Vaultwarden Review

The README describes a nearly complete implementation of the Bitwarden Client API. Listed features include the personal vault, Send, attachments, website icons, and a personal API key, organization features such as collections, password sharing, member roles, groups, event logs, admin password reset, Directory Connector support, and policies, two-factor options (Authenticator, Email, FIDO2 WebAuthn, YubiKey, and Duo), Emergency Access, and an admin backend. A modified web vault client is bundled in the containers. The wiki also has pages on enabling HTTPS, SMTP configuration, differences from the upstream API implementation, which container image to use, and enabling SSO support using OpenID Connect, so check that page for the current SSO status. The README states clearly that the project is not associated with Bitwarden or Bitwarden, Inc., that it was formerly called bitwarden_rs, and that one active maintainer is employed by Bitwarden and contributes independently.

Container images are the recommended install and are published to ghcr.io, docker.io, and quay.io, with Docker CLI and Docker Compose examples that map port 80 in the container to 127.0.0.1:8000 and mount a volume for persistent data, and other options are community packages or building the binary yourself, documented in the wiki. The web vault needs HTTPS and a secure context for the Web Crypto API, so it only works after you enable HTTPS, and the README recommends a reverse proxy even though the Rocket framework has built-in TLS support. The admin page at /admin needs an ADMIN_TOKEN, and the wiki recommends enabling HTTPS first, using a long random value, and storing an argon2id PHC hash generated with vaultwarden hash (use the OWASP preset for its minimums) instead of plain text, remembering to escape each $ as $$ in docker-compose.yml. Admin sessions last 20 minutes by default (ADMIN_SESSION_LIFETIME), changing the token does not end existing sessions (delete rsa_key.pem and restart to invalidate them), and saving settings creates a config.json that then takes precedence over environment variables. Backups need db.sqlite3 (backed up with sqlite3 .backup or, since version 1.32.1, the built-in /vaultwarden backup command, because the Docker image lacks sqlite3 and cron), attachments/, config.json, and the rsa_key files (encrypt these, since they hold secrets), with sends/ and icon_cache/ optional, and for MySQL or PostgreSQL you dump the tables separately. The wiki advises keeping at least one offsite copy, not relying only on filesystem or VM snapshots, and testing restores. The README does not list hardware requirements, and bugs should be reported to Vaultwarden, not to official Bitwarden support.

Users interact with the normal Bitwarden apps and browser extensions, pointing them to your server URL, so the day-to-day experience is identical to Bitwarden's. The server side is the admin backend, where you can view users and organizations, remove 2FA providers, deauthorize sessions, disable or delete users, change organization roles, check diagnostics, and invite users even when registration is disabled, and your own operational discipline. This section reflects the README and wiki; we did not deploy Vaultwarden.

• Nearly complete implementation of the Bitwarden Client API
• Organizations, collections, roles, groups, policies, and event logs
• Two-factor: Authenticator, Email, FIDO2 WebAuthn, YubiKey, and Duo
• Send, attachments, Emergency Access, and an admin backend with an argon2id-hashed token
• A built-in backup command since version 1.32.1
• Docker and Podman images with a bundled web vault, and a wiki page on OpenID Connect SSO
• Runs on a Raspberry Pi or small VPS

• Lets you self-host a password manager with official clients and very low resource use
• Includes organization features that Bitwarden's own self-hosted server reserves for paid plans
• AGPL-3.0 and a large community, with about 69,000 stars
• Thorough wiki guidance on backups, the admin token, HTTPS, and SMTP

• It is unofficial, and the maintainers disclaim liability for data loss, strongly recommending regular backups of files and the database
• A usable backup needs several pieces (the database, attachments, config.json, and RSA keys), and the keys and config contain secrets you must encrypt
• The web vault requires HTTPS, so you must set up a reverse proxy and certificates correctly, and the admin page should only be enabled after that
• Compatibility depends on tracking Bitwarden's client API, which can change, and the wiki lists differences from the upstream implementation
• You are the sysadmin of the most sensitive service you run

Vaultwarden is free under AGPL-3.0, and your only cost is hosting. The README gives no pricing and notes it is not connected to Bitwarden's paid plans.

1Password, LastPass, Keeper, and Proton Pass are commercial password managers with hosted, audited infrastructure and support. Vaultwarden gives you the Bitwarden client experience on a server you control, which suits families and small organizations that want control and low cost. The trade-off is operations and risk: you handle uptime, patching, HTTPS, and backups, and there is no vendor to call.

• Individuals, families, and small teams that want to self-host their password vault
• Homelab users already running Docker
• People who want Bitwarden's apps with organization features and no per-seat fee

• Organizations that need vendor support and a third-party-audited hosted service
• Anyone unwilling to maintain backups and HTTPS for a password server
• Teams that cannot accept an unofficial server implementation