vaultwarden properly

According to the Vaultwarden wiki, these are the files in the data folder that matter:

File / folder	Priority
db.sqlite3	Required: the whole vault
attachments/	Required if you use attachments
config.json	Recommended: admin page settings
rsa_key*	Recommended: signs login tokens; without them everyone has to sign in again
sends/, icon_cache/	Optional

Do not copy db.sqlite3 while the container is running; you can end up with a corrupt copy. Use SQLite's .backup command, which is safe on a database in use:

sudo apt install sqlite3
sudo sqlite3 /opt/vaultwarden/vw-data/db.sqlite3 \
  ".backup '/var/backups/vaultwarden/db-$(date +%Y%m%d-%H%M).sqlite3'"

Run it daily from cron, then send the copy (with attachments/, config.json and rsa_key*) off the server, for example to S3. The vault is already encrypted with the master password, but encrypting the backup as well is a good habit.

On ZoPanel, app data lives in /var/lib/zopanel-apps/<instance>/. Make sure your backup plan actually includes that folder, and test a restore onto another server at least once. A backup that has never been restored is a hope, not a backup.

The risks of self-hosting a password manager

Self-hosting is not automatically safer. You swap trusting a company for trusting yourself:

• If the server dies and there is no backup, the vault is gone. No support desk can restore it.
• If you forget your master password, nobody can decrypt the vault. Not even you with root.
• Patching is on you. An unpatched hole on the server that holds your passwords is a serious risk.
• Availability depends on your VPS. While it is down, you cannot add or sync new items.

If you are not ready for that, Bitwarden's cloud service is a perfectly sensible choice. If you are, Vaultwarden is one of the most worthwhile apps to self-host: light, stable, and used every day.

Conclusion

Installing Vaultwarden takes under 15 minutes. What makes the difference is what comes after: HTTPS from the start, closed signups, a hashed ADMIN_TOKEN, 2FA, and backups you have restored at least once. If you would rather skip Docker, nginx and certificates, Vaultwarden is a one-click install in ZoPanel's App Store, running in an isolated container. The App Store works on the Free plan (3 hosting accounts, 10 websites, 10 databases, no time limit); remote backups to S3 need Pro. See pricing for details.

Frequently asked questions

Is Vaultwarden safe to use?

The vault is encrypted on the client with your master password before it reaches the server, as with official Bitwarden. Overall safety depends on how you run it: HTTPS, closed signups, 2FA, regular updates and backups. Vaultwarden is a community project and is not audited by Bitwarden, Inc.

How much server does Vaultwarden need?

Very little. Around 256 MB of RAM is enough for a family or small team, so it can share a 1–2 GB VPS with websites. Disk use depends mostly on attachments.

Can I use the official Bitwarden apps with Vaultwarden?

Yes. In the Bitwarden mobile app, desktop app or browser extension, choose Self-hosted on the login screen and enter your Vaultwarden server's https:// address.

Why does Vaultwarden fail over plain HTTP?

The web vault relies on the browser's Web Crypto API, which only works over HTTPS (or on localhost). Point the domain at the server and get a certificate before creating accounts.

Can I recover a forgotten master password?

No. The master password encrypts the vault and is never stored on the server, so even an administrator cannot recover it. Write it down and keep it somewhere safe that a trusted person knows how to find.