Vaultwarden: An Overview and Getting-Started Guide

What it is

Vaultwarden is an open-source, alternative server implementation compatible with the Bitwarden Client API, written in the Rust programming language. Previously known under the project name Bitwarden_RS, the application was renamed starting in version 1.21.0. This change was implemented to separate the software clearly from the official server project and to prevent potential confusion regarding trademarks and branding. The source code is distributed under the GNU Affero General Public License version 3 (AGPL-3.0).

The software provides a backend service capable of managing and synchronizing credentials while maintaining compatibility with official Bitwarden client software, including desktop applications, mobile apps, and web browser extensions. According to the project README, Vaultwarden serves as an alternative server implementation designed for self-hosted deployments where running the official, resource-heavy service might not be ideal.

The Vaultwarden project is independent and is not associated with Bitwarden or Bitwarden, Inc. The documentation clarifies that while one active Vaultwarden maintainer is employed by Bitwarden, that individual contributes independently on their own personal time, and those contributions remain subject to review by the other project maintainers.

Because Vaultwarden is maintained separately from the upstream service, users are requested by the maintainers not to direct inquiries, bug reports, or crash reports to official Bitwarden support channels. Instead, issues and suggestions should be brought directly to the Vaultwarden community via their issue tracker, GitHub Discussions, Discourse forum, or Matrix chat room. Furthermore, the project documentation explicitly states that the maintainers cannot be held liable for any data loss involving passwords or attachments and advises all administrators to establish routine backups of their databases and persistent files.

What it can do

Vaultwarden delivers a nearly complete implementation of the Bitwarden Client API, allowing users to interact with their self-hosted server using standard Bitwarden client tools. A modified Web Vault client comes bundled directly inside the project’s official container images, providing access to a browser-based management interface out of the box.

For individual credential handling, Vaultwarden supports personal vault items, secure credential records, and file attachments. It also includes support for Bitwarden Send, a mechanism used to transmit text snippets and documents securely. Users can configure website icon retrieval, generate and manage personal API keys for development tasks, and set up Emergency Access to grant trusted contacts emergency permissions to vault contents under specified conditions.

Vaultwarden also incorporates comprehensive multi-user and organizational management features. Server administrators can create organizations to facilitate collaborative password sharing. Within organizations, credentials can be structured into collections, which operate as shared folders with controlled visibility. The system provides role-based access control, user groups, administrative password resets, event logs for tracking system actions, and policy enforcement to maintain organization-wide security rules. Organizations can also synchronize user accounts using the Directory Connector utility.

To protect user accounts, Vaultwarden supports several multi-factor authentication (MFA) mechanisms, also known as two-step login. Users can secure authentication using standard software authenticator applications that provide time-based one-time passcodes (TOTP), email-based verification codes, hardware-based FIDO2 WebAuthn keys, YubiKey physical devices, or Duo security services.

Additionally, the software features a dedicated Vaultwarden Admin Backend. This interface gives administrators a specialized portal to oversee operational configurations, review active settings, and manage server-level controls.

How to get started

The primary and recommended method for installing and running Vaultwarden is through container images published to container registries, including ghcr.io, docker.io, and quay.io. While users can also compile the software binary directly from source code or install third-party community packages, the project documentation cautions that community packages may lag behind official releases or alter default configuration structures.

When deploying Vaultwarden with the Docker command-line interface, a persistent volume should be mapped from the host to the container’s /data/ directory to store application data across restarts. The project documentation provides the following standard deployment commands:

docker pull vaultwarden/server:latest
docker run --detach --name vaultwarden \
  --env DOMAIN="https://vw.domain.tld" \
  --volume /vw-data/:/data/ \
  --restart unless-stopped \
  --publish 127.0.0.1:8000:80 \
  vaultwarden/server:latest

Administrators who utilize Podman can substitute podman in place of docker using identical arguments. The host storage path /vw-data/ can be adjusted to match any preferred directory structure on the host machine.

For environments organized around Docker Compose, configuration settings can be defined in a compose.yaml file. The documentation provides the following configuration:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vw.domain.tld"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 127.0.0.1:8000:80

Network security and encryption are mandatory elements of deployment. The project documentation emphasizes that the bundled web vault requires HTTPS and a secure context to interface with the browser’s Web Crypto API. Without enabling HTTPS, the web vault will not function. Although Vaultwarden is built on the Rocket web framework—which has integrated TLS functionality—the project maintainers recommend deploying a reverse proxy in front of the application to manage certificates, handle encryption, and route incoming requests.

Pricing and requirements

Vaultwarden is available as open-source software under the AGPL-3.0 license. Regarding commercial plans, subscriptions, and enterprise tiers, pricing and plans are subject to the official page at Bitwarden.

Operating Vaultwarden requires a host system capable of running container runtimes like Docker or Podman, or a system equipped to build the application binary from source. Host storage must be allocated to preserve application databases, configuration files, and uploaded attachments across container lifecycle events.

From a networking standpoint, a domain name and an active HTTPS setup are necessary requirements. Because modern web browsers restrict Web Crypto API functionality to secure contexts, establishing HTTPS—preferably managed via a reverse proxy as recommended in the documentation—is essential for full operation of the web vault interface.

Who it is for

According to the project maintainers, Vaultwarden is directed at serving the self-hosting community, specifically individuals, families, and small organizations. It is tailored for users who prefer to maintain their own private credential infrastructure while using standard Bitwarden client software across desktop, mobile, and web environments.

It is particularly suitable for administrators seeking a lightweight alternative server implementation in situations where running the official resource-heavy service might not be ideal. Because maintaining Vaultwarden requires operating container software, configuring reverse proxies, managing domain names, and maintaining regular backup routines, it is intended for individuals who are comfortable managing self-hosted infrastructure.

Alternatives

The Bitwarden server provides an official backend implementation for managing passwords and organization data.

The KeePassXC project offers an open-source password manager designed to store and protect credentials locally.

Sources

• https://github.com/dani-garcia/vaultwarden
• https://bitwarden.com/
• https://github.com/bitwarden/server
• https://github.com/keepassxreboot/keepassxc