Vaultwarden: self-hosted password manager in Docker

Vaultwarden is an alternative implementation of the Bitwarden server API, written in Rust. The official Bitwarden browser extensions, desktop apps and mobile apps connect to it as if it were the Bitwarden cloud, while your vault stays on your own server. It is a single small container, which makes it a popular first self-hosted service.

Vaultwarden is a community project and is not affiliated with Bitwarden Inc.

What you need

• A server with Docker and the Compose plugin
• A domain or subdomain and a reverse proxy that terminates HTTPS. The web vault and the apps need a secure connection, plain HTTP on an IP address is not enough.

Install

Create a folder and a compose.yaml in it. This is the file from the project README, with the domain replaced by an example:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.example.com"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 127.0.0.1:8000:80

• DOMAIN is the address users will open, with https://.
• ./vw-data/ holds everything: the database, attachments and keys.
• The port is bound to 127.0.0.1, so the container is reachable only from the server itself. Point your reverse proxy at 127.0.0.1:8000.

Start it:

docker compose up -d

First run

Open your domain and create an account. The master password is not stored anywhere and cannot be recovered, so write it down.

Then install a Bitwarden app or browser extension. On the login screen choose the self-hosted option and enter your domain as the server URL.

Backup

Back up the whole vw-data folder. Losing it means losing every password, so keep a copy on another machine.

Updating

docker compose pull && docker compose up -d