Chapter 6 · 6.3
Using Vaultwarden on your own VPS
Vaultwarden is a server for your password vault that you run yourself, for example on a VPS. It works with the regular Bitwarden apps and extensions. Your vault is then stored on your own server rather than with another company. This article explains how to use Vaultwarden. To learn how to install it, with Docker, https and server backups, see the VPS manual, in the recipe Vaultwarden: your own password vault.
Good to know first
- Vaultwarden is not made by Bitwarden. It is an unofficial project run by volunteers that speaks the same language as the Bitwarden apps. If you have a problem, report it to Vaultwarden, not to Bitwarden.
- Features that require a paid subscription with Bitwarden, such as emergency access and showing TOTP codes, work for everyone in Vaultwarden.
- You are the administrator. You handle updates, security, https and backups yourself. WebOké does not manage your VPS and does not help with software on your server.
- Logging in to your vault with a passkey is not (yet) possible in Vaultwarden. You can, however, store passkeys for other websites in your vault (see Saving and using passkeys).
Connecting the apps to your own server
- Open the Bitwarden browser extension, desktop app or mobile app.
- On the login screen, choose self-hosted as the region.
- Enter the address of your Vaultwarden as the server URL, for example
https://kluis.jouwdomein.nl. Save it. - Log in with the account you created on your Vaultwarden.
You open the web vault at the same address in your browser. Your address must use https with a valid certificate. Without https the web vault will not work, and the apps on your phone often refuse to connect without a proper certificate.
What else to set up
| Topic | Why |
|---|---|
| Sending email | Vaultwarden needs to be able to send email for invitations, emergency access and codes by email. On a WebOké VPS, outgoing port 25 is closed. So let Vaultwarden send through a mailbox, using port 587 or 465 (see All settings at a glance: servers, ports and security). |
| Closing sign-ups | Once you have created the accounts you need, turn off sign-ups for new users. Otherwise anyone on the internet can create an account on your server. |
| Two-step login | Turn it on for every account, as described in Securing your Bitwarden account with two-step login. Keep the recovery code safe. |
| Server backup | Back up the Vaultwarden database and attachments daily, with at least one copy in another location. Test restoring it. |
| Your own export | As a user, also make an encrypted export of your vault now and then (see Making a backup or export of your vault). If something goes wrong with your server, you will still have it. |
Sharing in a team and emergency access work just as they do in Bitwarden (see Sharing passwords with your team or family and Arranging emergency access in case something happens to you). All users then need an account on your server.
Please note: Your password vault is the most important thing you have. If your server is down, your apps can still open the vault with what they already have, but you cannot sync or set it up on a new device. Only run Vaultwarden if you really want to take on the management. Otherwise, Bitwarden in the European region is the simpler choice (see Bitwarden, KeePassXC, Vaultwarden or your browser: which one suits you?).