Aditya Sharma

Vaultwarden vs Bitwarden Self-Hosted: Which Server to Run

On this page, 10 sections

Vaultwarden is an unofficial, Rust-written server that speaks the Bitwarden client API, so the official Bitwarden apps and browser extension work against it. Bitwarden’s own self-hosted server is the company’s official stack, now with a lighter single-container option called Lite.

For one person or one family, Vaultwarden is the smaller thing to run. For a business that wants vendor support, the official server is the one built for it.

I read the Vaultwarden README and wiki, the Bitwarden self-hosting and licensing docs, the Bitwarden pricing page, and the GitHub API for both repositories on 11 October 2026. Every number below carries that read date. I did not install either server for this post, so there is no test run and no benchmark in it. It is a comparison of what each project documents about itself.

If you are still deciding whether Bitwarden is the right manager at all, why Bitwarden is my go-to password manager covers that first. This post assumes you have chosen it and are deciding what to run the server on.

What Vaultwarden is, and what “unofficial” means

The project’s GitHub description reads “Unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs”. The README calls it an alternative server implementation of the Bitwarden Client API, compatible with the official clients, and says it suits self-hosted deployments where running the official resource-heavy service might not be ideal.

“Unofficial” is not a marketing word here. The README says the project is not associated with Bitwarden or Bitwarden, Inc. It also spells out the practical consequences:

  • Bugs go to Vaultwarden. The README tells you not to use the official Bitwarden support channels for it.
  • The README states there is no liability for data loss and that backups are highly recommended.
  • One active maintainer is employed by Bitwarden and contributes on their own time. The README presents that as a fact about the contributor, not as an endorsement.
  • It was renamed from bitwarden_rs to avoid confusion and trademark issues.

So if your vault server misbehaves, there is no vendor to call. You have a community issue tracker, discussions, a forum and Matrix, all listed in the README.

The project numbers, read on 11 October 2026

From the GitHub API, on 11 October 2026:

  • dani-garcia/vaultwarden: 68,858 stars, AGPL-3.0 licence, last push 10 October 2026, not archived, created 17 February 2018. Latest release 1.37.4, published 5 October 2026.
  • bitwarden/server: 20,276 stars, last push 11 October 2026. GitHub shows its licence as “Other” because the repository carries more than one. Latest release v2026.9.2, published 30 September 2026.

Stars measure attention, not quality, and the two repositories do different jobs (one is a compatible reimplementation, the other is the product), so I would not read the gap as a verdict. What the dates do show is that both had pushes on 10 and 11 October 2026.

The licence row matters more. Bitwarden’s LICENSE_FAQ.md says the main server is AGPL 3.0, while code under the /bitwarden_license directory is “source available” under the Bitwarden License, which requires a paid subscription for production use. If you read “open source” as meaning every line is free to run in production, that sentence is the exception to check.

Is Vaultwarden audited? The claim most comparisons get wrong

You will often read that Vaultwarden has never been audited. The project’s own wiki says otherwise: its home page states “There have been several audits done on Vaultwarden” and points to an Audits page. That page lists:

  • An audit by the German BSI of version 1.30.3, with a German report and an English translation.
  • A penetration test by ERNW in October 2024. It found three vulnerabilities, including an authentication bypass in versions before 1.32.5, which were responsibly disclosed.
  • A note that some audits were not published.

Read that as two things at once. It is not unaudited. And one of the audits found an authentication bypass, which is exactly why the wiki’s own advice, on its container image page, is to keep the server updated. I attribute these details to the wiki; I did not read the BSI or ERNW reports themselves.

I also queried the GitHub security advisories endpoint for the repository. It returned 30 published advisories, 19 rated medium and 11 rated high, with 11 of them dated 3 October 2026.

I did not check which release fixed each one, and I did not run the same query for bitwarden/server, so this is not a head-to-head. It does tell you the project publishes its problems and that the practical risk is running an old version.

Bitwarden’s own audit page says it undergoes annual third-party security audits, naming Cure53 among the auditors. That covers the company’s product. It does not extend to Vaultwarden, which is a separate codebase.

What each one asks of your server

Bitwarden’s self-host page lists the deployment options: standard Linux, manual, offline, Windows, Kubernetes with Helm, and Lite. Everything except Lite ships with Microsoft SQL Server Express by default (an external SQL Server 2019 or later is allowed).

The Linux install page gives a minimum of a 1.4 GHz x64 CPU, 2 GB of RAM and 12 GB of storage, with 2 GHz dual core, 4 GB and 25 GB recommended, plus Docker Engine 26 or newer. It also notes the default SQL Server Express database has a 10 GB size limit.

Lite is the part worth knowing about, because it closes much of the “official is too heavy” argument. Per its docs it is a single Docker image (ghcr.io/bitwarden/lite) intended for personal use and home labs, not for business contexts.

It lists a minimum of 200 MB of RAM, 1 GB of storage and Docker Engine 26 or newer, and supports SQL Server, PostgreSQL, SQLite and MySQL or MariaDB. It needs an installation ID and key from bitwarden.com/host, and backups and database maintenance are yours. The page notes it was renamed from “Unified” in December 2025.

Vaultwarden’s README gives no RAM figure, so I will not invent one. What it does give is a single container with SQLite by default and MySQL or PostgreSQL as options (per the wiki’s container-image page), and a data folder you can back up as files. Here is the README’s own Compose example:

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: unless-stopped
    environment:
      DOMAIN: "https://vw.domain.tld"
    volumes:
      - ./vw-data/:/data/
    ports:
      - 127.0.0.1:8000:80

I copied this from the README and parsed it as YAML to confirm it is valid; I did not start the container. The README says the web vault needs HTTPS and a secure context because it relies on the Web Crypto API, and recommends a reverse proxy.

