Vaultwarden replaces Bitwarden everywhere you self-host your passwords

On July 24, 2026, Vaultwarden shipped version 1.37.0 — a release that patched seven security vulnerabilities and kept pace with the Bitwarden 2026.7.0+ client baseline. The project now counts 64,500 GitHub stars, 3,100 forks, and an active community spread across Matrix, GitHub Discussions, and Discourse. One of its core maintainers is employed by Bitwarden itself — the kind of maturity signal that few alternative server projects ever reach.

Here is the question, asked plainly: why would anyone who self-hosts their passwords still run the official Bitwarden server? The answer fits in three numbers: 50 MB of RAM for Vaultwarden, 2 GB for the official stack. SQLite out of the box versus SQL Server required. One Docker container instead of a dozen. The case is closed before you even start typing docker compose.

Bitwarden, rewritten in Rust — and shrunk by a factor of 40

Vaultwarden began as bitwarden_rs in 2018, created by Daniel García with a simple premise: deliver a Bitwarden-compatible API without dragging in the .NET and SQL Server baggage that makes the official implementation a resource hog. The project was renamed Vaultwarden with version 1.21.0 in 2021 to draw a clear line between the community effort and the Bitwarden trademark.

Rust is the first efficiency multiplier. The official server runs on .NET with SQL Server — a stack that demands at minimum 2 GB of RAM just for the database engine, not counting the constellation of microservices that orbit it. Vaultwarden compiles to a single native binary that bundles everything: the API, the web vault, and the storage layer. The official Docker image is under 100 MB compressed, and an idle instance consumes between 40 and 80 MB of RAM. On a Raspberry Pi 4, it stays below 100 MB even in production with multiple active users.

The default storage backend is SQLite — no external database server to provision, tune, or back up separately. If you grow beyond a handful of concurrent users, Vaultwarden also supports MySQL and PostgreSQL through the DATABASE_URL variable. But for a household, a family, or a small team, SQLite handles the load without breaking a sweat.

Everything Bitwarden charges for — free, without asterisks

Bitwarden’s pricing model gates features behind tiers. The free plan covers the basics, but built-in TOTP, encrypted file attachments, emergency access, vault health reports, and organizations with collection sharing all require a Premium ($10/year) or Families ($40/year) subscription.

Vaultwarden has no paywall. Every single premium-tier feature is available with zero restrictions:

• Built-in TOTP: generate 2FA codes directly inside the vault entry, no separate authenticator app needed. The code auto-copies to the clipboard after password autofill.
• Encrypted file attachments: attach files to any vault item — passport scans, SSH keys, seed phrase backups. End-to-end encrypted, stored on your own disk.
• Organizations and sharing: create collections, share credentials with your family or team, assign roles (admin, manager, user), and enforce security policies — no subscription required.
• Emergency access: designate a trusted contact who can access your vault after a configurable waiting period. No Bitwarden Inc. intervention needed.
• Vault health reports: reused passwords, known breach exposure, password strength scoring — the same reports as the Premium plan, executed locally on your server.
• Send: share a file (up to 500 MB) or encrypted text via an ephemeral link, optionally protected by a password and an expiration date.
• Passkeys (FIDO2/WebAuthn): store and use passkeys for passwordless authentication on supporting sites.
• SSO: Vaultwarden 1.37.0 improves single sign-on support, useful for organizations federating vault access.

None of these features are throttled by user count or sync limits. The official Bitwarden clients — desktop, mobile, browser extension, CLI — work with Vaultwarden without modification: you change the server URL in the settings and log in.

A deployment that fits in three commands

The minimal docker-compose.yml for a Vaultwarden instance is barely longer than a tweet:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vault.yourdomain.com"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 127.0.0.1:8000:80

docker compose up -d

That is it. No separate database, no Redis, no message queue, no twelve containers to orchestrate. The admin interface is at /admin with a token you configure in the ADMIN_TOKEN environment variable. It handles user management, invitations, organizations, and security policies from a clean web dashboard.

The one hard requirement is HTTPS. The web vault depends on the Web Crypto API, which is only available in a secure context. A reverse proxy — Caddy, Nginx, or Traefik — with a Let’s Encrypt certificate solves this in five minutes. The GitHub repository provides proxy configuration examples for every common setup.

Three deployment precautions. First, pin your version with an exact tag (1.37.0, not latest) in your Compose file to avoid surprise upgrades on docker compose pull. Second, never expose port 80 directly to the internet — unencrypted traffic to a password manager is operational suicide. Third, disable SIGNUPS_ALLOWED=true after creating your account — otherwise anyone who discovers your instance URL can register.

You hold the keys — provided you hold the backups

Vaultwarden inherits Bitwarden’s security model: end-to-end client-side encryption. The server never sees your passwords in plaintext. Your vault is encrypted with your master password before it leaves your device; the server stores ciphertext, not cleartext. Even with root access to the machine hosting Vaultwarden, an attacker cannot decrypt vault contents without each user’s master password.

This model has a direct trade-off: if you lose your master password, your data is gone forever. There is no “password reset” mechanism — that would be a backdoor. The only option available to the administrator is deleting the account so the user can start over.

What encryption does not protect is data availability. A disk failure, an accidental docker volume rm, a SQLite corruption — and your vault vanishes. The official documentation recommends automated backups of the /data directory (which contains db.sqlite3, attachments, and configuration files). For a household, a daily rsync to a NAS or S3 bucket is sufficient; for an organization, the 3-2-1 strategy (three copies, two media, one off-site) remains the gold standard.

On the hardening front, version 1.37.0 patched seven Medium-severity vulnerabilities (CVSS 4.3 to 6.3), including an SSRF flaw on the icon endpoint and a cross-organization cipher access issue. The team follows a coordinated disclosure policy: advisories are published on GitHub after CVE assignment. If you self-host, you are responsible for applying those patches — that is the price of sovereignty.

Verdict

Vaultwarden is the de facto standard for self-hosted password management. There is no debate: the project implements nearly the entire Bitwarden API, every official client is compatible, premium features are free, and the memory footprint is forty times smaller than the official server.

The question is not “Vaultwarden or official Bitwarden?” — unless you need SCIM, directory sync, or SSO with your corporate IdP, the official server has zero arguments in its favor. The real question is “self-hosted or cloud?”, and the answer depends on your operational discipline.

If you are willing to back up daily, apply updates within 48 hours, and monitor security advisories, Vaultwarden is strictly superior: you alone hold your secrets, you depend on no subscription, and no one can unilaterally shut down your account or change the terms of service.

If that discipline feels like a burden, Bitwarden Cloud at $10 per year remains an excellent service — audited, SOC 2 certified, maintained by a salaried team. But be clear about what is happening: Vaultwarden is not the inferior option. You are choosing to delegate responsibility.

References

• Vaultwarden GitHub — dani-garcia/vaultwarden
• Vaultwarden 1.37.0 Release Notes
• Vaultwarden Wiki — Setup and configuration
• Vaultwarden.com — Community site
• Noted.lol — Self-Host Vaultwarden Password Manager
• Bitwarden Help Center
• Bitwarden vs Vaultwarden Self-Hosted — Secure Tools Guide