Self-host a password manager with Vaultwarden

Vaultwarden is a lightweight server that speaks the Bitwarden protocol, so every official Bitwarden app and browser extension works with it. It runs in one container and uses very little memory.

1. Before you start

You need Docker installed, a domain name pointing at your server, and a reverse proxy with HTTPS. Our Docker guide and our Nginx and Let's Encrypt guide cover both.

HTTPS is not optional here. The Bitwarden clients refuse to connect over plain HTTP, and this is a password vault.

2. Generate an admin token

The admin page needs a hashed token. Vaultwarden generates it for you:

$ docker run --rm -it vaultwarden/server /vaultwarden hash

Enter a strong password when asked, twice. It prints a hash starting with $argon2id$. Copy the whole string and keep the password itself in a safe place.

3. Write the Compose file

services:
  vaultwarden:
    image: vaultwarden/server:latest
    container_name: vaultwarden
    restart: always
    environment:
      DOMAIN: "https://vault.example.com"
      SIGNUPS_ALLOWED: "true"
      ADMIN_TOKEN: "PASTE_THE_ARGON2_HASH_HERE"
    volumes:
      - ./data:/data
    ports:
      - "127.0.0.1:8080:80"

Three details matter:

• DOMAIN must be the exact HTTPS address you will use. Vaultwarden builds links and security settings from it.
• The port binds to 127.0.0.1, so the container is reachable only from the server itself. Nginx handles the outside world.
• If your hash contains $ characters and you use an .env file, each $ must be doubled to $$. Putting the hash directly in the Compose file as shown avoids that problem.

$ cd /opt/vaultwarden
$ docker compose up -d
$ docker compose logs -f

4. Put Nginx in front

Create a server block that proxies to http://127.0.0.1:8080, following our Nginx and Let's Encrypt guide, then run Certbot for vault.example.com. Open the site over HTTPS and check that the padlock is there before you go further.

5. Create your account, then close the door

Visit your domain, click Create Account, and register. Then edit the Compose file:

      SIGNUPS_ALLOWED: "false"

$ docker compose up -d

6. Connect your apps

In any Bitwarden client, before logging in, open the settings icon and set the server URL to https://vault.example.com. Then log in with the account you created. This works in the browser extensions, the mobile apps, and the desktop apps.

Turn on two-factor authentication in your account settings once you are in.

7. Back it up

Everything lives in the ./data directory next to your Compose file, with the vault itself in an SQLite database. Copy it off the server on a schedule:

$ docker compose stop
$ sudo tar czf /root/vaultwarden-backup.tar.gz -C /opt/vaultwarden data
$ docker compose start

$ scp [email protected]:/root/vaultwarden-backup.tar.gz .

Stopping the container for the copy keeps the database file consistent. Test a restore once, on another server, before you trust it.

Quick reference

Where to go next

Set a backup schedule and actually test a restore. Then add fail2ban for the login endpoint if the vault is exposed to the public internet, and keep the image current with docker compose pull && docker compose up -d, since security patches in a password manager are worth applying quickly.