The port binding above exposes it to the local machine only, which is why a proxy is part of the setup, not an optional extra. The wiki also lists image tags (latest, testing, version numbers, latest-alpine) across three registries, so pin a version if you do not want surprises.

Features and cost, per the docs

Vaultwarden’s README lists: a personal vault, Send, attachments, website icons, a personal API key, organizations (collections, sharing, roles, groups, event logs, admin password reset, Directory Connector, policies), two-factor options (authenticator, email, FIDO2, YubiKey, Duo), emergency access, an admin backend and a modified web vault. The wiki adds TOTP, trash, master password re-prompt and single sign-on through OpenID Connect.

The wiki is also clear about direction. It describes the project as aimed at individuals, families and smaller organizations, and says features mostly useful to larger organizations, such as directory sync, are not a priority.

As documented gaps it lists the Bitwarden Public API (partial), login with passkeys and new device login protection as things that may be added, and custom roles and some policies as things that probably will not be.

On cost, Bitwarden’s licensing page says self-hosting Bitwarden is free, but some features must be unlocked with a registered license file. Its pricing page lists Premium at $1.65 a month billed annually, which is $19.80 a year (1.65 times 12 is 19.80, checked), and Families at $3.99 a month, $47.88 a year. The Premium features it names include the integrated authenticator, file attachments, emergency access and security reports.

What I could not establish from the docs is how Vaultwarden’s inclusion of those same features relates to Bitwarden’s paid tiers. That is a licensing and fairness question, not a technical one, and I will not guess at it.

If you run Vaultwarden, read its licence and Bitwarden’s terms and decide for yourself. For a wider view of whether running it yourself is worth the time, see the real cost of self-hosting vs SaaS.

Backups decide whether this was a good idea

With either server, you are now the operator of the file that holds every password you own. The Vaultwarden wiki’s backup page is blunt about details people skip:

  • The data folder holds db.sqlite3, attachments, sends, config.json, the RSA keys and an icon cache. Back up all of it, not just the database.
  • Use SQLite’s online backup (.backup), not a plain file copy of a live database. Since version 1.32.1 there is also a built-in /vaultwarden backup command.
  • The Docker image has no sqlite3 binary and no cron daemon, so scheduling is something you build outside the container.
  • config.json holds the admin token and mail credentials in plaintext. Protect the backups accordingly.
  • Before a restore, stop the container and delete any stale -wal file.

The admin page is off until you set ADMIN_TOKEN. The wiki recommends an argon2id-hashed token produced with vaultwarden hash, and strongly recommends HTTPS first. The default admin session lasts 20 minutes.

How I would choose

  • Pick Vaultwarden if it is you or your family, you are comfortable being your own support desk, and you will keep it updated and backed up.
  • Pick Bitwarden Lite if you want the official code on a small box and accept that its docs restrict it to personal and home-lab use.
  • Pick the standard Bitwarden deployment if the vault is for a company, you need the vendor to answer when it breaks, or you rely on the larger-organization features Vaultwarden says are not a priority.
  • Pick neither self-hosted if you will not take backups seriously. Bitwarden’s hosted plan exists for that case, and so does the browser’s built-in manager, compared in Bitwarden vs Chrome’s password manager.

That last point is the honest centre of the question. Neither server is risky because of its code. The risk is a vault you cannot restore.

Questions people ask

Do the official Bitwarden apps work with Vaultwarden?

Yes, that is the design. The README says it is compatible with the official clients. The wiki warns that upstream client changes can break old servers, so keep the server current.

Is Vaultwarden safe?

It has been audited at least twice per its wiki, and it has also had published vulnerabilities, including an authentication bypass found in 2024. Safe depends mostly on updates, HTTPS and backups on your side.

Can I get official support for Vaultwarden?

No. The README tells you to report bugs to Vaultwarden and not to use the official Bitwarden support channels.

Do this today

Decide where your restore test will happen before you install anything. Write down the one machine that will hold the backup, and what you will do on the day the server dies. If you cannot answer that, use Bitwarden’s hosted plan.

Resources

Tell me where I am wrong

Your email is not published and I do not add it to any list. Corrections with a source are the ones I act on fastest.

More in Cyber Security

Every piece in Cyber Security

  1. Verify the GPTBot IP Address: Real Crawler or Fake User Agent A user agent proves nothing. Check the IP against OpenAI's published JSON, and Googlebot with reverse plus forward DNS. Scripts included, each one run. AI 9 min
  2. Lost YubiKey: What to Do in the First Hour and the First Week There is no central off switch for a lost YubiKey. You remove it service by service. Here is the order, what Google and Bitwarden… Cyber Security 6 min
  3. Is Chrome’s Password Manager Safe? What Google’s Own Pages Say Chrome encrypts and breach-checks saved passwords, but Google's own security blog names a gap with malware on Windows. What the pages say and what… Cyber Security 6 min
  4. Move Chrome Passwords to Bitwarden: Export, Import and Clean Up Export Chrome passwords as a CSV, import them once into Bitwarden, verify the count, then turn off Chrome saving and delete the CSV. Steps… Cyber Security 6 min
  5. Titan Security Key vs YubiKey: What Differs on the Spec Pages Both are FIDO security keys. I compared what Google and Yubico publish: protocols, connectors, passkey support and where the Titan's page goes quiet. Cyber Security 6 min
  6. How to Block AI Crawlers in WordPress (robots.txt Is Not a Lock) One robots.txt group per AI crawler token, a tested WordPress snippet, what each vendor documents, and why a physical robots.txt file can make your… AI 9 min