Vaultwarden is a Rust-rewrite of the Bitwarden server - fully compatible with the official Bitwarden apps, but you own the database. No monthly subscription, no cloud lock-in, all premium features unlocked. From $3/mo.
Bitwarden Cloud is fine. LastPass was fine, until it wasn't. SaaS password managers are juicy targets because they store everyone's vault in one place - even if encrypted, the attacker has all the time in the world to crack what they took.
Vaultwarden runs your vault on a host nobody's enumerating. Same Bitwarden apps on every device. Same end-to-end encryption. But the database lives on a VPS only you know about.
Your master password never leaves your device. The server stores only the encrypted blob - same as upstream Bitwarden.
Official browser extensions, iOS, Android, desktop - all point at your VPS. Point your Bitwarden client at vault.you.com and go.
The Rust binary uses single-digit megabytes. Pulsar Nano runs Vaultwarden + a reverse proxy with room to spare.
TOTP, attachments, organizations, emergency access - all unlocked by default in Vaultwarden.
Even with attachments and a few users, you'll be at low single-digit RAM.
Most of that is DNS propagation. The actual setup is one Docker command.
docker pull vaultwarden/server:latestPulsar Pro+ includes daily snapshots. If your vault corrupts, roll back to last night.
99.9% SLA. Because the one time you need a password is the time you can't reach your vault.
Your data is encrypted client-side anyway, but we also don't scan, profile, or analyze it.
If your reverse proxy is misbehaving, we'll actually look at the logs with you.
$3/mo is less than Bitwarden Premium and you keep your data on your own metal.
Concrete setup details for the first deploy, the firewall, and the first thing to check when something acts strange.
Expose only HTTPS on 443 through a reverse proxy. Keep the admin token private and do not expose it casually.
Nano is enough for personal and family vaults. Starter gives extra room for attachments and a reverse proxy stack.
Use Docker Compose, mount /data persistently, enable regular SQLite backups, and store backups off-host.
If mobile apps fail login, check HTTPS, websocket support, DOMAIN, and whether the reverse proxy preserves headers.