Vaultwarden review: lightweight Bitwarden server for self-hosters

What Vaultwarden is and why it exists

Vaultwarden is an unofficial Rust reimplementation of the Bitwarden server API, created specifically to address the resource demands of the official Bitwarden self-hosted server. The official server requires Microsoft SQL Server and a minimum of two gigabytes of RAM, making it impractical for home servers and low-cost virtual private servers. Vaultwarden solves this by using SQLite by default and running comfortably on hardware as modest as a Raspberry Pi with under fifty megabytes of memory at idle.

The project was formerly known as bitwarden_rs and was renamed in 2021 to avoid trademark confusion with the official Bitwarden product. Despite being unofficial, Vaultwarden is fully compatible with all official Bitwarden client applications, including browser extensions, desktop apps, mobile apps, and the command-line tool. Users simply point their Bitwarden client at a custom server URL and the experience is functionally identical to using the official cloud service.

Vaultwarden unlocks features that the official Bitwarden server gates behind paid subscription tiers. This includes TOTP authenticator code storage, file attachments on vault items, emergency access for trusted contacts, encrypted Send file sharing, and unlimited organization users for password sharing. For self-hosters, this represents the full Bitwarden feature set with zero licensing cost beyond server hosting.

Resource footprint and deployment

The defining characteristic of Vaultwarden is its minimal resource consumption. Multiple sources report idle memory usage between thirty and fifty megabytes of RAM, with successful deployments documented on hardware ranging from Raspberry Pi single-board computers to virtual private servers with just five hundred twelve megabytes of memory. One user reported running the software on a bare-metal installation with a single CPU core and five hundred twelve megabytes of RAM without performance issues.

Deployment typically happens via the official Docker container image, distributed through GitHub Container Registry, Docker Hub, and Quay. A basic Docker Compose configuration can have the service running in minutes. The container exposes port eighty by default and requires HTTPS for the web vault to function, so most production deployments place Vaultwarden behind a reverse proxy like Caddy, Nginx, or Traefik to handle TLS termination. Database options include SQLite for single-file simplicity, or MySQL and PostgreSQL for installations expecting higher load or more complex backup requirements.

Feature parity and limitations

Vaultwarden implements nearly all features available in the official Bitwarden server. This includes password vault syncing across devices, organizations for shared collections, granular member roles and groups, event logs, file attachments, the Send feature for encrypted temporary sharing, and multiple two-factor authentication methods including TOTP, FIDO2 WebAuthn hardware keys, Duo Security, and email-based codes. An admin panel accessible via web interface allows user management, invitations, and server configuration without touching configuration files.

Recent releases have added support for single sign-on via OpenID Connect, addressing one of the most frequently requested enterprise features. However, Vaultwarden still lacks some capabilities that larger organizations require, including SCIM provisioning for automated user lifecycle management and directory connector integration with Active Directory or LDAP. The project also does not undergo formal third-party security audits, which means it cannot provide SOC 2 Type II attestations or similar compliance documentation that regulated industries often require.

Because Vaultwarden is an independent reimplementation tracking the upstream Bitwarden API rather than a fork, it depends on the maintainer community to reverse-engineer and implement changes when Bitwarden updates its protocol. This has not been a significant problem historically, but it does represent a maintenance dependency that official software does not carry.

Operational responsibility and support

Self-hosting Vaultwarden means accepting full responsibility for the security and availability of your password vault. This includes configuring HTTPS correctly, hardening the admin panel or disabling it after initial setup, implementing firewall rules, establishing automated backup routines for the database and data directory, and maintaining a tested disaster recovery procedure. The project documentation explicitly states that it cannot be held liable for data loss and strongly recommends regular backups.

Support is community-driven. The project maintains a Discourse forum and GitHub discussions where users help one another troubleshoot issues, but there is no commercial support contract, no guaranteed response time, and no vendor to call when the service is down. For individuals and small teams comfortable with this model, the active community and extensive third-party guides make most problems solvable. For organizations that need enforceable service level agreements or prefer to outsource operational risk, managed Bitwarden cloud or the official self-hosted server with a support plan is the appropriate choice.

Updates arrive regularly, with releases in 2026 adding OpenID Connect SSO support and improvements to mobile app compatibility. The project has over forty thousand GitHub stars and benefits from contributions by a global community of developers, suggesting healthy long-term viability. However, the lack of a corporate entity behind the project means users bear the risk of maintainer turnover or shifting project priorities.

How it compares to alternatives

Against the official Bitwarden self-hosted server, Vaultwarden trades compliance certifications and enterprise SSO for dramatically lower resource consumption and zero licensing cost. The official server provides SOC 2 attestations, a bug bounty program, and commercial support, but requires a multi-container stack with Microsoft SQL Server and at least two gigabytes of RAM. Vaultwarden is the clear choice for individuals and small teams on modest hardware; Bitwarden official is appropriate for regulated enterprises.

Compared to cloud-hosted commercial password managers like 1Password or the managed Bitwarden cloud service, Vaultwarden offers complete data sovereignty at the cost of operational overhead. A family of six using Vaultwarden on a five-dollar-per-month VPS pays sixty dollars annually for hosting versus the forty-eight dollars Bitwarden charges for a Families plan, but gains full control over where vault data resides and avoids any third-party breach risk. The decision hinges on whether you value control and privacy enough to manage your own infrastructure.

Among self-hosted alternatives, Passbolt targets team collaboration with per-resource access controls and audit logs but runs a heavier PHP stack. KeePassXC offers offline file-based vaults synced via Nextcloud or Syncthing, eliminating server infrastructure entirely but losing real-time multi-device sync and browser integration quality. Vaultwarden sits in the middle: lighter than most server-based solutions, more polished than file-sync approaches, and uniquely leveraging the mature Bitwarden client ecosystem.